A consumer financial protection bureau The Wall Street Journal reported that a (CFPB) employee forwarded records containing personal information on approximately 256,000 consumers at one financial institution, as well as confidential supervisory information at 45 other institutions, to a personal email address.
The agency, which is already under fire from Republican lawmakers, described the breach in Congress as a major incident.
A spokeswoman for the CFPB told the Journal that, while most of the personal information was tied to consumers at an undisclosed entity, the emails included information on consumers from seven firms.
The Journal reported that the incident was first noticed by the agency in February and disclosed to lawmakers on March 21. The CFPB did not say why the employee — who has since been fired — sent the emails to a personal account.
The CFPB downplayed the severity of the data beach, saying the personal information included two spreadsheets with names and transaction-specific account numbers used internally by the financial institution. The spokesperson said the spreadsheets do not include consumers’ bank account numbers and cannot be used to access a consumer’s account.
As of Wednesday, the former CFPB employee had not complied with a request to remove the emails.
Republican lawmakers seized on the data breach, releasing the statement prompting director Rohit Chopra to release more details.
“Why should the CFPB be trusted to collect more data, burden financial institutions, and potentially limit services for consumers, when they themselves have demonstrated irresponsible handling of consumers’ financial information?” said Sen. Tim Scott of South Carolina, the top Republican on the Senate banking panel.
Most people in the mortgage industry will be happy to see that the regulator has taken it down a peg. The CFPB, which regulates independent mortgage banks and so-called “fintechs,” has been a thorn in the side of lenders and authorities since its formation following the Great Financial Crisis.
Under Chopra, the CFPB has intensified enforcement actions against the mortgage industry, which has increased compliance costs. mortgage bankers association In October Chairman and CEO Bob Brockschmidt described the agency as “judge, jury and executioner, all in one”.
They called on the agency to “establish clear and consistent standards while providing an opportunity for notice and comment when implementing the rules. Unfortunately, the bureau is not always following this common-sense system, formal process or consultation.” is declaring new legal obligations without due diligence, imposing new and unusable legal principles, and making it very difficult for firms to understand their legal obligations.
The agency is also fighting constitutional challenges on several fronts. The Supreme Court is expected to hear a case that would determine the agency’s funding structure, whereby it receives money through the Fed rather than through appropriations legislation passed through Congress.
In 2022, a panel of Trump-appointed judges on the Fifth Circuit US Court of Appeals determined that the agency’s funding source is unconstitutional. In a separate case, the Second Circuit US Court of Appeals, involving the Districts of Connecticut, New York and Vermont, decided in March that funding provisions for the CFPB are constitutional.
