United States: CFPB Proposes Rule On Confidential Treatment Of Privileged Information

In response to continuing concerns of the industry and policymakers about the treatment of privileged information submitted to supervisory personnel at the US Bureau of Consumer Financial Protection (the "CFPB"), the CFPB has published for public comment by April 16, 2012 a proposed rule that purports to preserve applicable legal privileges with respect to third parties (not the CFPB itself) when information is provided to the CFPB for any purpose in the course of supervisory or regulatory process.¹

As a part of the proposed rule, the CFPB is also proposing to readopt a slightly revised version of an interim final rule issued on July 28, 2011 in order to clarify the CFPB's position that sharing of information by the CFPB with Federal and State agencies as required or authorized by Title X of the Dodd–Frank Wall Street Reform and Consumer Protection Act (the "Dodd-Frank Act") does not affect the confidential and privileged nature of the information. Title X of the Dodd-Frank Act requires the CFPB to share final and draft examination reports with other Federal and State agencies and authorizes the CFPB to engage in joint investigations and administrative discovery with other Federal and State agencies.² The proposed rule provides that the CFPB shall not be deemed to have waived any applicable privilege by transferring privileged information to a Federal or State agency or permitting such an agency to use that information.

The proposed rule is intended to provide CFPB-supervised entities "...further assurances that the submission of privileged information to the [CFPB] or the [CFPB's] subsequent transmission of the information to other government agencies, will not affect the privileged and confidential nature of the information."³

The proposed rule is substantively identical to the provisions of the Federal Deposit Insurance Act and the Federal Credit Union Act that apply to the submission of privileged information by regulated institutions to the prudential regulators and to sharing of such information among regulators.⁴ Neither of these statutory provisions expressly applies to privileged information that is submitted to, or shared with Federal and State agencies by, the CFPB. While the proposed rule is helpful to CFPB-supervised entities, it is not a substitute for the statutory protections that apply to the submission of privileged information to the prudential regulators or to the transfer of such information by a prudential regulator to a Federal or State agency.

On March 26, 2012, the House of Representatives passed legislation by voice vote (H.R. 4014) that would provide privileged information submitted to the CFPB the same statutory confidentiality protection accorded information submitted to the prudential regulators in the course of supervisory or regulatory process, and the same assurance of non-waiver of applicable privileges for information transferred from the CFPB to a Federal or State agency. Senators Tim Johnson (D-SD) and Richard Shelby (R-AL) have introduced an identical bill in the Senate (S. 2099). It appears likely that a bill providing this statutory privilege protection would pass the Senate if voted upon. However, it is unclear when or whether this bill might be considered by the Senate.

Comparison to the January CFPB Bulletin

On January 4, 2012, the CFPB issued Bulletin 12-01, "The Bureau's Supervision Authority and Treatment of Confidential Supervisory Information," (the "January CFPB Bulletin") to provide guidance regarding the agency's collection of information through the supervisory process and the confidentiality protections that the CFPB believes this process provides to information so collected.⁵

The proposed rule would build upon and expand the foundation laid by the January CFPB Bulletin in two important ways—one, by expanding the scope of covered institutions to include nondepository institutions supervised by the CFPB, and two, by transforming the essential content of the January CFPB Bulletin into a notice-and-comment rulemaking. The proposed rule relies upon generally comparable legal authority to that set forth in the January CFPB Bulletin plus the CFPB rulemaking authority and authority to supervise nondepository institutions.

Expanded Scope Covers Nondepository Institutions

The proposed rule would cover information submitted to the CFPB by certain nondepository institutions (described below) and their service providers as well as by the larger depository institutions and their affiliates that were covered already by the January CFPB Bulletin. The CFPB has statutory authority to supervise insured depository institutions and credit unions with total assets greater than $10 billion and their affiliates for compliance with Federal consumer financial laws and related purposes.⁶ The January CFPB Bulletin applied only to privileged information provided by these types of institutions in connection with supervisory requests made by the CFPB.

The CFPB also has statutory authority to supervise nondepository covered persons for compliance with Federal consumer financial laws and related purposes.⁷ That authority varies according to type of consumer financial product or service and the size of the institution. The CFPB has authority to supervise nondepository covered persons that offer or provide to consumers payday loans; private education loans; and mortgage loan origination, brokerage or servicing and related modification and foreclosure relief services. The proposed rule would cover privileged information supplied to the CFPB in connection with supervisory requests made to these types of institutions and to those institutions that the CFPB defines by regulation as larger participants in certain consumer financial product and service markets.⁸

Notice-and-comment Process

The CFPB is proceeding through notice-and-comment rulemaking, creating a rulemaking record through consideration of public comment, and will ultimately codify the final rule in the Code of Federal Regulations. This process might have the effect of marginally enhancing the judicial deference that may be accorded to a final rule in any subsequent legal challenge under the Administrative Procedure Act.

Comparable Assertion of Legal Authority

The January CFPB Bulletin and the proposed rule assert several identical legal authorities to support the CFPB's conclusion that disclosure of privileged information to the CFPB will not waive or otherwise affect any legal privileges that may be claimed with respect to such information under Federal or State law as to any person or entity, except the CFPB.

First, the CFPB relies upon the transfer from the prudential regulators of all "powers and duties that were vested in [the regulators] relating to consumer financial protection functions" on the day before July 21, 2011, the designated transfer date established by the Secretary of the Treasury.⁹ The CFPB indicates that, at times, the agency will request CFPB-supervised entities to provide information that may be subject to one or more statutory or common law privileges, including the attorney-client privilege and attorney work product protection.

The CFPB notes that the prudential regulators have taken the position that a supervised institution's submission of privileged information to the regulator does not waive privilege with respect to third parties. While this position is codified in law for privileged information provided to the prudential regulators, but not for privileged information provided to the CFPB, the CFPB states that the grant of authority that transferred to the CFPB all of the powers and duties of the prudential regulators relating to consumer financial protection functions "encompasses the ability to receive privileged information without effecting a waiver."¹⁰

Second, the CFPB relies upon "nearly identical authority to supervise" certain nondepository institutions. This authority includes authority to prescribe rules to facilitate the supervision of nondepository institutions and assessment and detection of risks to consumers.¹¹ The CFPB did not rely upon this authority in the January CFPB Bulletin because that Bulletin applied only to depository institutions with assets greater than $10 billion and their affiliates.

Third, the CFPB relies upon authority to "prescribe rules regarding the confidential treatment of information obtained from persons in connection with the exercise of [the CFPB's] authorities under Federal consumer financial law."¹² Finally, the CFPB also relies upon authority to prescribe rules the agency determines are "necessary or appropriate to enable the [CFPB] to administer and carry out the purposes and objectives of the Federal consumer financial laws, and to prevent evasions thereof."¹³

SNR Denton Observations

First, an overarching concern is that the substantive content of the CFPB proposed rule is grounded in the statutory language explicitly afforded to the prudential regulators, but not explicitly afforded to the CFPB. This fact cannot be overcome by transforming and expanding the January CFPB Bulletin into a rulemaking; a rulemaking proceeding cannot create a statutory protection that does not already exist. The CFPB is promulgating a regulation in reliance on indirect authorities before the statutory underpinning has been enacted into law. Under these circumstances, the courts would likely be called upon to settle the ambiguity regarding the CFPB's authority in subsequent disputes concerning whether a waiver of privilege has occurred. This is precisely the reason the Congress is in the process of changing the law to provide privileged information that is submitted to, and shared by, the CFPB with the same protections afforded such information that is submitted to, and shared by, the prudential regulators.

The CFPB states that the proposed rule "is intended to govern all claims, in Federal and State court, that an entity has waived any applicable privilege by providing information requested by the [CFPB] pursuant to its supervisory or regulatory authority."¹⁴ This intent, while helpful, is not a substitute for explicit statutory language. Without a change in the law, sharing attorney-client privileged information with the CFPB, which may also share the information with state and other federal authorities, risks loss of the privilege altogether and entails the additional risk that such information may be used by a third party adversely to the litigation interests of the CFPB-supervised entity or by the CFPB itself.

Second, while the preamble to the proposed rule makes clear that the CFPB will at times request information from CFPB-supervised entities that may be subject to statutory or common law privileges, the CFPB nowhere indicates that the agency will provide guidance to its examiners regarding the protection of privileged information as the prudential regulators have seen fit to do.¹⁵ The issuance of such guidance is important to preserving all applicable privileges.

Finally, the CFPB has not articulated in the CFPB Supervision and Examination Manual.¹⁶ whether or when the agency will seek information from nonprivileged sources before specifically requesting privileged information, leaving open-ended the breadth of possible requests and demands for privileged information. For example, the OCC's examination manual instructs examiners, when possible, to obtain "needed information from sources that are not privileged," to limit "the form and scope of a request for privileged information" and to exchange "written communications...setting forth the precise identity of the materials being provided pursuant to the agency's examination authority, and confirming that the confidentiality of the materials will be maintained to the extent required or permitted by law."¹⁷

Taken together, the distinct possibility of waiver of applicable privileges and the absence of guidance to CFPB examiners in the CFPB Supervision and Examination Manual explain the basis upon which the industry and policymakers have sought to resolve concerns about submitting privileged information to the CFPB. Notwithstanding the provisions of the proposed rule and until the law is changed to apply the same statutory privilege protection to information provided to the CFPB as that provided to the prudential regulators, in all likelihood, CFPB-supervised entities will be subject to substantial uncertainty and may have more difficulty defending the non-production of examination materials to third party litigants when they have provided those materials to the CFPB. In the absence of a change in the law, a CFPB-supervised entity could waive privileges, including the attorney-client privilege, vis-à-vis third party litigants who could then seek production of the materials provided to the CFPB.

For all of these reasons, as an interim measure until the statutory privilege protection afforded by a change in the law can be achieved, CFPB-supervised institutions should consider whether to file public comments on the CFPB proposed rule recommending additional measures for protecting privileged information. These measures could include:

• Requiring the CFPB to provide a written directive ordering disclosure of the privileged information to ensure such disclosure is considered mandatory
• Limiting the form and scope of a request or demand by the CFPB for privileged information by following the examination guidance and practices of the prudential regulators
• Seeking a commitment from the CFPB that the agency will not share privileged information with state attorneys general in the absence of a court order requiring such sharing
• Mandating that CFPB-supervised institutions promptly notify the CFPB of a third party request for disclosure of privileged information so that the CFPB may intervene to help prevent the disclosure

Until these and other comparable measures are in place, we recommend that CFPB-supervised institutions protect privileges that apply to information requested by the CFPB in the manner set forth in the SNR Denton Dodd-Frank Update, " CFPB Treatment of Privileged Information" dated January 17, 2012.

An additional point worth noting is that the CFPB has indicated that it plans to request data and research from various industry participants and CFPB-supervised entities. To the extent that these requests are considered outside the supervisory, examination and/or regulatory process of the CFPB, even if the law were changed to provide the statutory privilege protection described above, with respect to a CFPB-supervised entity, a court could find that any privilege that would otherwise apply to the materials it produced in response to these requests would be irrevocably waived. In that event, a third party litigant would likely have a successful claim against the entity for production of the data and research the entity provided to the CFPB for the reason that all applicable privileges were waived when the entity provided the materials to the CFPB.

In providing data and research to the CFPB in response to industry-wide requests, a CFPB-supervised entity should take particular care not to provide data and research that is subject to a claim of privilege. If the entity elects to provide confidential information in response to industry-wide requests, among other precautions, as applicable, we recommend designating the materials as:

• privileged and confidential commercial or financial information exempt from mandatory disclosure under exemption 4 and other exemptions of the Freedom of Information Act and implementing regulations
• confidential information within the scope of the criminal prohibitions of the Trade Secrets Act and/or
• confidential commercial information or business information submitted by the entity under Executive Order 12600 and implementing regulations as a "submitter" or "business submitter"¹⁸

If the CFPB disagrees with these designations, then the CFPB-supervised entity should consider requesting the return or destruction of the information. These designations, as applicable, would help ensure protection of the confidential nature of any materials provided in response to industry-wide requests for data and research.

Footnotes

1. 77 Fed. Reg. 15286 (March 15, 2012).

2. See the Dodd-Frank Act §§ 1022(c)(6)(C), 1025(e) and 1052(a).

3. 77 Fed. Reg. 15290.

4. See 12 U.S.C. 1785(j), 12 U.S.C. 1828(x) and 12 U.S.C. 1821(t). The prudential regulators are the Office of the Comptroller of the Currency, the Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation, and the National Credit Union Administration.

5. See SNR Denton Dodd-Frank Update, "CFPB Treatment of Privileged Information" dated January 17, 2012.

6.12 U.S.C. 5581.

7.12 U.S.C. 5514.

8. For example, the CFPB is presently engaged in a rulemaking that would define larger participants in the consumer debt collection and the consumer reporting markets. 77 Fed. Reg. 9592 (February 12, 2012).

9. See the Dodd-Frank Act, § 106(b), 12 U.S.C. 5515(b).

10. 77 Fed. Reg. 15287. The prudential regulators' statutory authority is found at 12 U.S.C. 1828(x) (Federal banking agencies, State bank supervisors and foreign banking authorities) and 12 U.S.C. 1785(j) (National Credit Union Administration, state credit union supervisors and foreign banking authorities).

11. See the Dodd-Frank Act § 1024(b)(7)(A), 12 U.S.C. 5514(b)(7)(A).

12. See the Dodd-Frank Act § 1022(c)(6)(A), 12 U.S.C. 5512(6)(A).

13. See the Dodd-Frank Act, § 1022(b)(1), 12 U.S.C. 5512(b)(1).

14. 77 Fed. Reg. 15287.

15. See Comptroller's Handbook: Litigation and Other Matters at page 7 under "Evaluating Other Legal Matters" (February 2000).

16. See Supervision and Examination Manual, CFPB, October 2011.

17. Comptroller's Handbook at 8.

18. Exec. Order 12,600, 3 C.F.R. 235 (1988).

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.