Disclosure of Records and Information, 46075-46098 [2018-19384]

Agencies

• BUREAU OF CONSUMER FINANCIAL PROTECTION

[Federal Register Volume 83, Number 177 (Wednesday, September 12, 2018)]
[Rules and Regulations]
[Pages 46075-46098]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2018-19384]


=======================================================================
-----------------------------------------------------------------------

BUREAU OF CONSUMER FINANCIAL PROTECTION

12 CFR Part 1070

[Docket No. CFPB-2016-0039]
RIN 3170-AA63


Disclosure of Records and Information

AGENCY: Bureau of Consumer Financial Protection.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: This final rule amends the procedures used by the public to 
obtain information from the Bureau of Consumer Financial Protection 
(Bureau) under the Freedom of Information Act, the Privacy Act of 1974, 
and in legal proceedings.

DATES: This final rule is effective October 12, 2018.

FOR FURTHER INFORMATION CONTACT: David Snyder, Senior Counsel, Legal 
Division, at 202-435-7758. If you require this document in an 
alternative electronic format, please contact 
[email protected].

SUPPLEMENTARY INFORMATION:

I. Background

    The Bureau first published the procedures used by the public to 
obtain information from it under the Freedom of Information Act, the 
Privacy Act of 1974, and in legal proceedings in an interim final rule 
on July 28, 2011, 76 FR 45371 (Jul. 28, 2011). This was followed by a 
final rule on February 15,

[[Page 46076]]

2013, 78 FR 11483 (Feb. 15, 2013). Based on its experience over the 
last several years, the Bureau published a notice of proposed 
rulemaking on August 24, 2016, 81 FR 58310 (Aug. 24, 2016), that 
proposed to amend the rule to clarify, correct, and amend certain 
provisions of the rule, and it solicited comments on the proposal. The 
Bureau is issuing this final rule in response to the comments. The 
Bureau's August 24, 2016 notice of proposed rulemaking also proposed to 
amend the Bureau's rule regarding the confidential treatment of 
information obtained from persons in connection with the exercise of 
its authorities under Federal consumer financial law. This final rule 
only pertains to portions of the Bureau's proposal related to the 
Freedom of Information Act, the Privacy Act of 1974, and requests for 
Bureau information in legal proceedings.

II. Summary of the Final Rule

    The final rule revises subparts A, B, C, and E of section 1070 of 
title 12 of the Code of Federal Regulations.
    The revisions to subpart A address procedures related to the 
certification of authenticity of Bureau records and the service of 
summonses or complaints on the Bureau. Subpart A also contains 
definitions of terms used throughout the remainder of the part, and the 
final rule revises the definition of ``Chief FOIA Officer.''
    Subpart B implements the Freedom of Information Act, 5 U.S.C. 552 
(the FOIA). The Bureau has revised this subpart to clarify its 
practices, provide additional flexibility for requesters, and reflect 
recent changes made to the FOIA by the FOIA Improvement Act of 2016 
(Pub. L. 114-185). Additionally, these changes streamline the Bureau's 
process for assessing FOIA fees and notifying requesters of such fees. 
These changes will allow the Bureau to process FOIA requests more 
efficiently and provide records to requesters more quickly. The Bureau 
has made some minor revisions to its proposal in response to comments.
    The final rule does not revise subpart D.
    Subpart C (sometimes referred to as Touhy Regulations) sets forth 
procedures for requests for information from the Bureau in connection 
with legal proceedings between others, and describes the Bureau's 
procedures for considering such requests or demands for official 
information. The Bureau has made organizational and clarifying 
revisions to the provisions previously set forth in this subpart. The 
Bureau received no comments on this subpart and it finalizes the 
proposed subpart without modification.
    Subpart E contains the Bureau's rule implementing the Privacy Act 
of 1974, 5 U.S.C. 552a. The Bureau has revised the subpart to clarify 
the Chief Privacy Officer's authority, to provide additional 
flexibility for requestors, and to make technical corrections. The 
Bureau received no comments on this subpart and it finalizes the 
proposed subpart without modification.

III. Overview of Comments Received

    The Bureau received eight comment letters that pertained to its 
proposal regarding FOIA implementation. These included three comment 
letters from industry trade associations; and one comment letter each 
from an individual; an opposition research and communication 
organization; a financial institution; a consumer advocacy 
organization; and a Federal agency with responsibilities related to 
implementation of the FOIA. These comment letters largely proposed 
minor modifications to the proposed rule in order to clarify it and/or 
facilitate public access to information. The Bureau also received input 
from another Federal agency during the comment period. These 
suggestions primarily focused on procedural and technical changes to 
the proposed rule. The Bureau made some changes to the final rule based 
on this input.
    The Bureau received no comment letters regarding its proposed 
revisions to subpart C or subpart E, regarding its Touhy Regulations 
and implementation of the Privacy Act of 1974, respectively.\1\
---------------------------------------------------------------------------

    \1\ The Bureau received twenty-seven total comment letters in 
response to its notice of proposed rulemaking. The Bureau continues 
to consider the comments pertaining to its proposals related to the 
confidential treatment of Bureau information, and these comments are 
not addressed in this final rule.
---------------------------------------------------------------------------

IV. Legal Authority

    The Bureau proposed the rule pursuant to its authority under (1) 
Title X of the Dodd-Frank Act, 12 U.S.C. 5481 et seq., including (a) 
Section 1022(b)(1), 12 U.S.C. 5512(b)(1); (b) Section 1022(c)(6)(A), 12 
U.S.C. 5512(c)(6)(A); and (c) Section 1052(d), 12 U.S.C. 5562(d); (2) 
the Freedom of Information Act, 5 U.S.C. 552; (3) the Privacy Act of 
1974, 5 U.S.C. 552a; (4) the Right to Financial Privacy Act, 12 U.S.C. 
3401 et seq.; (5) the Trade Secrets Act, 18 U.S.C. 1905; (6) 18 U.S.C. 
641; (7) the Paperwork Reduction Act, 44 U.S.C. 3501 et seq., and (8) 
the Federal Records Act, 44 U.S.C. 3101. The Bureau received no 
comments on the applicability of these statutes, and it promulgates the 
final rule pursuant to these authorities.

V. Section-by-Section Analysis

Part 1070--Disclosure of Records and Information

Subpart A--General Provisions and Definitions
Section 1070.2 General Definitions
Section 1070.2(c) Chief FOIA Officer
    The Bureau had proposed no change to the defined term, ``Chief FOIA 
Officer.'' However, a Federal agency noted that the Bureau's status quo 
definition permitted a broader delegation of the Chief FOIA Officer's 
authority than is permitted by the FOIA. The previous definition 
allowed the Chief Operating Officer to delegate the Chief FOIA 
Officer's authority to ``any employee,'' but the FOIA requires that the 
Chief FOIA Officer be at the assistant secretary level or above. The 
Bureau agrees that this provision allowed a broader delegation of 
authority than is permissible under the FOIA and has removed the phrase 
``or any CFPB employee to whom the Chief Operating Officer has 
delegated authority to act under this part'' from the final rule. The 
Bureau believes that this provision, in conjunction with Sec.  
1070.2(d), provides the Bureau with the necessary flexibility to 
delegate some of the responsibilities of the Chief FOIA Officer to 
other CFPB employees without delegating more authority than is 
permissible under the FOIA.
Section 1070.3 Custodian of Records; Certification; Alternative 
Authority
Section 1070.3(b) Certification of Record
    Section 1070.3(b) authorizes the Bureau's Chief Operating Officer 
to certify the authenticity of any Bureau record or any copy of such 
record. The Bureau proposed revising the rule to clarify that the Chief 
Operating Officer can also certify the absence of a record. Such 
certification is contemplated in Rule 44 of the Federal Rules of Civil 
Procedure and Rule 902 of the Federal Rules of Evidence. See also 
Federal Rule of Evidence 803(10). The Bureau received no comments 
regarding this proposal, and it finalizes the proposal without 
modification.
Section 1070.5 Service of Summonses and Complaints
    The Bureau proposed moving Sec.  1070.31--which provides the 
process for serving the Bureau with summonses or complaints--to a new 
section in subpart A for clarity, in order to separate the rule 
governing service

[[Page 46077]]

when the Bureau is a party from the remaining provisions in subpart C, 
which deal with requests for information for other proceedings. In 
addition, the Bureau proposed revising paragraph (d)'s requirement that 
documents be ``stamped'' ``Service Accepted for Official Capacity 
Only'' by replacing the word ``stamped'' with the word ``marked.'' This 
proposal was intended to clarify that the documents may be labeled 
using a variety of methods. The Bureau received no comments regarding 
these proposals, and it finalizes them without modification.
Subpart B--Freedom of Information Act
    The Bureau received several general comments concerning its 
proposed changes to the regulations implementing the FOIA and the 
Bureau's FOIA process. Some commenters expressed support for the 
Bureau's proposed changes to the extent that they would expedite the 
FOIA process. Some of these commenters also raised concerns about the 
timeliness of the Bureau's FOIA process and its commitment to openness 
and transparency. The Bureau remains committed to open government and 
strives to be a leader by being transparent with respect to its own 
activities. In addition, the Bureau will continue to improve its FOIA 
process to ensure that all requests are responded to in a timely 
fashion.
    The Bureau also made several technical and typographical revisions 
to the rule in response to comments, including updating cross-
referenced provisions, ensuring consistent spelling of certain terms, 
and ensuring the consistent use of terminology throughout the rule.
Section 1070.11 Information Made Available; Discretionary Disclosures
Section 1070.11(a) In General
Section 1070.11(a)(2)
    Section 1070.11(a)(2) identifies a category of information and 
records that the FOIA requires Federal agencies to make publicly 
available. The Bureau proposed to remove the phrase ``and copying'' and 
replace it with ``in an electronic format.'' The Bureau proposed 
similar revisions to Sec.  1070.13. These changes are required by the 
FOIA Improvement Act of 2016. The Bureau received no comments on this 
proposal and it finalizes the proposal without modification.
Section 1070.11(b) Discretionary disclosures
    Section 1070.11(b) says that, even if a FOIA exemption applies to 
requested information or records, the Bureau has discretion to disclose 
it to the extent that the disclosure is not otherwise precluded by law. 
The paragraph further notes that such disclosures are not precedential. 
The Bureau proposed no revisions to this paragraph. However, another 
Federal agency suggested that the phrase ``but is merely an indication 
that, in the processing of the particular request, the CFPB finds no 
necessity for applying the exemption'' is unnecessary. The phrase at 
issue is contained in the part of Sec.  1070.11(b) noting that the 
Bureau's decision to discretionarily disclose a record in one case has 
no precedential value in the processing of another request. The Bureau 
agrees that this phrase is unnecessary and has removed it from the 
final rule.
Section 1070.13 & Public Inspection and Copying
Section 1070.13(d) Redaction of Identifying Details
    Section 1070.13 addresses the requirement that the Bureau make 
certain records available on its public website, and paragraph (d) 
addresses privacy-related redaction of those records. The Bureau 
proposed no revisions to this paragraph. However, one commenter noted 
that although Sec.  1070.13(d) discusses redacting records in the 
Bureau's FOIA reading room for personal privacy, it does not mention 
any other FOIA exemptions. Although the commenter is correct that Sec.  
1070.13(d) does not mention any other FOIA exemptions, the Bureau does 
not believe any changes to this provision are warranted because Sec.  
1070.13(a) already informs requesters that documents published in the 
Bureau's FOIA reading room are ``[s]ubject to the application of the 
FOIA exemptions and exclusions . . . .'' The Bureau finalizes the 
provision in the final rule without modification.
Section 1070.14 Requests for CFPB Records
Section 1070.14(b) Form of Request
    Section 1070.14(b) specifies the form of FOIA requests, and it 
previously distinguished between requests made in writing and by 
electronic means. The Bureau proposed a technical change to this 
provision, to remove the phrase ``or by electronic means'' and add ``as 
follows:'' in its place. The Bureau also proposed changes to Sec.  
1070.14(b)(1) and (2) to clarify how requesters must submit FOIA 
requests to the Bureau. The Bureau proposed similar changes to the 
following sections: 1070.17(b)(1); 1070.21(c); and 1070.22(e)(1)(i). 
The Bureau received no comments on these proposals and it finalizes 
them without modification.
Section 1070.14(c) Content of Request
    Section 1070.14(c) specifies the content of FOIA requests. Although 
the Bureau did not propose revisions to paragraphs (c)(1), (3), and 
(6), it received several suggestions from another Federal agency 
concerning these provisions. First, the agency suggested revising 
paragraph (c)(1) to say that a ``FOIA request must describe the records 
that the requester seeks in sufficient detail.'' The Bureau agrees and 
will make this edit as it is a core requirement of a perfected FOIA 
request.
    The agency also suggested removing the phrase ``[a]s a general 
rule'' from the last sentence of paragraph (c)(1) because it is 
unnecessary. The Bureau agrees and has removed this text from the final 
rule.
    Next, the agency suggested removing the part of paragraph (c)(3) 
that concerns requests to inspect records. The Bureau agrees that this 
provision is unnecessary and that, as a practical matter, requesters do 
not seek to inspect records prior to production. In response, the 
Bureau has removed the provision concerning the inspection of records 
and added a provision directing that the ``request should state whether 
the requester wishes to receive the records in a specific format.''
    Finally, the agency suggested changing paragraph (c)(6) to allow 
requesters to seek expedited processing at any time during the 
processing. The Bureau's rule previously required requesters to seek 
expedited processing with their initial requests. The agency noted that 
this provision could frustrate requesters by requiring them to withdraw 
and resubmit a request that includes a request for expedited 
processing. The Bureau agrees with the agency's suggestion, but has 
instead changed Sec.  1070.17(b)(1) in the final rule to address this 
concern. As such, revision to Sec.  1070.14(c)(6) is not necessary in 
response to this suggestion.
Section 1070.14(c)(4)
    Section 1070.14(c)(4) provides that a FOIA requester should 
indicate in the request whether the requester is a commercial user, an 
educational institution, non-commercial scientific institution, 
representative of the news media or ``other'' requester, as those terms 
are defined in Sec.  1070.22(b). The section also informs requesters 
that they may contact the Bureau's FOIA Public Liaison to seek 
assistance in determining the appropriate fee

[[Page 46078]]

category. Previously, the provision only permitted the Bureau to use 
information provided to the FOIA Public Liaison by a requester for the 
purpose of determining the requester's fee category. The Bureau 
proposed to remove this limitation so that it could use this 
information for other purposes, such as aiding a requester in 
clarifying the scope of a request, assisting in identifying records 
sought by a requester, and helping to resolve disputes related to a 
request.
    The Bureau received two comment letters regarding this provision. 
One commenter noted that the section included a fee category, 
``governmental entity,'' which is not recognized under the FOIA and is 
not defined anywhere in the Bureau's regulations. The Bureau agrees and 
has removed this fee category from the final rule. Another commenter 
raised concerns about the removal of language limiting the purposes for 
which the FOIA Public Liaison could use information provided by a 
requester. The commenter suggested that the Bureau narrow its proposal 
to codify certain specified uses for which the FOIA Public Liaison 
could use the information. The Bureau declines to make this change. The 
purpose of this proposal was to provide the FOIA Public Liaison with 
additional flexibilities in using the information to assist requesters 
in the processing of their requests. The Bureau removed this provision 
with the goal of maximizing the FOIA Public Liaison's ability to assist 
requesters with the processing of their requests and it believes that 
placing restrictions on the FOIA Public Liaison will hamper those 
efforts. For the aforementioned reasons, the Bureau finalizes the 
proposal without modification.
Section 1070.14(c)(5)
    Section 1070.14(c)(5) provides that if a requester seeks a waiver 
or reduction of fees associated with processing a request, then the 
request shall include a statement to that effect. The text previously 
included a statement that any request that does not seek a waiver or 
reduction of fees constitutes an agreement of the requester to pay all 
fees up to $25. The Bureau proposed to remove this language in light of 
other proposed fee-related revisions. Under the Bureau's proposed 
revisions to Sec.  1070.22(d) and (f), FOIA requesters could still 
specify an upper limit on the fees that they are willing to pay to 
process a request and the Bureau would notify a requester of any 
potential fees beyond that limit before processing the request. The 
Bureau received no comments on this proposal and it finalizes the 
proposal without modification.
Section 1070.14(e) Requests by an Individual for CFPB Records 
Pertaining to That Individual
    Section 1070.14(e) directs individuals who wish to inspect or 
obtain records pertaining to themselves to seek access to the records 
pursuant to the Bureau's regulations that implement the Privacy Act of 
1974, in subpart E of the rule. The Bureau proposed no revisions to 
this provision. However, another Federal agency suggested that the 
Bureau directly reference its Privacy Act request identity verification 
procedures at Sec.  1070.53(c) for first-party FOIA requests. It is the 
Bureau's practice to use the same identity verification procedures 
outlined in Sec.  1070.53(c) for both Privacy Act requests and first-
party FOIA requests, and such a change would codify the Bureau's 
current practice in its regulations. As such, the Bureau agrees with 
the commenter's suggestion and has made this change in the final rule.
Section 1070.14(g) Assistance From FOIA Public Liaison
    Section 1070.14 instructs requesters on how to request records from 
the Bureau under the FOIA. The Bureau received a suggestion from 
another Federal agency suggesting that it make the FOIA Public Liaison 
available more broadly to assist requesters. The Bureau agrees with the 
commenter's suggestion and has added a new provision to its final rule, 
Sec.  1070.14(g), which informs requesters that they can contact the 
FOIA Public Liaison to resolve any problems that arise during the 
processing of their requests. The Bureau believes that this change 
renders the reference to the FOIA Public Liaison in Sec.  1070.14(c)(4) 
unnecessary and has removed it from the final rule.
Section 1070.15 Responsibility for Responding to Requests for CFPB 
Records
    Section 1070.15 addresses, among other things, the process by which 
the Bureau consults with other agencies regarding FOIA requests and/or 
refers FOIA requests to other agencies. The Bureau did not propose any 
revisions to this provision. However, one commenter noted that the 
Bureau separately proposed a new definition of ``agency'' in Sec.  
1070.2(a) that included entities that are not subject to the FOIA. Were 
Sec.  1070.15 to be read in conjunction with this proposed definition, 
the rule would seem to allow the Bureau to refer FOIA requests to 
agencies that are not subject to the FOIA. Because the Bureau is not 
finalizing the proposed definitions in Sec.  1070.2 in this final rule, 
this comment is moot.
    In addition, a Federal agency suggested that the Bureau update and 
clarify its process for referrals and consultations, and that the 
Bureau allow for an additional process whereby the Bureau would 
coordinate with another agency when referral and consultation are not 
appropriate. The Bureau agrees with this suggestion and has added 
language to the final rule concerning referrals, consultations, and 
coordination. The changes to the rule clarify when it is appropriate 
for the Bureau to refer a request to, consult, or coordinate with 
another agency when processing a FOIA request. It also clarifies how 
the Bureau will document referrals and notify requesters when the 
Bureau has decided to refer a request to another agency.
Section 1070.16 Timing of Responses to Requests for CFPB Records
Section 1070.16(d) Unusual Circumstances
    Section 1070.16(d) addresses circumstances where the Bureau 
requires an extension to respond to a FOIA request. The Bureau proposed 
no revisions to this provision. However, one commenter suggested that 
the Bureau add language to Sec.  1070.16(d) stating that it will notify 
requesters of the availability of the services provided by the Bureau's 
FOIA Public Liaison and the National Archives and Records 
Administration (NARA), Office of Government Information Services (OGIS) 
when the Bureau requires an extension due to ``unusual circumstances'' 
under this provision. The Bureau agrees with this suggestion and has 
revised the final rule to incorporate this change.
    In addition, a Federal agency suggested that the Bureau remove 
several of the references to FOIA appeals in this paragraph. Although 
``unusual circumstances'' may apply to the processing of a FOIA appeal, 
the agency pointed out that in such circumstances the Bureau would not 
give the requester an opportunity to modify the scope of the appeal. 
The Bureau agrees with this suggestion and has implemented it in the 
final rule, as this part of the paragraph is intended to apply to 
requests, not FOIA appeals.

[[Page 46079]]

Section 1070.17 Requests for Expedited Processing
Section 1070.17(b) Form and Content of a Request for Expedited 
Processing
    Section 1070.17(b) instructs requesters on how to request expedited 
processing of a FOIA request. The Bureau proposed no revisions to this 
section. However, as explained above with respect to Sec.  1070.14(c), 
in response to a suggestion from another Federal agency, the Bureau has 
revised Sec.  1070.17(b)(1) of the final rule to state that requesters 
may request expedited processing at any time during the processing of 
their requests.
    In addition, the Federal agency recommended that the Bureau revise 
Sec.  1070.17(b)(2)(ii) to clarify what a requester must show to obtain 
expedited processing of the requested records. The Bureau agrees and 
has revised the rule accordingly. The FOIA provides for expedited 
processing of a request upon a showing of a ``compelling need,'' which 
includes a request by a ``person primarily engaged in disseminating 
information'' where there is an ``urgency to inform the public 
concerning actual or alleged Federal Government activity.'' 5 U.S.C. 
552(a)(6)(E). The rule did not previously explain what requesters must 
show to demonstrate that they are persons ``primarily engaged in 
disseminating information.'' The revised rule clarifies that a 
requester who is not a full-time member of the media must establish 
that the requester is a person ``whose primary professional activity or 
occupation is information dissemination.'' The revised rule also 
informs requesters that the existence of numerous articles on a given 
subject can be helpful in establishing that there is an ``urgency to 
inform'' the public on the topic of the request.
Section 1070.17(c) Determinations of Requests for Expedited Processing
    Section 1070.17(c) states that the Bureau will decide requests for 
expedited processing within ten calendar days of its receipt of the 
request, and that it will notify the requester of its decision in 
writing. The Bureau proposed no revisions to this section. However, one 
commenter suggested that the Bureau revise the provision to require the 
Bureau to process requests for expedited processing within five 
business days, and to require the Bureau to provide requested records 
within three business days of granting a request for expedited 
processing. The Bureau declines to adopt this recommendation. The 
current rule requires the Bureau to decide whether to grant a request 
for expedited processing in ten calendar days, which is what the FOIA 
requires. Additionally, the Bureau notes that, as reflected in its most 
recent Annual FOIA Report, the average amount of time it takes the 
Bureau to adjudicate a request for expedited processing is one day.
    The Bureau also declines to commit itself to releasing requested 
records within three business days of granting a request for expedited 
processing. When the Bureau grants a request for expedited processing, 
it processes the request as quickly and efficiently as possible. As 
noted above, the Bureau, on average, adjudicates requests for expedited 
processing in one day. Processing a request within three days after 
expedited processing is granted will not be feasible in many cases, 
particularly in cases involving a large number of responsive records.
    For the aforementioned reasons, the Bureau finalizes the provision 
without modification.
Section 1070.18 Responses to Requests for CFPB Records
Section 1070.18(a) Acknowledgement of Requests
    Section 1070.18(a) requires the Bureau to acknowledge its receipt 
of FOIA requests. The provision previously created this requirement 
only for perfected requests. A Federal agency recommended that the 
Bureau delete the word ``perfected,'' thus requiring the Bureau to also 
acknowledge and provide requesters with tracking numbers for requests 
that have not been perfected. The Bureau agrees with this 
recommendation. This is the Bureau's current practice, and it has 
revised the final rule to adopt this suggestion.
Section 1070.18(a)(4)
    Section 1070.18(a)(4) specifies what fee-related information the 
Bureau will include in acknowledgement letters it sends to requesters. 
The Bureau proposed to make a technical change to this provision, 
removing the phrase ``(of not less than $25)'' to account for the 
proposed revisions to fee-related provisions in Sec.  1070.22(d) and 
(f). The Bureau received no comments on this proposal and it finalizes 
the proposal without modification.
Section 1070.18(b) Initial Determination To Grant or Deny a Request
Section 1070.18(b)(2)
    Section 1070.18(b)(2) addresses the Bureau's response to a request 
that has been granted in full or in part. The Bureau proposed no 
revisions to this provision. However, a Federal agency recommended that 
the Bureau revise Sec.  1070.18(b)(2) to notify requesters that they 
can seek assistance from the Bureau's FOIA Public Liaison when the 
Bureau grants a request in full or in part. The Bureau agrees with this 
recommendation and has revised the final rule to incorporate it.
Section 1070.18(b)(4)
    Section 1070.18(b)(4) addresses the Bureau's response to a request 
that it determines should be denied in whole or in part. The Bureau 
proposed to add a new provision at Sec.  1070.18(b)(4)(iv) requiring it 
to inform requesters of the right to seek dispute resolution services 
from the Bureau's FOIA Public Liaison or OGIS. The Bureau also proposed 
to renumber the existing provisions under Sec.  1070.18(b)(4) to 
accommodate this change. The Bureau noted in its proposal that this 
change is required by the FOIA Improvement Act of 2016. The Bureau 
received no comments on this proposal and it finalizes the proposal 
without modification.
Section 1070.18(c) Resolution of Disputes
    The Bureau proposed a new paragraph in Sec.  1070.18 to inform 
requesters about the resources available to resolve any disputes that 
may arise during the request process. These resources are the Bureau's 
FOIA Public Liaison and mediation services provided by OGIS. One 
commenter suggested that the Bureau remove a provision in Sec.  
1070.18(c)(2) stating that the Bureau will not ``defer to OGIS 
mediation decision in particular cases.'' The commenter reasoned that 
this provision is not necessary because OGIS does not issue decisions. 
The Bureau agrees and it has revised the final rule to incorporate this 
recommendation.
Section 1070.18(d) Format of Records Disclosed
    The Bureau proposed a new paragraph to inform requesters that they 
may request records in a particular format. Under this proposal, the 
Bureau would provide records in a requested format when the requested 
format can readily be reproduced from the original file. The Bureau 
received no comments on this proposal and it finalizes the proposal 
without modification.
Section 1070.20 Requests for Business Information Provided to the CFPB
Section 1070.20(f) Opportunity To Object to Disclosure
    Section 1070.20(f) provides a submitter of business information 
with

[[Page 46080]]

ten business days to object to the Bureau's disclosure of the 
submitter's business information. The Bureau proposed to make two 
technical changes to this provision clarifying that the Bureau will 
delay any release of information to afford the submitter ten business 
days to object to the disclosure. The Bureau received one comment in 
support of this proposed change and it finalizes the proposal without 
modification.
Section 1070.21 Administrative Appeals
Section 1070.21(b) Time Limits for Filing Administrative Appeals
    Section 1070.21(b) provides the time limits for filing 
administrative appeals. The Bureau proposed to revise this provision to 
clarify that the time period for filing an appeal begins on the day 
after the date the initial determination is sent to the requester or 
the date of the letter transmitting the last records released, 
whichever is later. The Bureau also proposed to change the time limit 
for filing an administrative appeal from 45 days to 90 days. This 
change is required by the FOIA Improvement Act of 2016. The Bureau 
received no comments on these proposals and it finalizes them without 
modification.
Section 1070.21(d) Processing of Administrative Appeals
    Section 1070.21(d) specifies how the Bureau will process 
administrative appeals. The Bureau proposed to remove the requirement 
that appeals be stamped with the date of their receipt by the FOIA 
Office. The FOIA Office does not stamp an appeal with the date the 
Bureau received it, but the date is recorded in the Bureau's system for 
tracking FOIA requests. This requirement is outmoded and the Bureau 
proposed to remove it to account for its current practice.
    Section 1070.21(d) also previously provided that appeals would be 
processed in the order in which they are received. Since adopting this 
provision in 2011, the Bureau has found that it is not always 
practicable to complete action on appeals in the order in which they 
are received, and sometimes has chosen to act on a simple later-
received appeal rather than delay action pending completion of a more 
complex earlier-received appeal. In order to better align the 
regulation with current practice, the Bureau proposed to delete the 
provision calling for first-in-first-out processing of appeals.
    The Bureau received no comments on these proposals and it finalizes 
them without modification.
Section 1070.21(e) Determinations To Grant or Deny Administrative 
Appeals
    Section 1070.21(e) authorizes the General Counsel to decide 
administrative appeals, and Sec.  1070.21(e)(3) allows for remand of a 
FOIA determination as one option for the General Counsel's disposition 
of an appeal. The Bureau proposed to amend the first sentence of Sec.  
1070.21(e) to add a reference to remands so that all options for 
disposition of appeals are listed in that sentence. The Bureau received 
no comments on its proposed revision and it finalizes the revision 
without modification. In addition, one commenter recommended that the 
Bureau also include a provision in Sec.  1070.21(e) committing the 
Bureau to work as an active partner during the OGIS dispute resolution 
process when the Bureau agrees to participate in the process concerning 
a particular request. The Bureau agrees with this recommendation and 
has revised the final rule to incorporate it.
Section 1070.22 Fees for Processing Requests for CFPB Records
Section 1070.22(a) In General
    Section 1070.22(a) directs the Bureau to determine whether and to 
what extent to charge a requester fees for processing a FOIA request. 
Among other things, the provision previously stated that the Bureau 
charges certain fees ``unless circumstances exist . . . that render 
fees inapplicable or inadvisable or unless the requester has requested 
and the [Bureau] has granted a reduction in or waiver of fees. . . .'' 
The Bureau proposed no revisions to this provision. However, a Federal 
agency recommended that the Bureau remove the phrase ``or inadvisable'' 
from Sec.  1070.22(a) because it is not clear what the phrase means in 
this context. The Bureau agrees and has removed this phrase from the 
final rule.
Section 1070.22(b) Categories of Requesters
    Section 1070.22(b) identifies appropriate fee categories for 
requesters. One commenter suggested that community-based organizations 
and non-profits ``be added to the category that would obtain the lowest 
fees'' or, alternatively, that the Bureau create a new fee category for 
such groups where they would pay the lowest processing fees. The Bureau 
declines to adopt this recommendation. The fee categories are defined 
by statute and the Office of Management and Budget's fee guidance, and 
the Bureau does not believe it would be appropriate for it to create a 
new fee category that was not contemplated by the FOIA. The Bureau also 
cannot commit to placing all non-profits and community based 
organizations in the lowest fee categories because not all such 
organizations will meet the requirements for placement in these fee 
categories. The Bureau believes that the current FOIA fee categories 
and the fee waiver provisions in the Bureau's rule are sufficient to 
address the concerns raised by the commenter.
Section 1070.22(b)(1)(i)
    Section 1070.22(b)(1)(i) defines the ``Commercial user'' category 
of requester. The Bureau proposed to amend this provision to clarify 
that the Bureau's decision to place a requester in the commercial user 
category will be made on a case-by-case basis based on how the 
requester will use the information. The Bureau proposed this change to 
clarify how it will make decisions whether to place a requester in the 
commercial user category. The Bureau received no comments on this 
proposal and it finalizes the proposal without modification.
Section 1070.22(b)(1)(ii)
    Section 1070.22(b)(1)(ii) defines the ``Educational institution'' 
category of requester. Several commenters suggested that the Bureau 
update the definition to more accurately reflect the text of the FOIA 
and recent case law expanding the scope of the term ``educational 
institution'' to include students at educational institutions who 
submit a FOIA request in furtherance of coursework or other school-
sponsored activities. See Sack v. U.S. Dep't of Defense, 823 F.3d 687 
(D.C. Cir. 2016). The Bureau agrees with the commenters and has so 
revised this provision in the final rule, including by adding three 
examples of requesters to clarify under which circumstances a requester 
would fall within the scope of this fee category. The Bureau has also 
made corresponding changes to Sec.  1070.22(c)(2), removing information 
that is no longer necessary in light of the revisions to Sec.  
1070.22(b)(1)(ii).
Section 1070.22(b)(2)
    Section 1070.22(b)(2) provides that the Bureau will notify a 
requester of its determination as to the proper fee category to apply 
to the requester. The provision previously provided that the Bureau 
make its determination based on a review of the requester's submission 
and the Bureau's own records. The Bureau proposed to delete this 
limitation to clarify that it may base its determination on other 
appropriate information, including phone

[[Page 46081]]

conversations with the requester and publicly available information. 
The Bureau received no comments on this proposal and it finalizes the 
proposal without modification.
Section 1070.22(d) Other Circumstances When Fees Are Not Charged
    Section 1070.22(d) provides certain circumstances where the Bureau 
may not charge a requester a fee for processing a FOIA request. The 
Bureau proposed to insert a new paragraph at Sec.  1070.22(d)(2) and to 
renumber Sec.  1070.22(d) to accommodate the new paragraph. The Bureau 
explained in its proposal that the new paragraph would provide that it 
will not charge a requester any fees when the fee, excluding 
duplication costs, is less than $250. The Bureau proposed this change 
as part of its larger goal of revising the process for how it assesses 
FOIA processing fees and how the Bureau notifies requesters of such 
fees. The Bureau explained that this new provision would streamline its 
process for assessing FOIA fees. This change would allow the Bureau to 
process FOIA requests more quickly and efficiently because the Bureau 
would no longer need to contact a FOIA requester concerning processing 
fees when the cost to process the request is less than $250. As such, 
this provision would provide information to these requesters more 
quickly and at a reduced cost to the requesters.
    A Federal agency suggested that the Bureau should remove Sec.  
1070.22(d)(1) because it is no longer necessary given other revisions 
the Bureau has proposed to its FOIA regulations. The agency also 
recommended that the Bureau clarify Sec.  1070.22(d)(2) because it is 
not clear from the proposed revisions whether duplication costs would 
be included in the proposed $250 threshold.
    The Bureau intended its proposed $250 fee threshold to only apply 
to search and review costs, not duplication costs. Under its proposal, 
the Bureau would not charge any fees if the search and review fees were 
less than $250, but it did not intend for duplication costs to be 
subject to this threshold. The Bureau intended to subject duplication 
costs to Sec.  1070.22(d)(1), which provides that the Bureau will not 
charge a requester any FOIA processing fee when the cost of collecting 
the fee is equal to or greater than the fee itself. The Bureau intended 
to make this distinction because most of its FOIA responses are 
transmitted to requesters electronically and result in no duplication 
costs. The Bureau did not intend to offer requesters up to $250 worth 
of duplication without charge when the Bureau can almost always provide 
records in an electronic format. The Bureau has made clarifying 
revisions to its rule to address the agency's comments.
Section 1070.22(d)(4)
    Section 1070.22(d)(4) addresses miscellaneous circumstances where 
the Bureau may not assess fees. The Bureau proposed to revise this 
provision to prohibit it from charging search fees, or in certain cases 
duplication fees, when the Bureau has failed to comply with time limits 
under Sec.  1070.16 or Sec.  1070.21, unless (1) unusual circumstances 
apply to the processing of the request; (2) the Bureau has provided 
timely written notice of the unusual circumstances to the requester; 
(3) more than 5,000 pages are necessary to respond to the request; and 
(4) the Bureau has discussed with the requester (or made three good-
faith attempts to do so) how the requester could effectively limit the 
scope of the request. These changes are required by the FOIA 
Improvement Act of 2016.
    A Federal agency recommended that the Bureau revise Sec.  
1070.22(d)(4), reasoning that the proposal's exception to when the 
Bureau can charge FOIA processing fees when it does not meet FOIA 
timelines was technically broader than the FOIA's requirements. In 
addition, the Federal agency recommended revising the paragraph to 
account for a scenario where a court determines that exceptional 
circumstances apply to a request. The Federal agency also noted a 
technical error in a cross-reference in the paragraph. The Bureau had 
intended for proposed Sec.  1070.22(d)(4) to be coextensive with the 
FOIA. In response to these suggestions, the Bureau has revised the 
provision to more closely align with the FOIA's requirements, and it 
has added a paragraph to address a potential court determination that 
exceptional circumstances apply. It has also fixed the identified 
cross-reference. The Bureau otherwise finalizes its proposal.
Section 1070.22(e) Waiver or Reduction of Fees
Section 1070.22(e)(5)
    Section 1070.22(e)(5) provides that the Bureau will decide whether 
to grant or deny a request to reduce or waive fees prior to processing 
the FOIA request and that the Bureau will notify the requester of such 
a determination in writing. The Bureau proposed to delete this 
requirement because it is unnecessary in light of other proposed fee-
related revisions. The Bureau explained in its proposal that in many 
cases involving requests for fee waivers, the Bureau would be able to 
process the FOIA request without deciding the merits of the fee waiver 
request because the processing fees would be less than $250. It further 
reasoned that removing this requirement would allow the Bureau to 
process FOIA requests more efficiently and provide information to 
requesters more quickly. Under the Bureau's proposal, the Bureau would 
notify a requester when it had denied a fee waiver request and 
processing the request would incur fees. The Bureau received no 
comments on this proposal and it finalizes the proposal without 
modification.
Section 1070.22(e)(6)
    Section 1070.22(e)(6) specifies what information the Bureau will 
include in the letter it sends notifying the requester that the Bureau 
has denied a request for a waiver or reduction of fees. The Bureau 
proposed to make a technical change to this provision, removing the 
phrase ``(of not less than $25)'' to account for other newly proposed 
fee-related provisions. The Bureau received no comments on this 
proposal and it finalizes the proposal without modification.
Section 1070.22(f) Advance Notice and Prepayment of Fees
    Section 1070.22(f) describes the Bureau's process for notifying a 
requester of any processing fees associated with a FOIA request. The 
Bureau proposed several changes to this provision to clarify and 
streamline its process for assessing FOIA processing fees and for 
notifying requesters of such fees. First, the Bureau proposed to revise 
Sec.  1070.22(f) to provide that the Bureau would notify a requester of 
the estimated fees to process a FOIA request when the estimated fees 
are $250 or more and the estimated fees exceed the limit set by the 
requester, the requester has not specified a limit, or the Bureau has 
denied a request for a reduction or waiver of fees. Next, the Bureau 
proposed to revise Sec.  1070.22(f) to raise the fee threshold above 
which a requester must pre-pay estimated processing fees from $250 to 
$1000. The Bureau explained in its proposal that this change was 
necessary because of the Bureau's proposed change to Sec.  1070.22(d): 
The Bureau proposed raising its previous pre-payment threshold of $250 
because it would no longer charge fees for processing a request when 
the fees are $250 or less. The Bureau further explained that its 
proposed revisions to Sec.  1070.22(f) would require a requester to 
agree to

[[Page 46082]]

pay processing fees before the Bureau began processing the request. The 
Bureau said that such an agreement would provide sufficient assurance 
of payment for fees less than $1000, and that this change was in 
accordance with the Bureau's practice for requiring pre-payment of 
fees. Furthermore, the Bureau explained that this change would allow it 
to process FOIA requests more efficiently and provide records to 
requesters more quickly. The Bureau received no comments on these 
proposals and it finalizes them with only technical changes to the 
numbering of paragraphs in the section.
Section 1070.23 Authority and Responsibilities of the Chief FOIA 
Officer
Section 1070.22(a) Chief FOIA Officer
    Section 1070.22(a) discusses the role of the Bureau's Chief FOIA 
Officer. The Bureau proposed inserting two new paragraphs. The first 
concerns the Chief FOIA Officer's responsibility to offer training to 
Bureau staff regarding their responsibilities under the FOIA, and the 
second concerns the Chief FOIA Officer's role as the primary Bureau 
liaison with the OGIS and the Department of Justice's Office of 
Information Policy. The Bureau also proposed to renumber the provisions 
in this section to accommodate these changes. These changes are 
required by the FOIA Improvement Act of 2016. The Bureau received no 
comments on these proposals and it finalizes them without modification.
Subpart C--Disclosure of CFPB Information in Connection With Legal 
Proceedings
    Subpart C addresses the disclosure of Bureau information in 
connection with legal proceedings. The Bureau proposed several 
technical corrections throughout the subpart. The Bureau received no 
comments regarding these technical corrections, and it finalizes them 
without modification.
Section 1070.30 Purpose and Scope; Definitions
Section 1070.30(a)
    Section 1070.30(a) defines the circumstances for which the 
procedures outlined in subpart C apply. The Bureau proposed to delete 
paragraph (a)(1) from this provision and to renumber the section 
accordingly. This was intended as a technical change to account for 
moving Sec.  1070.31 to subpart A. The Bureau received no comments 
regarding this proposal, and it finalizes the proposal without 
modification.
Section 1070.30(e)
Section 1070.30(e)(2)
    Section 1070.30(e)(2) defines the term ``legal proceeding'' for 
subpart C. The Bureau proposed to add the phrase ``their agents'' to 
the last sentence of this provision to clarify that this definition 
applies to formal and informal requests made by both attorneys and 
their agents. The Bureau received no comments regarding this proposal, 
and it finalizes the proposal without modification.
Former Sec.  1070.31 Service of Summonses and Complaints
    Former Sec.  1070.31 provided the process for serving the Bureau 
with summonses or complaints. As discussed above with respect to 
proposed Sec.  1070.5, the Bureau proposed to delete Sec.  1070.31 from 
subpart C and move it to a new Sec.  1070.5 in subpart A. The Bureau 
also proposed to renumber sections and cross-references in subpart C to 
account for this change. The Bureau received no comments regarding 
these proposals, and it finalizes them without modification.
Proposed Sec.  1070.31 Service of Subpoenas, Court Orders, and Other 
Demands for CFPB Information or Action
    Proposed Sec.  1070.31(d)
    Proposed Sec.  1070.31(d) (formerly Sec.  1070.32(d)) provides that 
the Bureau is not authorized to accept on behalf of its employees any 
subpoenas, orders, or other demands or requests, which are not related 
to the employees' official duties. The previous text of the provision 
implied that it is the Bureau's practice to accept such demands or 
requests ``upon the express, written authorization of the individual 
CFPB employee to whom such demand or request is directed.'' The Bureau 
proposed to delete this part of the provision because it is not the 
general practice of the Bureau to accept service on behalf of 
individual employees. The Bureau further proposed deleting the 
paragraph's introductory caveat, ``[e]xcept as otherwise provided in 
this subpart,'' because the subpart does not otherwise provide for the 
Bureau to act as an agent for service for subpoenas, orders, or other 
demands or requests that do not relate to employees' official conduct. 
The Bureau received no comments regarding these proposals, and it 
finalizes them without modification.
Section 1070.33 Procedure When Testimony or Production of Documents is 
Sought; General
Section 1070.33(b)
    Section 1070.33(b) provides that the General Counsel may require a 
party seeking official information through testimony, Bureau records, 
or other material, to describe all reasonably foreseeable demands for 
such information. The Bureau proposed to make several technical changes 
to clarify this provision. The Bureau received no comments regarding 
these changes, and it finalizes the proposal without modification.
Subpart E--The Privacy Act
Section 1070.51 Authority and Responsibilities of the Chief Privacy 
Officer
    Section 1070.51 specifies the authority and responsibilities of the 
Bureau's Chief Privacy Officer. The Bureau proposed to add a new 
paragraph at Sec.  1070.51(a) authorizing the Chief Privacy Officer to 
``[d]evelop, implement, and maintain an organization-wide privacy 
program'' and to renumber the other paragraphs in Sec.  1070.51 to 
reflect this change. This change is in accordance with National 
Institute of Standards and Technology (NIST) Special Publication 800-53 
Revision 4, which provides that agencies should ``[appoint] a Senior 
Agency Official for Privacy (SAOP)/Chief Privacy Officer (CPO) 
accountable for developing, implementing, and maintaining an 
organization-wide governance and privacy program to ensure compliance 
with all applicable laws and regulations regarding the collection, use, 
maintenance, sharing, and disposal of personally identifiable 
information (PII) by programs and information systems. . . .'' The 
Bureau proposed this change to clarify the authority of its Chief 
Privacy Officer. The Bureau received no comments on this proposal, and 
it finalizes the proposal without modification.
Section 1070.53 Request for Access to Records
Section 1070.53(a) Procedures for Making a Request for Access to 
Records
    Section 1070.53(a) specifies the procedures for making Privacy Act 
requests for records. The previous text distinguished between requests 
made in writing and by electronic means. The Bureau proposed a 
technical change to this provision, to remove the phrase ``or by 
electronic means'' and add ``as follows:'' in its place. The Bureau 
also proposed changes to Sec.  1070.53(a)(1) to

[[Page 46083]]

clarify how requesters must submit Privacy Act requests to the Bureau. 
The Bureau proposed similar changes to Sec. Sec.  1070.56(a) and 
1070.58(b). The Bureau received no comments on this proposal and it 
finalizes the proposal without modification.
Section 1070.56 Request For Amendment of Records
Section 1070.56(a) Procedures for Making Request
Section 1070.56(a)(2)(i)
    Section 1070.56(a)(2)(i) provides that an individual requesting an 
amendment of a record must identify the system of records containing 
the record. The Bureau proposed to revise this provision to allow an 
individual to provide a description of the record in sufficient detail 
to allow Bureau personnel to locate the system of records containing 
the record. This revision was intended to provide a requester with more 
flexibility in the event that the requester does not know the precise 
name of the applicable system of records. Furthermore, this proposal 
was consistent with Sec.  1070.53(b)(2), which specifies requirements 
for requests for access to records. The Bureau received no comments on 
this proposal, and it finalizes the proposal without modification.
Section 1070.61 Training; Rules of Conduct; Penalties for Non-
Compliance
    Section 1070.61 addresses, among other things, the Bureau's 
obligations to conduct privacy-related training and establish rules of 
conduct related to privacy. The Bureau proposed to replace references 
to ``employees of Government contractors'' with the term ``contract 
personnel'' to avoid confusion with respect to Sec.  1070.2(k) 
(proposed Sec.  1070.2(l)), which defines the term ``employee.'' The 
Bureau received no comments on this proposal, and it finalizes the 
proposal without modification.

VI. Section 1022(b)(2)(A) of the Dodd-Frank Act

    In developing this final rule, the Bureau has considered the 
potential benefits, costs, and impacts as required by section 
1022(b)(2)(A) of the Dodd-Frank Act.\2\ This analysis describes these 
impacts solely for the Touhy procedures as the remaining provisions of 
this rule are not promulgated under federal consumer financial 
protection laws. The benefits and costs of those provisions are 
discussed above. The Bureau has consulted, or offered to consult with, 
the prudential regulators and the Federal Trade Commission, including 
consultation regarding consistency with any prudential, market, or 
systemic objectives administered by such agencies.
---------------------------------------------------------------------------

    \2\ Section 1022(b)(2)(A) of the Dodd-Frank Act addresses the 
consideration of the potential benefits and costs of regulation to 
consumers and covered persons, including the potential reduction of 
access by consumers to consumer financial products or services; the 
impact on depository institutions and credit unions with $10 billion 
or less in total assets as described in section 1026 of the Dodd-
Frank Act; and the impact on consumers in rural areas. Section 
1022(b)(2)(B) directs the Bureau to consult, before and during the 
rulemaking, with appropriate prudential regulators or other Federal 
agencies, regarding consistency with objectives those agencies 
administer.
---------------------------------------------------------------------------

    The Bureau has chosen to consider the benefits, costs, and impacts 
of the final rule as compared to the status quo, namely the Bureau's 
regulations as set forth by the Bureau on February 15, 2013, 78 FR 
11483 (Feb. 15, 2013).\3\ The Bureau does not have data with which to 
quantify the benefits or costs of the final rule, nor were any data 
provided by commenters. As such, the discussion below considers the 
qualitative costs, benefits, and impacts that the Bureau anticipates 
from the rule. The Bureau also notes that the discussion below should 
be read in conjunction with the discussion of benefits and costs in the 
Section-by-Section discussion above.
---------------------------------------------------------------------------

    \3\ The Bureau has discretion in any rulemaking to choose an 
appropriate scope of analysis with respect to potential benefits and 
costs and an appropriate baseline.
---------------------------------------------------------------------------

    As relevant, the final rule revises subparts A and C of part 1070 
of title 12 of the Code of Federal Regulations: The revisions to 
Subpart A offer clarifications of procedures related to the 
certification of authenticity of Bureau records and the service of 
summonses or complaints on the Bureau; the revisions to Subpart C 
include organizational and clarifying revisions to the provisions 
related to the Bureau's Touhy regulations.
    As these revisions mainly include clarifications, corrections and 
technical changes, they will have limited impacts on consumers and 
covered persons.
    The final rule will not have an appreciable impact on consumers' 
access to consumer financial products or services, as the scope of the 
final rule is limited to matters related to access to certain types of 
information, and does not relate to credit access.
    The final rule will not have a unique impact on insured depository 
institutions or insured credit unions with $10 billion or less in 
assets as described in section 1026(a) of the Dodd-Frank Act as the 
rule does not distinguish information regarding such institutions or 
procedures applicable to such institutions.
    The final rule will not have a unique impact on consumers in rural 
areas as the rule does not distinguish information regarding consumers 
in rural areas or procedures applicable to such consumers.

VII. Procedural Requirements

    The Regulatory Flexibility Act, 5 U.S.C. 601 et seq., as amended by 
the Small Business Regulatory Enforcement Fairness Act of 1996 (the 
RFA), requires each agency to consider the potential impact of its 
regulations on small entities, including small businesses, small 
governmental units, and small not-for-profit organizations, unless the 
head of the agency certifies that the rule will not have a significant 
economic impact on a substantial number of small entities. The 
undersigned so certifies. The rule does not impose any obligations or 
standards of conduct for purposes of analysis under the RFA, and it 
therefore does not give rise to a regulatory compliance burden for 
small entities.
    Finally, the Bureau has determined that this rule does not impose 
any new recordkeeping, reporting, or disclosure requirements on members 
of the public that would be collections of information requiring 
approval under the Paperwork Reduction Act, 44 U.S.C. 3501 et seq.

VIII. Congressional Review Act

    Pursuant to the Congressional Review Act (5 U.S.C. 801 et seq.), 
the Bureau will submit a report containing this rule and other required 
information to the U.S. Senate, the U.S. House of Representatives, and 
the Comptroller General of the United States prior to the rule's 
published effective date. The Office of Information and Regulatory 
Affairs has designated this rule as not a ``major rule'' as defined by 
5 U.S.C. 804(2).

List of Subjects in 12 CFR Part 1070

    Confidential business information, Consumer protection, Freedom of 
information, Privacy.

Authority and Issuance

    For the reasons set forth in the preamble, the Bureau amends 12 CFR 
part 1070 to read as follows:

PART 1070--DISCLOSURE OF RECORDS AND INFORMATION

0
1. The authority citation is revised to read as follows:

    Authority: 12 U.S.C. 5481 et seq.; 5 U.S.C. 552; 5 U.S.C. 552a; 
18 U.S.C. 1905; 18 U.S.C. 641; 44 U.S.C. ch. 31; 44 U.S.C. ch. 35; 
12 U.S.C. 3401 et seq.

[[Page 46084]]

Subpart A--General Provisions and Definitions

0
2. Revise Sec.  1070.1 to read as follows:


Sec.  1070.1  Authority, purpose, and scope.

    (a) Authority. (1) This part is issued by the Bureau of Consumer 
Financial Protection, an independent Bureau within the Federal Reserve 
System, pursuant to the Consumer Financial Protection Act of 2010, 12 
U.S.C. 5481 et seq.; the Freedom of Information Act, 5 U.S.C. 552; the 
Privacy Act of 1974, 5 U.S.C. 552a; the Federal Records Act, 44 U.S.C. 
3101; the Paperwork Reduction Act, 44 U.S.C. 3501 et seq.; the Right to 
Financial Privacy Act of 1978, 12 U.S.C. 3401; the Trade Secrets Act, 
18 U.S.C. 1905; 18 U.S.C. 641; and any other applicable law that 
establishes a basis for the exercise of governmental authority by the 
CFPB.
    (2) This part establishes mechanisms for carrying out the CFPB's 
statutory responsibilities under the statutes in paragraph (a)(1) of 
this section to the extent those responsibilities require the 
disclosure, production, or withholding of information. In this regard, 
the CFPB has determined that the CFPB, and its delegates, may disclose 
information of the CFPB, in accordance with the procedures set forth in 
this part, whenever it is necessary or appropriate to do so in the 
exercise of any of the CFPB's authority. The CFPB has determined that 
all such disclosures, made in accordance with the rules and procedures 
specified in this part, are authorized by law.
    (b) Purpose and scope. This part contains the CFPB's rules relating 
to the disclosure of records and information generated by and obtained 
by the CFPB.
    (1) Subpart A contains general provisions and definitions used in 
this part.
    (2) Subpart B implements the Freedom of Information Act, 5 U.S.C. 
552.
    (3) Subpart C sets forth the procedures with respect to subpoenas, 
orders, or other requests for CFPB information in connection with legal 
proceedings.
    (4) Subpart D provides for the protection of confidential 
information and procedures for sharing confidential information with 
supervised institutions, government Agencies, and others in certain 
circumstances.
    (5) Subpart E implements the Privacy Act of 1974, 5 U.S.C. 552a.

0
3. Revise Sec.  1070.2(c) to read as follows:


Sec.  1070.2   General definitions.

* * * * *
    (c) Chief FOIA Officer means the Chief Operating Officer of the 
CFPB.
* * * * *

0
4. Revise Sec. Sec.  1070.3 and 1070.4 to read as follows:


Sec.  1070.3  Custodian of records; certification; alternative 
authority.

    (a) Custodian of records. The Chief Operating Officer is the 
official custodian of all records of the CFPB, including records that 
are in the possession or control of the CFPB or any CFPB employee.
    (b) Certification of record. The Chief Operating Officer may 
certify the authenticity of any CFPB record or any copy of such record, 
or the absence thereof, for any purpose, and for or before any duly 
constituted Federal or State court, tribunal, or agency.
    (c) Alternative authority. Any action or determination required or 
permitted to be done by the Chief Operating Officer may be done by any 
employee who has been duly designated for this purpose by the Chief 
Operating Officer.


Sec.  1070.4  Records of the CFPB not to be otherwise disclosed.

    Except as provided by this part, employees or former employees of 
the CFPB, or others in possession of a record of the CFPB that the CFPB 
has not already made public, are prohibited from disclosing such 
records, without authorization, to any person who is not an employee of 
the CFPB.

0
5. Add Sec.  1070.5 to read as follows:


Sec.  1070.5  Service of summonses and complaints.

    (a) Only the General Counsel is authorized to receive and accept 
summonses or complaints sought to be served upon the CFPB or CFPB 
employees sued in their official capacity. Such documents should be 
served upon the General Counsel, Consumer Financial Protection Bureau, 
1700 G Street NW, Washington, DC 20552. This authorization for receipt 
shall in no way affect the requirements of service elsewhere provided 
in applicable rules and regulations.
    (b) If, notwithstanding paragraph (a) of this section, any summons 
or complaint described in that paragraph is delivered to an employee of 
the CFPB, the employee shall decline to accept the proffered service 
and may notify the person attempting to make service of the regulations 
set forth herein. If, notwithstanding this instruction, an employee 
accepts service of a document described in paragraph (a) of this 
section, the employee shall immediately notify and deliver a copy of 
the summons and complaint to the General Counsel.
    (c) When a CFPB employee is sued in an individual capacity for an 
act or omission occurring in connection with duties performed on behalf 
of the CFPB (whether or not the officer or employee is also sued in an 
official capacity), the employee by law is to be served personally with 
process. See Fed. R. Civ. P. 4(i)(3). An employee sued in an individual 
capacity for an act or omission occurring in connection with duties 
performed on behalf of the CFPB shall immediately notify, and deliver a 
copy of the summons and complaint to, the General Counsel.
    (d) The CFPB will only accept service of process for an employee 
sued in his or her official capacity. Documents for which the General 
Counsel accepts service in official capacity shall be marked ``Service 
Accepted in Official Capacity Only.'' Acceptance of service shall not 
constitute an admission or waiver with respect to jurisdiction, 
propriety of service, improper venue, or any other defense in law or 
equity available under applicable laws or rules.

0
6. Revise subparts B and C to read as follows:
Subpart B--Freedom of Information Act
Sec.
1070.10 General.
1070.11 Information made available; discretionary disclosures.
1070.12 Publication in the Federal Register.
1070.13 Public inspection in an electronic format.
1070.14 Requests for CFPB records.
1070.15 Responsibility for responding to requests for CFPB records.
1070.16 Timing of responses to requests for CFPB records.
1070.17 Requests for expedited processing.
1070.18 Responses to requests for CFPB records.
1070.19 Classified information.
1070.20 Requests for business information provided to the CFPB.
1070.21 Administrative appeals.
1070.22 Fees for processing requests for CFPB records.
1070.23 Authority and responsibilities of the Chief FOIA Officer.
Subpart C--Disclosure of CFPB Information in Connection With Legal 
Proceedings
Sec.
1070.30 Purpose and scope; definitions.
1070.31 Service of subpoenas, court orders, and other demands for 
CFPB information or action.
1070.32 Testimony and production of documents prohibited unless 
approved by the General Counsel.
1070.33 Procedure when testimony or production of documents is 
sought; general.
1070.34 Procedure when response to demand is required prior to 
receiving instructions.

[[Page 46085]]

1070.35 Procedure in the event of an adverse ruling.
1070.36 Considerations in determining whether the CFPB will comply 
with a demand or request.
1070.37 Prohibition on providing expert or opinion testimony.

Subpart B--Freedom of Information Act


Sec.  1070.10  General.

    This subpart contains the regulations of the CFPB implementing the 
Freedom of Information Act (the FOIA), 5 U.S.C. 552, as amended. These 
regulations set forth procedures for requesting access to records 
maintained by the CFPB. These regulations should be read together with 
the FOIA, the 1987 Office of Management and Budget Guidelines for FOIA 
Fees, the CFPB's Privacy Act regulations set forth in subpart E of this 
part, and the FOIA web page on the CFPB's website, https://www.consumerfinance.gov, which provide additional information about 
this topic.


Sec.  1070.11  Information made available; discretionary disclosures.

    (a) In general. The FOIA provides for public access to information 
and records developed or maintained by Federal agencies. Generally, the 
FOIA divides agency information into three major categories and 
provides methods by which each category of information is to be made 
available to the public. The three major categories of information are 
as follows:
    (1) Information required to be published in the Federal Register 
(see Sec.  1070.12);
    (2) Information required to be made available for public inspection 
in an electronic format or, in the alternative, to be published and 
offered for sale (see Sec.  1070.13); and
    (3) Information required to be made available to any member of the 
public upon specific request (see Sec. Sec.  1070.14 through 1070.22).
    (b) Discretionary disclosures. Even though a FOIA exemption may 
apply to the information or records requested, the CFPB may, if not 
precluded by law, elect under the circumstances not to apply the 
exemption. The fact that the exemption is not applied by the CFPB in 
response to a particular request shall have no precedential 
significance in processing other requests.
    (c) Disclosures of records frequently requested. Subject to the 
application of the FOIA exemptions and exclusions (5 U.S.C. 552(b) and 
(c)), the CFPB shall make publicly available, as provided by Sec.  
1070.13, all records regardless of form or format, which have been 
released previously to any person under 5 U.S.C. 552(a)(3) and 
Sec. Sec.  1070.14 through 1070.22, and which the CFPB determines have 
become or are likely to become the subject of subsequent requests for 
substantially the same records. When the CFPB receives three (3) or 
more requests for substantially the same records, then the CFPB shall 
also make the released records publicly available.


Sec.  1070.12  Publication in the Federal Register.

    (a) Requirement. The CFPB shall separately state, publish and 
maintain current in the Federal Register for the guidance of the public 
the following information:
    (1) Descriptions of its central and field organization and the 
established place at which, the persons from whom, and the methods 
whereby, the public may obtain information, make submissions or 
requests, or obtain decisions;
    (2) Statements of the general course and method by which its 
functions are channeled and determined, including the nature and 
requirements of all formal and informal procedures available;
    (3) Rules of procedure, descriptions of forms available or the 
places at which forms may be obtained, and instructions as to the scope 
and contents of all papers, reports, or examinations;
    (4) Substantive rules of general applicability adopted as 
authorized by law, and statements of general policy or interpretations 
of general applicability formulated and adopted by the CFPB; and
    (5) Each amendment, revision, or repeal of matters referred to in 
paragraphs (a)(1) through (4) of this section.
    (b) Exceptions. Publication of the information under paragraph (a) 
of this section shall be subject to the application of the FOIA 
exemptions and exclusions (5 U.S.C. 552(b) and (c)) and the limitations 
provided in 5 U.S.C. 552(a)(1).


Sec.  1070.13  Public inspection in an electronic format.

    (a) In general. Subject to the application of the FOIA exemptions 
and exclusions (5 U.S.C. 552(b) and (c)), the CFPB shall, in 
conformance with 5 U.S.C. 552(a)(2), make available for public 
inspection in an electronic format, including by posting on the CFPB's 
website, https://www.consumerfinance.gov, or, in the alternative, 
promptly publish and offer for sale the following information:
    (1) Final opinions, including concurring and dissenting opinions, 
and orders made in the adjudication of cases;
    (2) Those statements of policy and interpretations which have been 
adopted by the CFPB but are not published in the Federal Register;
    (3) Its administrative staff manuals and instructions to staff that 
affect a member of the public;
    (4) Copies of all records made publicly available pursuant to Sec.  
1070.11; and
    (5) A general index of the records referred to in paragraph (a)(4) 
of this section.
    (b) Information made available online. For records required to be 
made available for public inspection in an electronic format pursuant 
to 5 U.S.C. 552(a)(2) (paragraphs (a)(1) through (4) of this section), 
as soon as practicable, the CFPB shall make such records available on 
its e-FOIA Library, located at https://www.consumerfinance.gov.
    (c) Record availability at the on-site e-FOIA Library. Any member 
of the public may, upon request, access the CFPB's e-FOIA Library via a 
computer terminal at 1700 G Street NW, Washington, DC 20552. Such a 
request may be made by electronic means as set forth on the CFPB's 
website, https://www.consumerfinance.gov, or in writing, to the Chief 
FOIA Officer, Consumer Financial Protection Bureau, 1700 G Street NW, 
Washington, DC 20552. The request must indicate a preferred date and 
time for the requested access. The CFPB reserves the right to arrange a 
different date and time with the requester, if necessary.
    (d) Redaction of identifying details. To prevent a clearly 
unwarranted invasion of personal privacy, the CFPB may redact 
identifying details contained in any matter described in paragraphs 
(a)(1) through (4) of this section before making such matters available 
for inspection or publication. The justification for the redaction 
shall be explained fully in writing, and the extent of such redaction 
shall be indicated on the portion of the record which is made available 
or published, unless including that indication would harm an interest 
protected by the exemption in 5 U.S.C. 552(b) under which the redaction 
is made. If technically feasible, the extent of the redaction shall be 
indicated at the place in the record where the redaction is made.


Sec.  1070.14  Requests for CFPB records.

    (a) In general. Subject to the application of the FOIA exemptions 
and exclusions (5 U.S.C. 552(b) and (c)), the CFPB shall promptly make 
its records available to any person pursuant to a

[[Page 46086]]

request that conforms to the rules and procedures of this section.
    (b) Form of request. A request for records of the CFPB shall be 
made in writing as follows:
    (1) If a request is submitted by mail or delivery service, it shall 
be addressed to the Chief FOIA Officer, Consumer Financial Protection 
Bureau, 1700 G Street NW, Washington, DC 20552. The request shall be 
labeled ``Freedom of Information Act Request.''
    (2) If a request is submitted by electronic means, it shall be 
submitted as set forth on the CFPB's website, https://www.consumerfinance.gov. The request shall be labeled ``Freedom of 
Information Act Request.''
    (c) Content of request. (1) In order to ensure the CFPB's ability 
to respond in a timely manner, a FOIA request must describe the records 
that the requester seeks in sufficient detail to enable CFPB personnel 
to locate them with a reasonable amount of effort. Whenever possible, 
the request should include specific information about each record 
sought, such as the date, title or name, author, recipient, and subject 
matter of the record. If known, the requester should include any file 
designations or descriptions for the records requested. The more 
specific the requester is about the records or type of records 
requested, the more likely the CFPB will be able to locate those 
records in response to the request;
    (2) In order to ensure the CFPB's ability to communicate 
effectively with the requester, a request should include contact 
information for the requester, including the name of the requester and, 
to the extent available, a mailing address, telephone number, and email 
address at which the CFPB may contact the requester regarding the 
request;
    (3) The request should state whether the requester wishes to 
receive the records in a specific format;
    (4) A requester should indicate in the request whether the 
requester is a commercial user, an educational institution, non-
commercial scientific institution, representative of the news media, or 
``other'' requester, as those terms are defined in Sec.  1070.22(b), 
and the basis for claiming that fee category;
    (5) If a requester seeks a waiver or reduction of fees associated 
with processing a request, then the request shall include a statement 
to that effect as is required by Sec.  1070.22(e); and
    (6) If a requester seeks expedited processing of a request, then 
the request must include a statement to that effect as is required by 
Sec.  1070.17.
    (d) Perfected requests; effect of request deficiencies. For 
purposes of computing its deadline to respond to a request, the CFPB 
will deem itself to have received a request only if, and on the date 
that, it receives a request that contains substantially all of the 
information required by and that otherwise conforms with paragraphs (b) 
and (c) of this section. The CFPB need not accept a request, process a 
request, or be bound by any deadlines in this subpart for processing a 
request that fails to conform, in any material respect, to the 
requirements of paragraphs (b) and (c) of this section. If a request is 
deficient in any material respect, then the CFPB may return it to the 
requester and if it does so, it shall advise the requester in what 
respect the request is deficient, and what additional information is 
needed to respond to the request. The requester may then amend or 
resubmit the request. A determination by the CFPB that a request is 
deficient in any respect is not a denial of a request for records and 
such determinations are not subject to appeal. If a requester fails to 
respond to a CFPB notification that a request is deficient within 
thirty (30) days of the CFPB's notification, the CFPB will deem the 
request withdrawn.
    (e) Requests by an individual for CFPB records pertaining to that 
individual. An individual who wishes to inspect or obtain copies of 
records of the Bureau that pertain to that individual shall provide 
identity verification in accordance with Sec.  1070.53(c).
    (f) Requests for CFPB records pertaining to another individual. 
Where a request for records pertains to a third party, a requester may 
receive greater access by submitting either a notarized authorization 
signed by that individual or a declaration by that individual made in 
compliance with the requirements set forth in 28 U.S.C. 1746 
authorizing disclosure of the records to the requester, or submits 
proof that the individual is deceased (e.g., a copy of a death 
certificate or an obituary). The CFPB may require a requester to supply 
additional information if necessary in order to verify that a 
particular individual has consented to disclosure.
    (g) Assistance from FOIA Public Liaison. Requesters may contact the 
CFPB's FOIA Public Liaison to seek assistance in determining the 
appropriate fee category, formatting of requests, or resolving any 
problems that arise prior to submitting a request or during the 
processing of a request. The FOIA Public Liaison can be contacted at 
the telephone number listed on the CFPB's website, https://www.consumerfinance.gov.


Sec.  1070.15  Responsibility for responding to requests for CFPB 
records.

    (a) In general. In determining which records are responsive to a 
request, the CFPB ordinarily will include only records in its 
possession as of the date the CFPB begins its search for them. If any 
other date is used, the CFPB shall inform the requester of that date.
    (b) Authority to grant or deny requests. The Chief FOIA Officer 
shall be authorized to grant or deny any request for a record of the 
CFPB.
    (c) Consultations, referrals and coordination. When reviewing a 
record in response to a request, the CFPB will determine whether 
another agency is better able to determine whether the record is exempt 
from disclosure under the FOIA. As to any such record, the agency must 
proceed in one of the following ways:
    (1) Referral. (i) When a requested record has been created by an 
agency other than the CFPB, the CFPB shall refer the record to that 
agency for a direct response to the requester.
    (ii) Whenever the CFPB refers any part of the responsibility for 
responding to a request to another agency, it must document the 
referral, maintaining a copy of the record that it refers, and notify 
the requester of the referral, informing the requester of the name of 
the agency to which the record was referred, including that agency's 
FOIA contact information.
    (2) Consultation. When a FOIA request is received for a record 
created by the CFPB that includes information originated by another 
agency, the CFPB shall consult the originating agency for review and 
recommendation on disclosure. The CFPB shall not release any such 
records without prior consultation with the originating agency.
    (3) Coordination. The standard referral procedure is not 
appropriate where disclosure of the identity of the agency to which the 
referral would be made could harm an interest protected by an 
applicable exemption, such as the exemptions that protect personal 
privacy or national security interests. In such instances, in order to 
avoid harm to an interest protected by an applicable exemption, the 
agency that received the request should coordinate with the originating 
agency to seek its views on the disclosability of the record. The 
release determination for the record that is the subject of the 
coordination should then be conveyed to the requester by the agency 
that originally received the request.

[[Page 46087]]

Sec.  1070.16   Timing of responses to requests for CFPB records.

    (a) In general. Except as set forth in paragraphs (b) through (d) 
of this section, and Sec.  1070.17, the CFPB shall respond to requests 
according to their order of receipt.
    (b) Multitrack processing. (1) The CFPB may establish separate 
tracks to process simple and complex requests. The CFPB may assign a 
request to the simple or complex track(s) based on the amount of work 
and/or time needed to process the request. The CFPB shall process 
requests in each track based on the date the request was perfected in 
accordance with Sec.  1070.14(d).
    (2) The CFPB may provide a requester in its complex track with an 
opportunity to limit the scope of the request to qualify for faster 
processing within the specified limits of the simple track(s).
    (c) Time period for responding to requests for records. Ordinarily, 
the CFPB shall have twenty (20) business days from when a request is 
received by the CFPB to determine whether to grant or deny a request 
for records. The twenty (20) business day time period set forth in this 
paragraph (c) shall not be tolled by the CFPB except that the CFPB may:
    (1) Make one reasonable demand to the requester for clarifying 
information about the request and toll the twenty (20) business day 
time period while it awaits the clarifying information; or
    (2) Toll the twenty (20) business day time period while it awaits 
clarification from or addresses any dispute with the requester 
regarding the assessment of fees.
    (d) Unusual circumstances. (1) Where the CFPB determines that due 
to unusual circumstances it cannot respond either to a request within 
the time period set forth in paragraph (c) of this section or to an 
appeal within the time period set forth in Sec.  1070.21, the CFPB may 
extend the applicable time periods by informing the requester in 
writing of the unusual circumstances and of the date by which the CFPB 
expects to complete its processing of the request or appeal. Any 
extension or extensions of time with respect to a request or an appeal 
shall not cumulatively total more than ten (10) business days. However, 
if the CFPB determines that it needs additional time beyond a ten (10) 
business day extension to process a request, then the CFPB shall notify 
the requester, provide the requester with an opportunity to limit the 
scope of the request, arrange for an alternative time frame for 
processing the request, or modify the request, and notify the requester 
of the availability of services provided by its FOIA Public Liaison and 
the Office of Government Information Services (OGIS).
    (2) As used in this paragraph (d), ``unusual circumstances'' means:
    (i) The need to search for and collect the requested records from 
field facilities or other establishments that are separate from the 
office processing the request;
    (ii) The need to search for, collect, and appropriately examine a 
voluminous amount of separate and distinct records which are demanded 
in a single request; or
    (iii) The need for consultation, which shall be conducted with all 
practicable speed, with another agency having a substantial interest in 
the determination of the request, or among two or more CFPB offices 
having substantial subject matter interest therein.


Sec.  1070.17  Requests for expedited processing.

    (a) In general. The CFPB shall process a request on an expedited 
basis whenever a requester demonstrates a compelling need for expedited 
processing in accordance with the requirements of this paragraph (a) or 
in other cases that the CFPB deems appropriate.
    (b) Form and content of a request for expedited processing. A 
request for expedited processing shall be made as follows:
    (1) A request for expedited processing shall be made in writing and 
submitted as part of a request for records in accordance with Sec.  
1070.14(b), or at any time during the processing of the request. When a 
request for records includes a request for expedited processing, the 
request shall be labeled ``Expedited Processing Requested.''
    (2) A request for expedited processing shall contain a statement 
that demonstrates a compelling need for the requester to obtain 
expedited processing of the requested records. A ``compelling need'' is 
defined as follows:
    (i) Failure to obtain the requested records on an expedited basis 
could reasonably be expected to pose an imminent threat to the life or 
physical safety of an individual. The requester shall fully explain the 
circumstances warranting such an expected threat so that the CFPB may 
make a reasoned determination that a delay in obtaining the requested 
records could pose such a threat; or
    (ii) With respect to a request made by a person primarily engaged 
in disseminating information, urgency to inform the public concerning 
actual or alleged Federal government activity. A requester who is not a 
full-time member of the news media must establish that the requester is 
a person whose primary professional activity or occupation is 
information dissemination, though it need not be the requester's sole 
occupation. Such a requester also must establish a particular urgency 
to inform the public about the government activity involved in the 
request--one that extends beyond the public's right to know about 
government activity generally. The existence of numerous articles 
published on a given subject can be helpful in establishing the 
requirement that there be an ``urgency to inform'' the public on the 
topic.
    (3) The requester shall certify the written statement that purports 
to demonstrate a compelling need for expedited processing to be true 
and correct to the best of the requester's knowledge and belief. The 
certification must be in the form prescribed by 28 U.S.C. 1746: ``I 
declare under penalty of perjury that the foregoing is true and correct 
to the best of my knowledge and belief. Executed on [date].'' The 
requester shall mail or submit electronically a copy of such written 
certification to the Chief FOIA Officer as set forth in Sec.  
1070.14(b). The CFPB may waive this certification requirement in 
appropriate circumstances.
    (c) Determinations of requests for expedited processing. Within ten 
(10) calendar days of its receipt of a request for expedited 
processing, the CFPB shall decide whether to grant it and shall notify 
the requester of the determination in writing.
    (d) Effect of granting requests for expedited processing. If the 
CFPB grants a request for expedited processing, then the CFPB shall 
give the expedited request priority over non-expedited requests and 
shall process the expedited request as soon as practicable. The CFPB 
may assign expedited requests to their own simple and complex 
processing tracks based upon the amount of work and/or time needed to 
process them. Within each such track, an expedited request shall be 
processed in the order of its receipt.
    (e) Appeals of denials of requests for expedited processing. If the 
CFPB denies a request for expedited processing, then the requester 
shall have the right to submit an appeal of the denial determination in 
accordance with Sec.  1070.21. The CFPB shall communicate this appeal 
right as part of its written notification to the requester denying 
expedited processing. The requester shall label its appeal request 
``Appeal for Expedited Processing.'' The CFPB shall act expeditiously 
upon an appeal of a denial of a request for expedited processing.

[[Page 46088]]

Sec.  1070.18  Responses to requests for CFPB records.

    (a) Acknowledgements of requests. Upon receipt of a request, the 
CFPB will assign to the request a unique tracking number. The CFPB will 
send an acknowledgement letter to the requester by mail or email within 
ten (10) calendar days of receipt of the request. The acknowledgment 
letter will contain the following information:
    (1) The applicable request tracking number;
    (2) The date of receipt of the request, as determined in accordance 
with Sec.  1070.14(d), as well as the date when the requester may 
expect a response;
    (3) A brief statement identifying the subject matter of the 
request; and
    (4) A confirmation, with respect to any fees that may apply to the 
request pursuant to Sec.  1070.22, that the requester has sought a 
waiver or reduction in such fees, has agreed to pay any and all 
applicable fees, or has specified an upper limit that the requester is 
willing to pay in fees to process the request.
    (b) Initial determination to grant or deny a request. (1) The 
officer designated in Sec.  1070.15(b), or his or her delegate, shall 
make initial determinations either to grant or to deny in whole or in 
part requests for records.
    (2) If the request is granted in full or in part, and if the 
requester requests a copy of the records requested, then a copy of the 
records shall be mailed or emailed to the requester in the requested 
format, to the extent the records are readily producible in the 
requested format. The CFPB shall also send the requester a statement of 
the applicable fees, either at the time of the determination or shortly 
thereafter, and inform the requester of the availability of its FOIA 
Public Liaison to offer assistance.
    (3) In the case of a request for inspection, the requester shall be 
notified in writing of the determination, when and where the requested 
records may be inspected, and of the fees incurred in complying with 
the request. The CFPB shall then promptly make the records available 
for inspection at the time and place stated, in a manner that will not 
interfere with CFPB's operations and will not exclude other persons 
from making inspections. The requester shall not be permitted to remove 
the records from the room where inspection is made. If, after making 
inspection, the requester desires copies of all or a portion of the 
requested records, copies shall be furnished upon payment of the 
established fees prescribed by Sec.  1070.22. Fees may be charged for 
search and review time as stated in Sec.  1070.22.
    (4) If it is determined that the request for records should be 
denied in whole or in part, the requester shall be notified by mail or 
by email. The letter of notification shall:
    (i) State the exemptions relied upon in denying the request;
    (ii) If technically feasible, indicate the amount of information 
deleted and the exemptions under which the deletion is made at the 
place in the record where such deletion is made (unless providing such 
indication would harm an interest protected by the exemption relied 
upon to deny such material);
    (iii) Set forth the name and title or position of the responsible 
official;
    (iv) Advise the requester of the right to seek dispute resolution 
services from the Bureau's FOIA Public Liaison or the Office of 
Governmental Information Services;
    (v) Advise the requester of the right to administrative appeal in 
accordance with Sec.  1070.21; and
    (vi) Specify the official or office to which such appeal shall be 
submitted.
    (5) If it is determined, after a reasonable search for records, 
that no responsive records have been found to exist, the requester 
shall be notified in writing or by email. The notification shall also 
advise the requester of the right to administratively appeal the CFPB's 
determination that no responsive records exist (i.e., to challenge the 
adequacy of the CFPB's search for responsive records) in accordance 
with Sec.  1070.21. The response shall specify the official or office 
to which the appeal shall be submitted for review.
    (c) Resolution of disputes. The CFPB is committed to efficiently 
resolving disputes during the request process. The following resources 
are available to requesters to resolve any disputes that may arise 
during the request process:
    (1) FOIA Public Liaison. Any request related questions or concerns 
should be directed to the FOIA Public Liaison, who is responsible for 
reducing delays, increasing transparency and understanding of the 
status of requests, and assisting in the resolution of disputes.
    (2) Dispute resolution. The National Archives and Records 
Administration (NARA), Office of Government Information Services (OGIS) 
offers non-compulsory, non-binding dispute resolution services to help 
resolve FOIA disputes. A requester may contact OGIS directly at Office 
of Government Information Services, National Archives and Records 
Administration, Room 2510, 8601 Adelphi Road, College Park, MD 20740-
6001, Email: [email protected], Phone: (301) 837-1996, Fax: (301) 837-0348. 
This information is provided as a public service only. By providing 
this information, the CFPB does not commit to refer disputes to OGIS.
    (d) Format of records disclosed. (1) The CFPB will provide records 
in the requested format if the records can readily be reproduced from 
the original file to that specific format.
    (2) The CFPB may charge fees associated with converting records or 
files into the requested format in accordance with Sec.  1070.22.


Sec.  1070.19  Classified information.

    Whenever a request is made for a record containing information that 
another agency has classified, or which may be appropriate for 
classification by another agency under Executive Order 13526 or any 
other executive order concerning the classification of information, the 
CFPB shall refer the responsibility for responding to the request to 
the classifying or originating agency, as appropriate.


Sec.  1070.20  Requests for business information provided to the CFPB.

    (a) In general. Business information provided to the CFPB by a 
business submitter shall not be disclosed pursuant to a FOIA request 
except in accordance with this section.
    (b) Definitions. For purposes of this section:
    (1) Business information means commercial or financial information 
obtained by the CFPB from a submitter that may be protected from 
disclosure under Exemption 4 of the FOIA, 5 U.S.C. 552(b)(4).
    (2) Submitter means any person from whom the CFPB obtains business 
information, directly or indirectly. The term includes, without 
limitation, corporations, State, local, and tribal governments, and 
foreign governments.
    (c) Designation of business information. A submitter of business 
information will use good-faith efforts to designate, by appropriate 
markings, either at the time of submission or at a reasonable time 
thereafter, any portions of its submission that it considers to be 
protected from disclosure under Exemption 4 of the FOIA. These 
designations will expire ten (10) years after the date of the 
submission unless the submitter requests otherwise and provides 
justification for, a longer designation period.
    (d) Notice to submitters. The CFPB shall provide a submitter with 
prompt written notice of receipt of a request or appeal encompassing 
its business information whenever required in accordance with paragraph 
(e) of this section. Such written notice shall either

[[Page 46089]]

describe the exact nature of the business information requested or 
provide copies of the records or portions of records containing the 
business information. When notification of a voluminous number of 
submitters is required, notification may be made by posting or 
publishing the notice in a place reasonably likely to accomplish it.
    (e) When notice is required. (1) The CFPB shall provide a submitter 
with notice of receipt of a request or appeal whenever:
    (i) The information has been designated in good faith by the 
submitter as information considered protected from disclosure under 
Exemption 4; or
    (ii) The CFPB has reason to believe that the information may be 
protected from disclosure under Exemption 4.
    (2) The notice requirements of this paragraph (e) shall not apply 
if:
    (i) The CFPB determines that the information is exempt under the 
FOIA;
    (ii) The information lawfully has been published or otherwise made 
available to the public;
    (iii) Disclosure of the information is required by statute (other 
than the FOIA) or by a regulation issued in accordance with the 
requirements of Executive Order 12600 (3 CFR, 1988 Comp., p. 235); or
    (iv) The designation made by the submitter under paragraph 
(e)(1)(i) of this section appears obviously frivolous, except that, in 
such a case, the CFPB shall, within a reasonable time prior to a 
specified disclosure date, give the submitter written notice of any 
final decision to disclose the information.
    (f) Opportunity to object to disclosure before release. (1) Through 
the notice described in paragraph (d) of this section, the CFPB shall 
delay any release in order to afford a submitter ten (10) business days 
from the date of the notice to provide the CFPB with a detailed 
statement of any objection to disclosure. Such statement shall specify 
all grounds for withholding any of the information under any exemption 
of the FOIA and, in the case of Exemption 4, shall demonstrate why the 
information is considered to be a trade secret or commercial or 
financial information that is privileged or confidential. In the event 
that a submitter fails to respond to the notice within the time 
specified in it, the submitter shall be considered to have no objection 
to disclosure of the information. Information provided by a submitter 
pursuant to this paragraph (f) may itself be subject to disclosure 
under the FOIA.
    (2) When notice is given to a submitter under this section, the 
requester shall be advised that such notice has been given to the 
submitter. The requester shall be further advised that a delay in 
responding to the request may be considered a denial of access to 
records and that the requester may proceed with an administrative 
appeal or seek judicial review, if appropriate. However, the requester 
will be invited to agree to a voluntary extension of time so that the 
CFPB may review the submitter's objection to disclose, if any.
    (g) Notice of intent to disclose. The CFPB shall consider a 
submitter's objections and specific grounds for nondisclosure prior to 
determining whether to disclose business information. Whenever the CFPB 
decides to disclose business information over the objection of a 
submitter, the CFPB shall forward to the submitter a written notice 
which shall include:
    (1) A statement of the reasons for which the submitter's disclosure 
objections were not sustained;
    (2) A description of the business information to be disclosed; and
    (3) A specified disclosure date which is not less than ten (10) 
business days after the notice of the final decision to release the 
requested information has been mailed to the submitter. Except as 
otherwise prohibited by law, a copy of the disclosure notice shall be 
forwarded to the requester at the same time.
    (h) Notice to submitter of FOIA lawsuit. Whenever a requester 
brings suit seeking to compel disclosure of business information, the 
CFPB shall promptly notify the submitter of that business information 
of the existence of the suit.
    (i) Notice to requester of business information. The CFPB shall 
notify a requester whenever it provides the submitter with notice and 
an opportunity to object to disclosure; whenever it notifies the 
submitter of its intent to disclose the requested information; and 
whenever a submitter files a lawsuit to prevent the disclosure of the 
information.


Sec.  1070.21  Administrative appeals.

    (a) Grounds for administrative appeals. A requester may appeal an 
initial determination of the CFPB, including for the following reasons:
    (1) To deny access to records in whole or in part (as provided in 
Sec.  1070.18(b));
    (2) To assign a particular fee category to the requester (as 
provided in Sec.  1070.22(b));
    (3) To deny a request for a reduction or waiver of fees (as 
provided in Sec.  1070.22(e));
    (4) That no records exist that are responsive to the request (as 
provided in Sec.  1070.18(b)); or
    (5) To deny a request for expedited processing (as provided in 
Sec.  1070.17(e)).
    (b) Time limits for filing administrative appeals. An appeal, other 
than an appeal of a denial of expedited processing, must be postmarked 
or submitted electronically on a date that is within ninety (90) 
calendar days after the date the initial determination is sent to the 
requester or the date of the letter transmitting the last records 
released, whichever is later. An appeal of a denial of expedited 
processing must be made within ten (10) days of the date of the initial 
determination letter to deny expedited processing (see Sec.  1070.17).
    (c) Form and content of administrative appeals. In order to ensure 
a timely response to an appeal, the appeal shall be made in writing as 
follows:
    (1) If appeal is submitted by mail or delivery service, it shall be 
addressed to and submitted to the officer specified in paragraph (e) of 
this section at the address set forth in Sec.  1070.14(b). The appeal 
shall be labeled ``Freedom of Information Act Appeal.''
    (2) If an appeal is submitted by electronic means, it shall be 
addressed to the officer specified in paragraph (e) of this section and 
submitted as set forth on the CFPB's website, https://www.consumerfinance.gov. The appeal shall be labeled ``Freedom of 
Information Act Appeal.''
    (3) The appeal shall set forth contact information for the 
requester, including, to the extent available, a mailing address, 
telephone number, or email address at which the CFPB may contact the 
requester regarding the appeal; and
    (4) The appeal shall specify the applicable request tracking 
number, the date of the initial request, and the date of the letter of 
initial determination, and, where possible, enclose a copy of the 
initial request and the initial determination being appealed.
    (d) Processing of administrative appeals. The FOIA office will 
record the date that appeals are received. The receipt of the appeal 
will be acknowledged by the CFPB and the requester will be advised of 
the date the appeal was received, the appeal tracking number, and the 
expected date of response.
    (e) Determinations to grant or deny administrative appeals. The 
General Counsel is authorized to and shall decide whether to affirm the 
initial determination (in whole or in part), to reverse the initial 
determination (in whole or in part) or to remand the initial 
determination to the Chief FOIA Officer for further action and shall 
notify the requester of this decision in writing

[[Page 46090]]

within twenty (20) business days after the date of receipt of the 
appeal, unless extended pursuant to Sec.  1070.16(d).
    (1) If it is decided that the appeal is to be denied (in whole or 
in part) the requester shall be:
    (i) Notified in writing of the denial;
    (ii) Notified of the reasons for the denial, including which of the 
FOIA exemptions were relied upon;
    (iii) Notified of the name and title or position of the official 
responsible for the determination on appeal;
    (iv) Provided with a statement that judicial review of the denial 
is available in the United States District Court for the judicial 
district in which the requester resides or has a principal place of 
business, the judicial district in which the requested records are 
located, or the District of Columbia in accordance with 5 U.S.C. 
552(a)(4)(B); and
    (v) Provided with notification that dispute resolution services are 
available to the requester as a non-exclusive alternative to litigation 
through the Office of Government Information Services in accordance 
with 5 U.S.C. 552(h)(3). Dispute resolution is a voluntary process. If 
the CFPB agrees to participate in the dispute resolution services 
provided by the Office of Governmental Information Services, it will 
actively engage as a partner to the process in an attempt to resolve 
the dispute.
    (2) If the initial determination is reversed on appeal, the 
requester shall be so notified and the request shall be processed 
promptly in accordance with the decision on appeal.
    (3) If the initial determination is remanded on appeal to the Chief 
FOIA Officer for further action, the requester shall be so notified and 
the request shall be processed in accordance with the decision on 
appeal. The remanded request shall be treated as a new request received 
by the CFPB as of the date when the General Counsel transmits the 
remand notification to the requester. The procedures and deadlines set 
forth in this subpart for processing, deciding, responding to, and 
filing administrative appeals of new FOIA requests shall apply to the 
remanded request.
    (f) Adjudication of administrative appeals of requests in 
litigation. An appeal ordinarily will not be adjudicated if the request 
becomes a matter of FOIA litigation.


Sec.  1070.22  Fees for processing requests for CFPB records.

    (a) In general. The CFPB shall determine whether and to what extent 
to charge a requester fees for processing a FOIA request, for the 
services and in the amounts set forth in this paragraph (a), by 
determining an appropriate fee category for the requester (as set forth 
in paragraph (b) of this section) and then by charging the requester 
those fees applicable to the assigned category (as set forth in 
paragraph (c) of this section), unless circumstances exist (as 
described in paragraph (d) of this section) that render fees 
inapplicable or unless the requester has requested and the CFPB has 
granted a reduction in or waiver of fees (as set forth in paragraph (e) 
of this section).
    (1) The CFPB shall charge a requester fees for the cost of copying 
or printing records at the rate of $0.10 per page.
    (2) The CFPB shall charge a requester for all time spent by its 
employees searching for records that are responsive to a request. The 
CFPB shall charge the requester fees for search time as follows:
    (i) The CFPB shall charge for search time at the salary rate(s) 
(basic pay plus sixteen (16) percent) of the employee(s) who conduct 
the search. However, the CFPB shall charge search fees at the rate of 
$9.00 per fifteen (15) minutes of search time whenever only 
administrative/clerical employees conduct a search and at the rate of 
$23.00 per fifteen (15) minutes of search time whenever only 
professional/executive employees conduct a search. Search charges shall 
also include transportation of employees and records necessary to the 
search at actual cost. Fees may be charged for search time even if the 
search does not yield any responsive records, or if records are exempt 
from disclosure.
    (ii) The CFPB shall charge the requester for the actual direct 
costs of conducting an electronic records search, including computer 
search time, runs, and output. The CFPB shall also charge for time 
spent by computer operators or programmers (at the rates set forth in 
paragraph (a)(2)(i) of this section) who conduct or assist in the 
conduct of an electronic records search.
    (3) The CFPB shall charge a requester for time spent by its 
employees examining responsive records to determine whether any 
portions of such record are exempt from disclosure, pursuant to the 
FOIA exemptions of 5 U.S.C. 552(b). The CFPB shall also charge a 
requester for time spent by its employees redacting any such exempt 
information from a record and preparing a record for release to the 
requester. The CFPB shall charge a requester for time spent reviewing 
records at the salary rate(s) (i.e., basic pay plus sixteen (16) 
percent) of the employees who conduct the review. However, the CFPB 
shall charge review fees at the rate of $9.00 per fifteen (15) minutes 
of search time whenever only administrative/clerical employees review 
records and at the rate of $23.00 per fifteen (15) minutes of search 
time whenever only professional/executive employees review records. 
Fees shall be charged for review time even if records ultimately are 
not disclosed.
    (4) Fees for all services provided shall be charged whether or not 
copies are made available to the requester for inspection. However, no 
fee shall be charged for monitoring a requester's inspection of 
records.
    (5) Other services and materials requested which are not covered by 
this part nor required by the FOIA are chargeable at the actual cost to 
the CFPB. This includes, but is not limited to:
    (i) Certifying that records are true copies; or
    (ii) Sending records by special methods such as express mail, etc.
    (b) Categories of requesters. (1) For purposes of assessing fees as 
set forth in this section, each requester shall be assigned to one of 
the following categories:
    (i) Commercial user refers to one who seeks information for a use 
or purpose that furthers the commercial, trade, or profit interests of 
the requester or the person on whose behalf the request is made, which 
can include furthering those interests through litigation. The CFPB's 
decision to place a requester in the commercial use category will be 
made on a case-by-case basis based on how the requester will use the 
information.
    (ii) Educational institution refers to any school that operates a 
program of scholarly research. A requester in this fee category must 
show that the request is made in connection with his or her role at the 
educational institution. Agencies may seek verification from the 
requester that the request is in furtherance of scholarly research and 
agencies will advise requesters of their placement in this category.
    Example 1 to paragraph (b)(1)(ii). A request from a professor of 
geology at a university for records relating to soil erosion, written 
on letterhead of the Department of Geology, would be presumed to be 
from an educational institution.
    Example 2 to paragraph (b)(1)(ii). A request from the same 
professor of geology seeking drug information from the Food and Drug 
Administration in furtherance of a murder mystery he is writing would 
not be presumed to be an institutional request, regardless of whether 
it was written on institutional stationery.

[[Page 46091]]

    Example 3 to paragraph (b)(1)(ii). A student who makes a request in 
furtherance of their coursework or other school-sponsored activities 
and provides a copy of a course syllabus or other reasonable 
documentation to indicate the research purpose for the request, would 
qualify as part of this fee category.
    (iii) Non-commercial scientific institution refers to an 
institution that is not operated on a ``commercial user'' basis as that 
term is defined in paragraph (b)(2)(i) of this section, and which is 
operated solely for the purpose of conducting scientific research, the 
results of which are not intended to promote any particular product or 
industry.
    (iv) Representative of the news media refers to any person or 
entity that gathers information of potential interest to a segment of 
the public, uses its editorial skills to turn the raw materials into a 
distinct work, and distributes that work to an audience. In this 
paragraph (b)(1)(iv), the term ``news'' means information that is about 
current events or that would be of current interest to the public. 
Examples of news-media entities are television or radio stations 
broadcasting to the public at large and publishers of periodicals (but 
only if such entities qualify as disseminators of ``news'') who make 
their products available for purchase by or subscription by or free 
distribution to the general public. Other examples of news media 
entities include online publications and websites that regularly 
deliver news content to the public. These examples are not all-
inclusive. Moreover, as methods of news delivery evolve (for example, 
the adoption of the electronic dissemination of newspapers through 
telecommunications services), such alternative media shall be 
considered to be news-media entities. A freelance journalist shall be 
regarded as working for a news-media entity if the journalist can 
demonstrate a solid basis for expecting publication through that 
entity, whether or not the journalist is actually employed by the 
entity. A publication contract would present a solid basis for such an 
expectation; the CFPB may also consider the past publication record of 
the requester in making such a determination.
    (v) Other requester refers to a requester who does not fall within 
any of the categories described in paragraphs (b)(1)(i) through (iv) of 
this section.
    (2) Within twenty (20) calendar days of its receipt of a request, 
the CFPB shall make a determination as to the proper fee category to 
apply to a requester. The CFPB shall inform the requester of the 
determination in the request acknowledgment letter, or if no such 
letter is required, in another writing. Where the CFPB has reasonable 
cause to doubt the use to which a requester will put the records 
sought, or where that use is not clear from the request itself, the 
CFPB should seek additional clarification before assigning the request 
to a specific category.
    (3) If the CFPB assigns to a requester a fee category, then the 
requester shall have the right to submit an appeal of the CFPB's 
determination in accordance with Sec.  1070.21. The CFPB shall 
communicate this appeal right as part of its written notification to 
the requester of an adverse fee category determination. The requester 
shall label its appeal request ``Appeal of Fee Category 
Determination.''
    (c) Fees applicable to each category of requester. The following 
fee schedule applies uniformly throughout the CFPB to requests 
processed under the FOIA. Specific levels of fees are prescribed for 
each category of requester defined in paragraph (b) of this section.
    (1) Commercial users shall be charged the full direct costs of 
searching for, reviewing, and duplicating the records they request. 
Moreover, when a request is received for disclosure that is primarily 
in the commercial interest of the requester, the CFPB is not required 
to consider a request for a waiver or reduction of fees based upon the 
assertion that disclosure would be in the public interest. The CFPB may 
recover the cost of searching for and reviewing records even if there 
is ultimately no disclosure of records or no records are located.
    (2) Educational and non-commercial scientific institution 
requesters shall be charged only for the cost of duplicating the 
records they request, except that the CFPB shall provide the first one 
hundred (100) pages of duplication free of charge.
    (3) Representatives of the news media shall be charged only for the 
cost of duplicating the records they request, except that the CFPB 
shall provide them with the first one hundred (100) pages of 
duplication free of charge.
    (4) Other requesters who do not fit any of the categories described 
in paragraphs (c)(1) through (3) of this section shall be charged the 
full direct cost of searching for and duplicating records that are 
responsive to the request, except that the CFPB shall provide the first 
one hundred (100) pages of duplication and the first two hours of 
search time free of charge. The CFPB may recover the cost of searching 
for records even if there is ultimately no disclosure of records, or no 
records are located. Requests from persons for records about themselves 
filed in the CFPB's systems of records shall continue to be treated 
under the fee provisions of the Privacy Act of 1974, 5 U.S.C. 552a, 
which permit fees only for duplication, after the first one hundred 
(100) pages are furnished free of charge.
    (d) Other circumstances when fees are not charged. In the following 
situations the CFPB may not charge a requester certain FOIA processing 
fees.
    (1) If the cost of collecting a fee would be equal to or greater 
than the total FOIA processing fee, then the CFPB shall not charge a 
requester any FOIA processing fees.
    (2) If the total search and review fees are less than $250, then 
the CFPB shall not charge a requester any search and review fees.
    (3) If the CFPB has waived or reduced FOIA processing fees in 
accordance with paragraph (e) of this section, then the CFPB shall not 
charge the portion of the FOIA processing fees that has been waived or 
reduced.
    (4) If the CFPB fails to comply with any time limit under Sec.  
1070.15 or Sec.  1070.21, then the CFPB shall not assess search fees or 
if the requester is a representative of the news media or an 
educational or noncommercial scientific institution, then the CFPB 
shall not assess duplication fees, unless:
    (i) A court has determined that exceptional circumstances, as 
defined by the FOIA, exist; or
    (ii) The CFPB has determined that unusual circumstances apply to 
the processing of the request; and
    (A) Provided timely written notice to the requester of the unusual 
circumstances in accordance with Sec.  1070.16(d);
    (B) Determined that more than 5,000 pages are necessary to respond 
to the request; and
    (C) Discussed with the requester via mail, email, or telephone (or 
made not less than three good-faith attempts to do so) how the 
requester could effectively limit the scope of the request.
    (5) If the CFPB determines, as a matter of administrative 
discretion, that waiving or reducing the fees would serve the interest 
of the United States Government.
    (e) Waiver or reduction of fees. (1) A requester shall be entitled 
to receive from the CFPB a waiver or reduction in the fees otherwise 
applicable to a FOIA request whenever the requester:
    (i) Requests such waiver or reduction of fees in writing as part of 
the FOIA request;
    (ii) Labels the request for waiver or reduction of fees ``Fee 
Waiver or

[[Page 46092]]

Reduction Requested'' on the FOIA request; and
    (iii) Demonstrates that the fee reduction or waiver request that a 
waiver or reduction of the fees is in the public interest because:
    (A) Furnishing the information is likely to contribute 
significantly to public understanding of the operations or activities 
of the government; and
    (B) Furnishing the information is not primarily in the commercial 
interest of the requester.
    (2) To determine whether the requester has satisfied the 
requirements of paragraph (e)(1)(iii)(A) of this section, the CFPB 
shall consider the following factors:
    (i) The subject of the requested records must concern identifiable 
operations or activities of the Federal government, with a connection 
that is direct and clear, and not remote or attenuated.
    (ii) The disclosable portions of the requested records must be 
meaningfully informative about government operations or activities in 
order to be ``likely to contribute'' to an increased public 
understanding of those operations or activities. The disclosure of 
information that already is in the public domain, in either a 
duplicative or a substantially similar form, is not as likely to 
contribute to the public's understanding.
    (iii) The disclosure must contribute to the understanding of a 
reasonably broad audience of persons interested in the subject, as 
opposed to the individual understanding of the requester. A requester's 
expertise in the subject area and ability and intention to effectively 
convey information to the public shall be considered. It shall be 
presumed that a representative of the news media will satisfy this 
consideration.
    (iv) The public's understanding of the subject in question, as 
compared to the level of public understanding existing prior to the 
disclosure, must be enhanced by the disclosure to a significant extent.
    (3) To determine whether the requester has satisfied the 
requirements of paragraph (e)(1)(iii)(B) of this section, the CFPB 
shall consider the following factors:
    (i) The CFPB shall consider any commercial interest of the 
requester (with reference to the definition of ``commercial user'' in 
paragraph (b)(1)(i) of this section), or of any person on whose behalf 
the requester may be acting, that would be furthered by the requested 
disclosure. Requesters shall be given an opportunity in the 
administrative process to provide explanatory information regarding 
this consideration.
    (ii) A fee waiver or reduction is justified where the public 
interest standard is satisfied and that public interest is greater in 
magnitude than that of any identified commercial interest in 
disclosure. The CFPB ordinarily shall presume that where a news media 
requester has satisfied the public interest standard, the public 
interest will be the interest primarily served by disclosure to that 
requester. Disclosure to data brokers or others who merely compile and 
market government information for direct economic return shall not be 
presumed to primarily serve the public interest.
    (4) Where only some of the records to be released satisfy the 
requirements for a waiver of fees, a waiver shall be granted for those 
records.
    (5) If the CFPB denies a request to reduce or waive fees, then the 
CFPB shall advise the requester, in the denial notification letter, 
that the requester may incur fees if the CFPB proceeds to process the 
request. The notification letter shall also advise the requester that 
the CFPB will not proceed to process the request further unless the 
requester, in writing, directs the CFPB to do so and either agrees to 
pay any fees that may apply to processing the request or specifies an 
upper limit that the requester is willing to pay to process the 
request. If the CFPB does not receive this written direction and 
agreement/specification within thirty (30) calendar days of the date of 
the denial notification letter, then the CFPB shall deem the request to 
be withdrawn.
    (6) If the CFPB denies a request to reduce or waive fees, then the 
requester shall have the right to submit an appeal of the denial 
determination in accordance with Sec.  1070.21. The CFPB shall 
communicate this appeal right as part of its written notification to 
the requester denying the fee reduction or waiver request. The 
requester should label its appeal request ``Appeal for Fee Reduction/
Waiver.''
    (f) Advance notice and prepayment of fees. (1) The CFPB shall 
notify a requester of the estimated fees for processing a request and 
provide a breakdown of the fees attributable to search, review, and 
duplication, when the estimated fees are $250 or more and:
    (i) The fees exceed the limit set by the requester;
    (ii) The requester did not specify a limit; or
    (iii) The CFPB has denied a request for a reduction or waiver of 
fees.
    (2) The requester must provide an agreement to pay the estimated 
fees; however, the requester shall also be given an opportunity to 
reformulate the request in an attempt to reduce fees.
    (3) If the fees are estimated to exceed $1000, the requester must 
pre-pay such amount prior to the processing of the request, or provide 
satisfactory assurance of full payment if the requester has a history 
of prompt payment of FOIA fees. The requester shall also be given an 
opportunity to reformulate the request in such a way as to lower the 
applicable fees.
    (4) The CFPB reserves the right to request prepayment after a 
request is processed and before documents are released.
    (5) If a requester has previously failed to pay a fee within thirty 
(30) calendar days of the date of the billing, the requester shall be 
required to pay the full amount owed plus any applicable interest and 
to make an advance payment of the full amount of the estimated fee 
before the CFPB begins to process a new request or the pending request.
    (6) When the CFPB acts under paragraphs (f)(1) through (5) of this 
section, the statutory time limits of twenty (20) days (excluding 
Saturdays, Sundays, and legal public holidays) from receipt of initial 
requests or appeals, plus extensions of these time limits, shall begin 
only after fees have been paid, a written agreement to pay fees has 
been provided, or a request has been reformulated.
    (g) Form of payment. Payment may be tendered as set forth on the 
CFPB's website, https://www.consumerfinance.gov.
    (h) Charging interest. The CFPB may charge interest on any unpaid 
bill starting on the 31st day following the date of billing the 
requester. Interest charges will be assessed at the rate provided in 31 
U.S.C. 3717 and will accrue from the date of the billing until payment 
is received by the CFPB. The CFPB will follow the provisions of the 
Debt Collection Act of 1982 (Pub. L. 97-365, 96 Stat. 1749), as 
amended, and its administrative procedures, including the use of 
consumer reporting agencies, collection agencies, and offset.
    (i) Aggregating requests. Where the CFPB reasonably believes that a 
requester or a group of requesters acting together is attempting to 
divide a request into a series of requests for the purpose of avoiding 
fees, the CFPB may aggregate those requests and charge accordingly. The 
CFPB may presume that multiple requests of this type made within a 
thirty (30) day period have been made in order to avoid fees. Where 
requests are separated by a longer period, the CFPB will aggregate them 
only where there exists a solid basis for

[[Page 46093]]

determining that aggregation is warranted under all the circumstances 
involved. Multiple requests involving unrelated matters will not be 
aggregated.


Sec.  1070.23   Authority and responsibilities of the Chief FOIA 
Officer.

    (a) Chief FOIA Officer. The Director authorizes the Chief FOIA 
Officer to act upon all requests for agency records, with the exception 
of determining appeals from the initial determinations of the Chief 
FOIA Officer, which will be decided by the General Counsel. The Chief 
FOIA officer shall, subject to the authority of the Director:
    (1) Have CFPB-wide responsibility for efficient and appropriate 
compliance with the FOIA;
    (2) Monitor implementation of the FOIA throughout the CFPB and keep 
the Director, the General Counsel, and the Attorney General 
appropriately informed of the CFPB's performance in implementing the 
FOIA;
    (3) Recommend to the Director such adjustments to agency practices, 
policies, personnel and funding as may be necessary to improve the 
Chief FOIA Officer's implementation of the FOIA;
    (4) Review and report to the Attorney General, through the 
Director, at such times and in such formats as the Attorney General may 
direct, on the CFPB's performance in implementing the FOIA;
    (5) Facilitate public understanding of the purposes of the 
statutory exemptions of the FOIA by including concise descriptions of 
the exemptions in both the CFPB's handbook and the CFPB's annual report 
on the FOIA, and by providing an overview, where appropriate, of 
certain general categories of CFPB records to which those exemptions 
apply;
    (6) Designate one or more FOIA Public Liaisons;
    (7) Offer Training to Bureau staff regarding their responsibilities 
under the FOIA;
    (8) Serve as the primary Bureau liaison with the Office of 
Government Information Services and the Office of Information Policy; 
and
    (9) Maintain and update, as necessary and in accordance with the 
requirements of this subpart, the CFPB's FOIA website, including its e-
FOIA Library.
    (b) FOIA Public Liaisons. FOIA Public Liaisons shall report to the 
Chief FOIA Officer and shall serve as supervisory officials to whom a 
requester can raise concerns about the service the requester has 
received from the CFPB's FOIA office, following an initial response 
from the FOIA office staff. FOIA Public Liaisons shall be responsible 
for assisting in reducing delays, increasing transparency and 
understanding of the status of requests, and assisting in the 
resolution of disputes.

Subpart C--Disclosure of CFPB Information in Connection with Legal 
Proceedings


Sec.  1070.30  Purpose and scope; definitions.

    (a) This subpart sets forth the procedures to be followed with 
respect to subpoenas, court orders, or other requests or demands for 
any CFPB information, whether contained in the files of the CFPB or 
acquired by a CFPB employee as part of the performance of that 
employee's duties or by virtue of employee's official status.
    (b) This subpart does not apply to requests for official 
information made pursuant to subparts B, D, and E of this part.
    (c) This subpart does not apply to requests for information made in 
the course of adjudicating claims against the CFPB by CFPB employees 
(present or former) or applicants for CFPB employment for which 
jurisdiction resides with the U.S. Equal Employment Opportunity 
Commission, the U.S. Merit Systems Protection Board, the Office of 
Special Counsel, the Federal Labor Relations Authority, or their 
successor agencies, or a labor arbitrator operating under a collective 
bargaining agreement between the CFPB and a labor organization 
representing CFPB employees.
    (d) This subpart is intended only to inform the public about CFPB 
procedures concerning the service of process and responses to 
subpoenas, summons, or other demands or requests for official 
information or action and is not intended to and does not create, and 
may not be relied upon to create any right or benefit, substantive or 
procedural, enforceable at law by a party against the CFPB or the 
United States.
    (e) For purposes of this subpart:
    (1) Demand means a subpoena or order for official information, 
whether contained in CFPB records or through testimony, related to or 
for possible use in a legal proceeding.
    (2) Legal proceeding encompasses all pre-trial, trial, and post-
trial stages of all judicial or administrative actions, hearings, 
investigations, or similar proceedings before courts, commissions, 
boards, grand juries, arbitrators, or other judicial or quasi-judicial 
bodies or tribunals, whether criminal, civil, or administrative in 
nature, and whether foreign or domestic. This phrase includes all 
stages of discovery as well as formal or informal requests by 
attorneys, their agents, or others involved in legal proceedings.
    (3) Official Information means all information of any kind, however 
stored, that is in the custody and control of the CFPB or was acquired 
by CFPB employees, or former employees as part of their official duties 
or because of their official status while such individuals were 
employed by or served on behalf of the CFPB. Official information also 
includes any information acquired by CFPB employees or former employees 
while such individuals were engaged in matters related to consumer 
financial protection functions prior to the employees' transfer to the 
CFPB pursuant to Subtitle F of the Consumer Financial Protection Act of 
2010.
    (4) Request means any request for official information in the form 
of testimony, affidavits, declarations, admissions, responses to 
interrogatories, document production, inspections, or formal or 
informal interviews, during the course of a legal proceeding, including 
pursuant to the Federal Rules of Civil Procedure, the Federal Rules of 
Criminal Procedure, or other applicable rules of procedure.
    (5) Testimony means a statement in any form, including personal 
appearances before a court or other legal tribunal, interviews, 
depositions, telephonic, televised, or videographed statements or any 
responses given during discovery or similar proceeding in the course of 
litigation.


Sec.  1070.31  Service of subpoenas, court orders, and other demands 
for CFPB information or action.

    (a) Except in cases in which the CFPB is represented by legal 
counsel who have entered an appearance or otherwise given notice of 
their representation, only the General Counsel is authorized to receive 
and accept subpoenas or other demands or requests directed to the CFPB 
or its employees, whether civil or criminal in nature, for:
    (1) Records of the CFPB;
    (2) Official information including, but not limited to, testimony, 
affidavits, declarations, admissions, responses to interrogatories, or 
informal statements, relating to material contained in the files of the 
CFPB or which any CFPB employee acquired in the course and scope of the 
performance of his or her official duties;
    (3) Garnishment or attachment of compensation of current or former 
employees; or
    (4) The performance or non-performance of any official CFPB duty.
    (b) Documents described in paragraph (a) of this section should be 
served upon

[[Page 46094]]

the General Counsel, Consumer Financial Protection Bureau, 1700 G 
Street NW, Washington, DC 20552. Service must be effected as provided 
in applicable rules and regulations governing service in Federal 
judicial and administrative proceedings. Acceptance of such documents 
by the General Counsel does not constitute a waiver of any defense that 
might otherwise exist with respect to service under the Federal Rules 
of Civil or Criminal Procedure or other applicable laws or regulations.
    (c) In the event that any demand or request described in paragraph 
(a) of this section is sought to be delivered to a CFPB employee other 
than in the manner prescribed in paragraph (b) of this section, such 
employee shall decline service and direct the server of process to 
these regulations. If the demand or request is nonetheless delivered to 
the employee, the employee shall immediately notify, and deliver a copy 
of that document to, the General Counsel.
    (d) The CFPB is not an agent for service for, or otherwise 
authorized to accept on behalf of its employees, any subpoenas, orders, 
or other demands or requests, which are not related to the employees' 
official duties.
    (e) Copies of any subpoenas, orders, or other demands or requests 
that are directed to former employees of the CFPB in connection with 
the performance of official CFPB duties shall also be served upon the 
General Counsel. The CFPB shall not, however, serve as an agent for 
service for the former employee, nor is the CFPB otherwise authorized 
to accept service on behalf of its former employees. If the demand 
involves their official duties as CFPB employees, former employees who 
receive subpoenas, orders, or similar compulsory process should also 
notify, and deliver a copy of the document to, the General Counsel.


Sec.  1070.32  Testimony and production of documents prohibited unless 
approved by the General Counsel.

    (a) Unless authorized by the General Counsel, no employee or former 
employee of the CFPB shall, in response to a demand or a request 
provide oral or written testimony by deposition, declaration, 
affidavit, or otherwise concerning any official information.
    (b) Unless authorized by the General Counsel, no employee or former 
employee shall, in response to a demand or request, produce any 
document or any material acquired as part of the performance of that 
employee's duties or by virtue of that employee's official status.


Sec.  1070.33  Procedure when testimony or production of documents is 
sought; general.

    (a) If, as part of a proceeding in which the United States or the 
CFPB is not a party, official information is sought through a demand 
for testimony, CFPB records, or other material, the party seeking such 
information must (except as otherwise required by Federal law or 
authorized by the General Counsel) set forth in writing:
    (1) The title and forum of the proceeding, if applicable;
    (2) A detailed description of the nature and relevance of the 
official information sought;
    (3) A showing that other evidence reasonably suited to the 
requester's needs is not available from any other source; and
    (4) If testimony is requested, the intended use of the testimony, a 
general summary of the desired testimony, and a showing that no 
document could be provided and used in lieu of testimony.
    (b) To the extent he or she deems necessary or appropriate, the 
General Counsel may also require from the party seeking such 
information a plan of all reasonably foreseeable demands, including but 
not limited to the names of all employees and former employees from 
whom testimony or discovery will be sought, areas of inquiry, expected 
duration of proceedings requiring oral testimony, identification of 
potentially relevant documents, or any other information deemed 
necessary to make a determination. The purpose of this requirement is 
to assist the General Counsel in making an informed decision regarding 
whether testimony, the production of documents, or the provision of 
other information should be authorized.
    (c) The General Counsel may consult or negotiate with an attorney 
for a party, or the party if not represented by an attorney, to refine 
or limit a request or demand so that compliance is less burdensome.
    (d) The General Counsel will notify the CFPB employee and such 
other persons as circumstances may warrant of his or her decision 
regarding compliance with the request or demand.


Sec.  1070.34  Procedure when response to demand is required prior to 
receiving instructions.

    (a) If a response to a demand described in Sec.  1070.33 is 
required before the General Counsel renders a decision, the CFPB will 
request that the appropriate CFPB attorney or an attorney of the 
Department of Justice, as appropriate, take steps to stay, postpone, or 
obtain relief from the demand pending decision. If necessary, the 
attorney will:
    (1) Appear with the employee upon whom the demand has been made;
    (2) Furnish the court or other authority with a copy of the 
regulations contained in this subpart;
    (3) Inform the court or other authority that the demand has been, 
or is being, as the case may be, referred for the prompt consideration 
of the appropriate CFPB official; and
    (4) Request the court or authority to stay the demand pending 
receipt of the requested instructions.
    (b) In the event that an immediate demand for production or 
disclosure is made in circumstances which would preclude the proper 
designation or appearance of an attorney of the CFPB or the Department 
of Justice on the employee's behalf, the employee, if necessary, shall 
request from the demanding court or authority a reasonable stay of 
proceedings for the purpose of obtaining instructions from the General 
Counsel.


Sec.  1070.35  Procedure in the event of an adverse ruling.

    If a stay of, or other relief from, the effect of a demand made 
pursuant to Sec. Sec.  1070.33 and 1070.34 is declined or not obtained, 
or if the court or other judicial or quasi-judicial authority declines 
to stay the effect of the demand made pursuant to Sec. Sec.  1070.33 
and 1070.34, or if the court or other authority rules that the demand 
must be complied with irrespective of the General Counsel's 
instructions not to produce the material or disclose the information 
sought, the employee upon whom the demand has been made shall decline 
to comply with the demand citing this subpart and United States ex rel. 
Touhy v. Ragen, 340 U.S. 462 (1951).


Sec.  1070.36  Considerations in determining whether the CFPB will 
comply with a demand or request.

    (a) In deciding whether to comply with a demand or request, CFPB 
officials and attorneys shall consider, among other pertinent 
considerations:
    (1) Whether such compliance would be unduly burdensome or otherwise 
inappropriate under the applicable rules of discovery or the rules of 
procedure governing the case or matter in which the demand arose;
    (2) Whether the number of similar requests would have a cumulative 
effect on the expenditure of CFPB resources;
    (3) Whether compliance is appropriate under the relevant 
substantive law concerning privilege or disclosure of information;

[[Page 46095]]

    (4) The public interest;
    (5) The need to conserve the time of CFPB employees for the conduct 
of official business;
    (6) The need to avoid spending time and money of the United States 
for private purposes;
    (7) The need to maintain impartiality between private litigants in 
cases where a substantial government interest is not implicated;
    (8) Whether compliance would have an adverse effect on performance 
by the CFPB of its mission and duties;
    (9) The need to avoid involving the CFPB in controversial issues 
not related to its mission;
    (10) Whether compliance would interfere with supervisory 
examinations, compromise the CFPB's supervisory functions or programs, 
or undermine public confidence in supervised financial institutions; 
and
    (11) Whether compliance would interfere with the CFPB's ability to 
monitor for risks to consumers in the offering or provision of consumer 
financial products and services.
    (b) Among those demands and requests in response to which 
compliance will not ordinarily be authorized are those with respect to 
which any of the following factors, inter alia, exist:
    (1) Compliance would violate a statute or applicable rule of 
procedure;
    (2) Compliance would violate a specific regulation or Executive 
order;
    (3) Compliance would reveal information properly classified in the 
interest of national security;
    (4) Compliance would reveal confidential or privileged commercial 
or financial information or trade secrets without the owner's consent;
    (5) Compliance would compromise the integrity of the deliberative 
processes of the CFPB;
    (6) Compliance would not be appropriate or necessary under the 
relevant substantive law governing privilege;
    (7) Compliance would reveal confidential information; or
    (8) Compliance would interfere with ongoing investigations or 
enforcement proceedings, compromise constitutional rights, or reveal 
the identity of a confidential informant.
    (c) The CFPB may condition disclosure of official information 
pursuant to a request or demand on the entry of an appropriate 
protective order.


Sec.  1070.37  Prohibition on providing expert or opinion testimony.

    (a) Except as provided in this section, and subject to 5 CFR 
2635.805, CFPB employees or former employees shall not provide opinion 
or expert testimony based upon information which they acquired in the 
scope and performance of their official CFPB duties, except on behalf 
of the CFPB or the United States or a party represented by the CFPB, or 
the Department of Justice, as appropriate.
    (b) Any expert or opinion testimony by a former employee of the 
CFPB shall be excepted from paragraph (a) of this section where the 
testimony involves only general expertise gained while employed at the 
CFPB.
    (c) Upon a showing by the requester of exceptional need or unique 
circumstances and that the anticipated testimony will not be adverse to 
the interests of the United States, the General Counsel may, consistent 
with 5 CFR 2635.805, exercise his or her discretion to grant special, 
written authorization for CFPB employees, or former employees, to 
appear and testify as expert witnesses at no expense to the United 
States.
    (d) If, despite the final determination of the General Counsel, a 
court of competent jurisdiction or other appropriate authority orders 
the appearance and expert or opinion testimony of a current or former 
CFPB employee, that person shall immediately inform the General Counsel 
of such order. If the General Counsel determines that no further legal 
review of or challenge to the court's order will be made, the CFPB 
employee, or former employee, shall comply with the order. If so 
directed by the General Counsel, however, the employee, or former 
employee, shall decline to testify.

0
7. Revise subpart E to read as follows:
Subpart E--Privacy Act
Sec.
1070.50 Purpose and scope; definitions.
1070.51 Authority and responsibilities of the Chief Privacy Officer.
1070.52 Fees.
1070.53 Request for access to records.
1070.54 CFPB procedures for responding to a request for access.
1070.55 Special procedures for medical records.
1070.56 Request for amendment of records.
1070.57 CFPB review of a request for amendment of records.
1070.58 Appeal of adverse determination of request for access or 
amendment.
1070.59 Restrictions on disclosure.
1070.60 Exempt records.
1070.61 Training; rules of conduct; penalties for non-compliance.
1070.62 Preservation of records.
1070.63 Use and collection of Social Security numbers.

Subpart E--Privacy Act


Sec.  1070.50   Purpose and scope; definitions.

    (a) This subpart implements the provisions of the Privacy Act of 
1974, 5 U.S.C. 552a (the Privacy Act). The regulations apply to all 
records maintained by the CFPB and which are retrieved by an 
individual's name or personal identifier. The regulations set forth the 
procedures for requests for access to, or amendment of, records 
concerning individuals that are contained in systems of records 
maintained by the CFPB. These regulations should be read in conjunction 
with the Privacy Act, which provides additional information about this 
topic.
    (b) For purposes of this subpart, the following definitions apply:
    (1) The term Chief Privacy Officer means the Chief Information 
Officer of the CFPB or any CFPB employee to whom the Chief Information 
Officer has delegated authority to act under this part;
    (2) The term guardian means the parent of a minor, or the legal 
guardian of any individual who has been declared to be incompetent due 
to physical or mental incapacity or age by a court of competent 
jurisdiction;
    (3) Individual means a citizen of the United States or an alien 
lawfully admitted for permanent residence;
    (4) Maintain includes maintain, collect, use, or disseminate;
    (5) Record means any item, collection, or grouping of information 
about an individual that is maintained by an agency, including, but not 
limited to, his education, financial transactions, medical history, and 
criminal or employment history and that contains his name or the 
identifying number, symbol, or other identifying particular assigned to 
the individual, such as a finger or voiceprint or a photograph;
    (6) Routine use means the disclosure of a record that is compatible 
with the purpose for which it was collected;
    (7) System of records means a group of any records under the 
control of an agency from which information is retrieved by the name of 
the individual or by some identifying number, symbol, or other 
identifying particular assigned to the individual; and
    (8) Statistical record means a record in a system of records 
maintained for statistical research or reporting purposes only and not 
used in whole or in part in making any determination about an 
identifiable individual, except as provided by 13 U.S.C. 8.

[[Page 46096]]

Sec.  1070.51   Authority and responsibilities of the Chief Privacy 
Officer.

    The Chief Privacy Officer is authorized to:
    (a) Develop, implement, and maintain an organization-wide privacy 
program;
    (b) Respond to requests for access to, accounting of, or amendment 
of records contained in a system of records maintained by the CFPB;
    (c) Approve the publication of new systems of records and amend 
existing systems of record; and
    (d) File any necessary reports related to the Privacy Act.


Sec.  1070.52  Fees.

    (a) Copies of records. The CFPB shall provide the requester with 
copies of records requested pursuant to Sec.  1070.53 at the same cost 
charged for duplication of records under Sec.  1070.22.
    (b) No fee. The CFPB will not charge a fee if:
    (1) Total charges associated with a request are less than $5; or
    (2) The requester is a CFPB employee or former employee, or an 
applicant for employment with the CFPB, and the request pertains to 
that employee, former employee, or applicant.


Sec.  1070.53  Request for access to records.

    (a) Procedures for making a request for access to records. An 
individual's requests for access to records that pertain to that 
individual (or to the individual for whom the requester serves as 
guardian) may be submitted to the CFPB in writing as follows:
    (1) If submitted by mail or delivery service, the request shall be 
labeled ``Privacy Act Request'' and shall be addressed to the Chief 
Privacy Officer, Consumer Financial Protection Bureau, 1700 G Street 
NW, Washington, DC 20552.
    (2) If submitted by electronic means, the request shall be labeled 
``Privacy Act Request'' and the request shall be submitted as set forth 
at the CFPB's website, https://www.consumerfinance.gov.
    (b) Content of a request for access to records. A request for 
access to records shall include:
    (1) A statement that the request is made pursuant to the Privacy 
Act;
    (2) The name of the system of records that the requester believes 
contains the record requested, or a description of the nature of the 
record sought in detail sufficient to enable CFPB personnel to locate 
the system of records containing the record with a reasonable amount of 
effort;
    (3) Whenever possible, a description of the nature of the record 
sought, the date of the record or the period in which the requester 
believes that the record was created, and any other information that 
might assist the CFPB in identifying the record sought (e.g., maiden 
name, dates of employment, account information, etc.);
    (4) Information necessary to verify the requester's identity 
pursuant to paragraph (c) of this section; and
    (5) The mailing or email address where the CFPB's response or 
further correspondence should be sent.
    (c) Verification of identity. To obtain access to the CFPB's 
records pertaining to a requester, the requester shall provide proof to 
the CFPB of the requester's identity as provided in paragraphs (c)(1) 
and (2) of this section.
    (1) In general, the following will be considered adequate proof of 
a requester's identity:
    (i) A photocopy of two forms of identification, including one form 
of identification that bears the requester's photograph, and one form 
of identification that bears the requester's signature;
    (ii) A photocopy of a single form of identification that bears both 
the requester's photograph and signature; or
    (iii) A statement swearing or affirming the requester's identity 
and to the fact that the requester understands the penalties provided 
in 5 U.S.C. 552a(i)(3).
    (2) Notwithstanding paragraph (c)(1) of this section, a designated 
official may require additional proof of the requester's identity 
before action will be taken on any request, if such official determines 
that it is necessary to protect against unauthorized disclosure of 
information in a particular case. In addition, if a requester seeks 
records pertaining to an individual in the requester's capacity as that 
individual's guardian, the requester shall be required to provide 
adequate proof of the requester's legal relationship before action will 
be taken on any request.
    (d) Request for accounting of previous disclosures. An individual 
may request an accounting of previous disclosures of records pertaining 
to that individual in a system of records as provided in 5 U.S.C. 
552a(c). Such requests should conform to the procedures and form for 
requests for access to records set forth in paragraphs (a) and (b) of 
this section.


Sec.  1070.54  CFPB procedures for responding to a request for access.

    (a) Acknowledgment and response. The CFPB will provide written 
acknowledgement of the receipt of a request within twenty (20) business 
days from the receipt of the request and will, where practicable, 
respond to each request within that twenty (20) day period. When a full 
response is not practicable within the twenty (20) day period, the CFPB 
will respond as promptly as possible.
    (b) Disclosure. (1) When the CFPB discloses information in response 
to a request, the CFPB will make the information available for 
inspection and copying during regular business hours as provided in 
Sec.  1070.13, or the CFPB will mail it or email it to the requester, 
if feasible, upon request.
    (2) The requester may bring with him or her anyone whom the 
requester chooses to see the requested material. All visitors to the 
CFPB's buildings must comply with the applicable security procedures.
    (c) Denial of a request. If the CFPB denies a request made pursuant 
to Sec.  1070.53, it will inform the requester in writing of the 
reason(s) for denial and the procedures for appealing the denial.


Sec.  1070.55  Special procedures for medical records.

    If an individual requests medical or psychological records pursuant 
to Sec.  1070.53, the CFPB will disclose them directly to the requester 
unless the CFPB determines that such disclosure could have an adverse 
effect on the requester. If the CFPB makes that determination, the CFPB 
shall provide the information to a licensed physician or other 
appropriate representative that the requester designates, who shall 
disclose those records to the requester in a manner he or she deems 
appropriate.


Sec.  1070.56  Request for amendment of records.

    (a) Procedures for making request. (1) If an individual wishes to 
amend a record that pertains to that individual in a system of records, 
that individual may submit a request in writing to the Chief Privacy 
Officer, as set forth in Sec.  1070.53(a). The request shall be labeled 
``Privacy Act Amendment Request.''
    (2) A request for amendment of a record must:
    (i) Identify the name of the system of records that the requester 
believes contains the record for which the amendment is requested, or a 
description of the nature of the record in detail sufficient to enable 
CFPB personnel to locate the system of records containing the record 
with a reasonable amount of effort;
    (ii) Specify the portion of that record requested to be amended; 
and
    (iii) Describe the nature and reasons for each requested amendment.
    (3) When making a request for amendment of a record, the CFPB will

[[Page 46097]]

require a requester to verify his or her identity under the procedures 
set forth in Sec.  1070.53(c), unless the requester has already done so 
in a related request for access or amendment.
    (b) Burden of proof. In a request for amendment of a record, the 
requester bears the burden of proving by a preponderance of the 
evidence that the record is not accurate, relevant, timely, or 
complete.


Sec.  1070.57  CFPB review of a request for amendment of records.

    (a) Time limits. The CFPB will acknowledge a request for amendment 
of records within ten (10) business days after it receives the request. 
In the acknowledgment, the CFPB may request additional information 
necessary for a determination on the request for amendment. The CFPB 
will make a determination on a request to amend a record promptly.
    (b) Contents of response to a request for amendment. When the CFPB 
responds to a request for amendment, the CFPB will inform the requester 
in writing whether the request is granted or denied, in whole or in 
part. If the CFPB grants the request, it will take the necessary steps 
to amend the record and, when appropriate and possible, notify prior 
recipients of the record of its action. If the CFPB denies the request, 
in whole or in part, it will inform the requester in writing:
    (1) Why the request (or portion of the request) was denied;
    (2) That the requester has a right to appeal; and
    (3) How to file an appeal.


Sec.  1070.58  Appeal of adverse determination of request for access or 
amendment.

    (a) Appeal. A requester may appeal a denial of a request made 
pursuant to Sec.  1070.53 or Sec.  1070.56 within ten (10) business 
days after the CFPB notifies the requester that it has denied the 
request.
    (b) Content of appeal. A requester may submit an appeal in writing 
as set forth in Sec.  1070.53(a). The appeal shall be addressed to the 
General Counsel and labeled ``Privacy Act Appeal.'' The appeal must 
also:
    (1) Specify the background of the request; and
    (2) Provide reasons why the requester believes the denial is in 
error.
    (c) Determination. The General Counsel will make a determination as 
to whether to grant or deny an appeal within thirty (30) business days 
from the date it is received, unless the General Counsel extends the 
time for good cause.
    (1) If the General Counsel grants an appeal regarding a request for 
amendment, he or she will take the necessary steps to amend the record 
and, when appropriate and possible, notify prior recipients of the 
record of its action.
    (2) If the General Counsel denies an appeal, he or she will inform 
the requester of such determination in writing, including the reasons 
for the denial, and the requester's right to file a statement of 
disagreement and to have a court review its decision.
    (d) Statement of disagreement. (1) If the General Counsel denies an 
appeal regarding a request for amendment, a requester may file a 
concise statement of disagreement with the denial. The CFPB will 
maintain the requester's statement with the record that the requester 
sought to amend and any disclosure of the record will include a copy of 
the requester's statement of disagreement.
    (2) When practicable and appropriate, the CFPB will provide a copy 
of the statement of disagreement to any prior recipients of the record.


Sec.  1070.59  Restrictions on disclosure.

    The CFPB will not disclose any record about an individual contained 
in a system of records to any person or agency without the prior 
written consent of that individual unless the disclosure is authorized 
by 5 U.S.C. 552a(b). Disclosures authorized by 5 U.S.C. 552a(b) include 
disclosures that are compatible with one or more routine uses that are 
contained within the CFPB's Systems of Records Notices, which are 
available on the CFPB's website, at https://www.consumerfinance.gov.


Sec.  1070.60  Exempt records.

    (a) Exempt systems of records. Pursuant to 5 U.S.C. 552a(k)(2), the 
CFPB exempts the systems of records listed in paragraphs (a)(1) through 
(4) of this section from 5 U.S.C. 552a(c)(3), (d), (e)(1), (e)(4)(G)-
(H), and (f), and Sec. Sec.  1070.53 through 1070.59, to the extent 
that such systems of records contain investigatory materials compiled 
for law enforcement purposes, provided, however, that if any individual 
is denied any right, privilege, or benefit to which he or she would 
otherwise be entitled under Federal law, or for which he or she would 
otherwise be eligible as a result of the maintenance of such material, 
such material shall be disclosed to such individual, except to the 
extent that the disclosure of such material would reveal the identity 
of a source who furnished information to the CFPB under an express 
promise that the identity of the source would be held in confidence:
    (1) CFPB.002 Depository Institution Supervision Database.
    (2) CFPB.003 Non-Depository Institution Supervision Database.
    (3) CFPB.004 Enforcement Database.
    (4) CFPB.005 Consumer Response System.
    (b) Information compiled for civil actions or proceedings. This 
subpart does not permit an individual to have access to any information 
compiled in reasonable anticipation of a civil action or proceeding.


Sec.  1070.61  Training; rules of conduct; penalties for non-
compliance.

    (a) Training. The Chief Privacy Officer shall institute a training 
program to instruct CFPB employees and contractor personnel covered by 
5 U.S.C. 552a(m), who are involved in the design, development, 
operation, or maintenance of any CFPB system of records, on a 
continuing basis with respect to the duties and responsibilities 
imposed on them and the rights conferred on individuals by the Privacy 
Act, the regulations in this subpart, and any other related 
regulations. Such training shall provide suitable emphasis on the civil 
and criminal penalties imposed on the CFPB and the individual employees 
or contractor personnel by the Privacy Act for non-compliance with 
specified requirements of the Act as implemented by the regulations in 
this subpart.
    (b) Rules of conduct. The following rules of conduct are applicable 
to employees of the CFPB (including, to the extent required by the 
contract or 5 U.S.C. 552a(m), Government contractors and employees of 
such contractors), who are involved in the design, development, 
operation or maintenance of any system of records, or in maintaining 
any records, for or on behalf of the CFPB.
    (1) The head of each office of the CFPB shall be responsible for 
assuring that employees subject to such official's supervision are 
advised of the provisions of the Privacy Act, including the criminal 
penalties and civil liabilities provided therein, and the regulations 
in this subpart, and that such employees are made aware of their 
individual and collective responsibilities to protect the security of 
personal information, to assure its accuracy, relevance, timeliness and 
completeness, to avoid unauthorized disclosure either orally or in 
writing, and to ensure that no system of records is maintained without 
public notice.
    (2) Employees of the CFPB involved in the design, development, 
operation, or maintenance of any system of records, or in maintaining 
any record shall:

[[Page 46098]]

    (i) Collect no information of a personal nature from individuals 
unless authorized to collect it to achieve a function or carry out a 
responsibility of the CFPB;
    (ii) Collect information, to the extent practicable, directly from 
the individual to whom it relates;
    (iii) Inform each individual asked to supply information, on the 
form used to collect the information or on a separate form that can be 
retained by the individual of--
    (A) The authority (whether granted by statute, or by executive 
order of the President) which authorizes the solicitation of the 
information and whether disclosure of such information is mandatory or 
voluntary;
    (B) The principal purpose or purposes for which the information is 
intended to be used;
    (C) The routine uses which may be made of the information, as 
published pursuant to 5 U.S.C. 552a(e)(4)(D); and
    (D) The effects on the individual, if any, of not providing all or 
any part of the requested information;
    (iv) Not collect, maintain, use or disseminate information 
concerning an individual's religious or political beliefs or activities 
or membership in associations or organizations, unless expressly 
authorized by statute or by the individual about whom the record is 
maintained or unless pertinent to and within the scope of an authorized 
law enforcement activity;
    (v) Advise their supervisors of the existence or contemplated 
development of any record system which is capable of retrieving 
information about individuals by individual identifier;
    (vi) Assure that no records maintained in a CFPB system of records 
are disseminated without the permission of the individual about whom 
the record pertains, except when authorized by 5 U.S.C. 552a(b);
    (vii) Maintain and process information concerning individuals with 
care in order to ensure that no inadvertent disclosure of the 
information is made either within or without the CFPB;
    (viii) Prior to disseminating any record about an individual to any 
person other than an agency, unless the dissemination is made pursuant 
to 5 U.S.C. 552a(b)(2), make reasonable efforts to assure that such 
records are accurate, complete, timely, and relevant for agency 
purposes; and
    (ix) Assure that an accounting is kept in the prescribed form, of 
all dissemination of personal information outside the CFPB, whether 
made orally or in writing, unless disclosed under 5 U.S.C. 552 or 
subpart B of this part.
    (3) The head of each office of the CFPB shall, at least annually, 
review the record systems subject to their supervision to ensure 
compliance with the provisions of the Privacy Act of 1974 and the 
regulations in this subpart.


Sec.  1070.62  Preservation of records.

    The CFPB will preserve all correspondence pertaining to the 
requests that it receives under this part, as well as copies of all 
requested records, until disposition or destruction is authorized by 
title 44 of the United States Code or the National Archives and Records 
Administration's General Records Schedule 14. Records will not be 
disposed of or destroyed while they are the subject of a pending 
request, appeal, proceeding, or lawsuit.


Sec.  1070.63  Use and collection of Social Security numbers.

    The CFPB will ensure that employees authorized to collect 
information are aware:
    (a) That individuals may not be denied any right, benefit, or 
privilege as a result of refusing to provide their Social Security 
numbers, unless the collection is authorized either by a statute or by 
a regulation issued prior to 1975; and
    (b) That individuals requested to provide their Social Security 
numbers must be informed of:
    (1) Whether providing Social Security numbers is mandatory or 
voluntary;
    (2) Any statutory or regulatory authority that authorizes the 
collection of Social Security numbers; and
    (3) The uses that will be made of the numbers.

    Dated: August 30, 2018.
Mick Mulvaney,
Acting Director, Bureau of Consumer Financial Protection.
[FR Doc. 2018-19384 Filed 9-11-18; 8:45 am]
 BILLING CODE 4810-AM-P