December 6, 2022

Volume XII, Number 340


December 05, 2022

Subscribe to Latest Legal News and Analysis

Will My Confidential CID Information Be Released by the CFPB? It’s Far from Certain

A recently published opinion of the US District Court for the District of Columbia creates some uncertainty as to the Consumer Financial Protection Bureau’s (CFPB’s) authority to protect information provided to it pursuant to a civil investigative demand (CID). In his opinion in Franks v. CFPB, Judge Christopher Cooper rejected most of the arguments made by a plaintiff’s class action firm seeking information gathered by the CFPB pursuant to a CID in an enforcement investigation. But, he granted summary judgment to the plaintiff and ordered the CFPB to review its decision to withhold certain information that had been provided “voluntarily” pursuant to the CID.

The Freedom of Information Act (FOIA) generally requires executive branch agencies such as the CFPB to provide copies of information in their records, but also establishes exemptions from that requirement, including an exemption for information gathered for “law enforcement purposes.” One of the underpinnings of the law enforcement exemption is that such information is not routinely gathered or maintained by the government, but sometimes must be collected so that government prosecutors may conduct investigations of potential violations of law.

To encourage voluntary cooperation with government investigators, the FOIA grants heightened confidentiality protection to information voluntarily provided to investigative agencies. In FOIA matters, the CFPB has taken the position that because its CIDs are not self-executing—namely, enforcing one requires the CFPB to take the additional step of filing a complaint in district court seeking enforcement of its CID and compelling the noncomplying recipient to produce information—the decision of a CID recipient to produce information is “voluntary.”

Judge Cooper found this argument unpersuasive and contrary to circuit precedent. He found that the CFPB had misinterpreted longstanding federal law to the effect that “voluntariness does not turn on the recipient’s perception of whether it must comply with the demand—it instead turns on the agency’s power to induce compliance.”[1] This is hardly surprising given that the CFPB’s position, taken to its logical endpoint, would counsel simply ignoring CIDs and further burdening both parties and the court with pointless litigation.

Nonetheless, this decision raises the specter that the FOIA standard for protecting information that has been provided pursuant to a CID may be less secure than the CFPB staff has led regulated entities to believe, and common sense would have dictated in any event. Because the CFPB’s rigorous Document Submission Standards (DSS) are specific and intricate, information is produced in a form that makes it convenient for use by others, including, as here, the plaintiff’s class action lawyers seeking information that might then be used to sustain a class action complaint.

Until we see how the CFPB elects to treat sensitive information produced pursuant to what the law and common sense both treat as compulsory process, no one who has provided information pursuant to a CID should presume that their information will remain safe from being turned over to others and used against them, and should certainly not rely on CFPB assurances to the contrary. Persons who produce information in response to a CFPB process of any kind also should assert all available exemptions from disclosure under the FOIA (such as the trade secrets exemption for proprietary business information, or the invasion of privacy exemption for nonpublic personal information of consumers) at the time of production.

[1] Indeed, the CFPB has made much in public statements surrounding settlements it has reached with targets of enforcement investigations of such targets’ “cooperation” and that this has been taken into account in reaching an accord. Targets of investigations do indeed feel pressured to comply absent judicial orders.

Copyright © 2022 by Morgan, Lewis & Bockius LLP. All Rights Reserved.National Law Review, Volume VII, Number 363

About this Author

Nicholas Gess, Government and regulatory attorney, Morgan Lewis
Of Counsel

Nicholas M. Gess counsels on state and federal government enforcement and regulatory actions and their impact on business. He advises corporate clients on how to achieve results with governmental agencies and how to manage the risks of government action, particularly in the current environment where state enforcement authorities conduct parallel investigations with federal authorities such as the CFPB, DOJ, and FTC.

Charles Horn, financial services attorney, Morgan Lewis

Charles M. Horn is a partner in Morgan Lewis's Investment Management and Securities Industry Practice. Mr. Horn focuses his practice on regulatory and transactional matters, primarily in the areas of banking and financial services. He works on behalf of domestic and global financial institutions of all sizes on regulatory, supervisory, enforcement and compliance matters before all major federal financial institutions regulatory agencies, and leading state financial regulatory agencies.