CFPB Rule Regarding Privileged Information

New regulation attempts to protect from disclosure privileged information provided by financial institutions to the Consumer Financial Protection Bureau, or shared by the Bureau with other agencies.

On June 28, the Consumer Financial Protection Bureau (CFPB or the Bureau) adopted a proposed rule intended to protect financial institutions' privileged information from disclosure when that information is offered to the CFPB for supervisory purposes. Under the rule, neither an institution's delivery of privileged information to the CFPB nor the CFPB's subsequent transfer of that information to another government agency or regulator waives any privilege the institution could otherwise claim.

The new rule adds a new regulation, 12 C.F.R. § 1070.48, which specifies that a supervised entity does not waive any applicable privilege with respect to third parties by providing privileged information to the CFPB. The rule also further clarifies 12 C.F.R. § 1070.47(c), stating that the sharing of any privileged information by the CFPB with any federal or state agency will not waive any applicable privileges. This provision covers both information submitted to the CFPB by supervised entities and privileged information created by the CFPB in its supervisory role.

Background

The CFPB's regulations provide the CFPB with authority to request information from supervised institutions that the CFPB determines will help serve the purpose of promoting fairness and transparency for consumer financial products and services. Supervised institutions are required to comply with these requests. In January 2012, the CFPB released Bulletin 12-01, which stated that the CFPB would continue to demand attorney-client privileged documents from its supervised institutions but that such disclosures would not waive attorney-client privilege with respect to third parties.

In furtherance of its position, in March the CFPB issued a notice of proposed rulemaking, requesting comments on its proposed rule to codify Bulletin 12-01 and provide that information covered by both attorney-client privilege and attorney work-product privilege would not be waived for third parties. The proposed rule expanded the scope of Bulletin 12-01 explicitly to include materials covered under the work-product doctrine, evidencing the CFPB's intention to request both attorney-client and work-product materials from supervised institutions.

The notice of proposed rulemaking received a number of strong reactions. Commentators, including the American Bar Association, expressed concerns with the proposed rule, including the belief of some that the CFPB does not have legal authority to compel supervised entities to produce materials protected by the attorney-client privilege or the work-product doctrine and that the proposal would serve to undermine the attorney-client privilege and work-product doctrine. The CFPB has sought to rebuff these challenges. It argues that effective supervision requires access to privileged materials and that it inherited its supervisory authority (and right to privileged materials) from the federal banking agencies. Thus, according to the Bureau, it would only be sensible for the same antiwaiver rule enjoyed by the federal banking agencies to apply to the CFPB.[1]

Many commentators were not satisfied with the CFPB's response, hoping instead for a legislative solution to protect privileged information. Financial institutions are protected by a federal statute, the Federal Deposit Insurance Act (FDIA), 12 U.S.C. §§ 1821(t), 1828(x), which provides there is no waiver of the attorney-client privilege when a federally chartered bank provides privileged materials to a "federal banking agency." However, because the CFPB is not a "federal banking agency," it is not thought to be covered by the FDIA.

In related legislation, on March 26, 2012, the House of Representatives passed H.R. 4014, which would amend Sections 1821(t) and 1828(x) to include the Bureau in the list of federal agencies that may share attorney-client privileged information with other federal agencies without the privilege being waived. Its companion Senate bill, S. 2099, has been referred to the Senate Banking Committee but has not been acted upon. The CFPB reaffirmed that it "continues to support appropriate legislation" that will protect against the waiver of privileged information.

Going Forward

In its commentary to the rule, the CFPB has expressed its willingness to work with supervised entities to both limit the frequency of its requests for privileged information and to share confidential and privileged information "only in very limited circumstances and upon review of all the relevant facts and considerations." The CFPB will request privileged information "only when it determines that such information is material to its supervisory objectives and that it cannot practicably obtain the same information from non-privileged sources." All privileged information shared with another state or federal agency would remain the property of the CFPB, and the other agencies may not further disclose such information without the CFPB's consent.

Importantly, the CFPB conceded that it will share the privileged material with state law enforcement agencies, including state attorneys general. The rule indicates that although state law enforcement officials would have access to privileged materials, those officials would be unable to use that information in enforcement proceedings because they are third parties under the new rule. Still, financial institutions and other entities falling in the CFPB's purview should be aware that privileged information could be seen by other regulators, though the CFPB rules prevent that information from being used in any enforcement proceeding.

These provisions will become effective 30 days after the date of publication in the Federal Register.

[1]. Regardless of the legislative outcome, the CFPB believes "[t]he validity and effectiveness of the rule depends on the scope of the Bureau's rulemaking authority, not on the Bureau's authority to compel privileged information." Although the CFPB maintains that it has authority to compel production of privileged information, it relies less on its prior assertion that the reason supervised institutions do not waive their privileges after submission to the Bureau is because such submissions are not voluntary. The commentary on the rule now states in a footnote, "[T]he Bureau intends the rule to also govern claims of waiver related to the voluntary submission of privileged information to the Bureau."