The Paperwork Reduction Act (PRA)  requires agencies to obtain OMB approval for identical collections of  information from 10 or more individuals or entities. The information  security program should include periodic assessments of the risk and magnitude of harm that could  result from the unauthorized access, use, disclosure, disruption,  modification, or destruction of information or information systems; policies and procedures that (1) are based on risk assessments, (2)  cost-effectively reduce information security risks to an acceptable  level, (3) ensure that information security is addressed throughout the  life-cycle of each system, and (4) ensure compliance with applicable  requirements; subordinate plans for providing adequate information security for  networks, facilities, and systems or groups of information systems, as  appropriate; security awareness training to inform personnel of information security  risks and of their responsibilities in implementing agency policies and  procedures, as well as training personnel with significant security  responsibilities for information security; periodic testing and evaluation of the effectiveness of information  security policies, procedures, and practices, to be performed with a  frequency depending on risk, but no less than annually—including  testing of management, operational, and technical controls for every  system identified in the agency’s required inventory of major  information systems; a process for planning, implementing, evaluating, and documenting  remedial action to address any deficiencies in the information security  policies, procedures, and practices of the agency; procedures for detecting, reporting, and responding to security plans and procedures to ensure continuity of operations for  information systems that support the operations and assets of the  agency. CFPB Collects a Wide Range of Consumer Financial Data

From January 2012 to July 2014, CFPB undertook 12 large-scale data  collection efforts. CFPB and Other Regulators Have Established Information- Sharing Agreements, but Some Overlap Exists

			CFPB’s Information-Sharing Agreements and Coordination

To minimize overlap and burden on financial institutions, CFPB has  coordinated with the prudential regulators and shared consumer financial  data through various formal agreements. In total, the collections cover approximately 87 percent of  outstanding credit card balances by volume. As shown in figure 1, CFPB and OCC collect similar credit card  information, but from different institutions. CFPB has taken steps to minimize burden on financial institutions. CFPB Lacks Written Procedures for Data Intake

CFPB reviews data collections to determine whether the Dodd-Frank  Act’s restrictions apply, but it has not yet created written procedures for its  data intake process. However, CFPB staff said  they have not developed written procedures for removing personal  identifiers from supervisory data or implemented controls such as  requiring reviews of anonymized files to ensure that all fields with  information that directly identifies individuals had been removed. Such data are  commercially available products and did not constitute information  collections under PRA, according to CFPB staff. CFPB Established Access Controls for Protecting Consumer Financial Data

CFPB had implemented several logical access controls for the  component of the information system that maintains the consumer  financial data collections we reviewed and was scanning for problems or  vulnerabilities. CFPB Generally Followed Steps of the NIST Risk Management Framework for the System That Maintains Consumer Financial Data

Although the collection of consumer financial data can create concerns  over improper use or unauthorized disclosure, CFPB has taken steps to  assess the risks posed by these data and implemented controls or taken  other actions to address the risks. For example, the agency  created a data intake process that brings together staff with relevant  expertise to consider the statutory, privacy, and information security  implications of proposals to collect consumer financial data. Staff also  described a process for anonymizing large-scale data collections that  directly identify individuals. OCC also had not sought OMB approval for  its credit card and mortgage data collections even though it now  obtains data from more than nine entities for each of these collections. Obtaining further guidance from OMB on whether the information- sharing agreement requires CFPB and OCC to follow procedures  outlined in PRA and getting OMB approval for OCC’s credit card and  mortgage data collections would help both agencies ensure they fully  comply with the law, do not unduly burden financial institutions, and  maximize the practical utility of the information collected. To help ensure consistent implementation of its current processes and  practices, the Director of CFPB should establish or enhance written  procedures for:  1.  the data intake process, including reviews of proposed data  collections for compliance applicable legal requirements and  restrictions and documentation requirements for consultations with  OMB about PRA applicability;  2.  anonymizing data, including how staff should assess data  sensitivity, which steps to take to anonymize data fields, and  responsibilities for reviews of anonymized data collections;  3.  assessing and managing privacy risks, including documentation  requirements to support statements about potential privacy risks in  PIAs and for determinations that PIAs are not required;  4.  monitoring and auditing privacy controls; and  5.  documenting information security risk-assessment results  consistently and comprehensively to include all NIST- recommended elements. To enhance the protection of collected consumer financial data, the  Director of CFPB should fully implement the following five privacy and  security steps:  1.  develop a comprehensive written privacy plan that brings together  existing privacy policies and guidance;  2.  obtain periodic reviews of the privacy program’s practices as part  of the independent audit of CFPB’s operations and budget;  3.  develop and implement role-based privacy training;  4.  update remedial plans for the information system that maintains  consumer financial data and related components to include all  identified weaknesses and realistic scheduled completion dates  that reflect current priorities and available resources; and  5.  include an evaluation of compliance with contract provisions  relating to information security in CFPB’s review of the service  provider that processes consumer financial data for CFPB. We are also making a recommendation to the Comptroller of the  Currency. To ensure compliance with federal law, the Comptroller of the  Currency should seek timely approval from OMB under PRA for OCC’s  credit card and mortgage collections, including the information-sharing  agreement with CFPB for credit card data. Appendix I: Objectives, Scope, and Methodology

The objectives of this report were to review (1) the Consumer Financial  Protection Bureau’s (CFPB) consumer financial data collection efforts,  including the authorities, scope, purposes, and uses of these collections,  and the ways in which CFPB has collaborated with other federal financial  regulators as part of these collections; (2) the extent to which CFPB  complied with statutory restrictions on its consumer financial data  collection authorities and federal privacy requirements; and (3) the extent  to which CFPB has assessed the risks of these collections and applied  appropriate information security protections over these data. We also  reviewed the Federal Reserve’s public notifications about its collections  for conducting bank holding company stress tests (Y-14 collections),  which included notices in the Federal Register about its credit card and  mortgage data collections, and OCC’s documents related its credit card  and mortgage data collections, including its contract with a data  aggregator. We also randomly selected and interviewed 1 additional  financial institution to interview that was supervised by CFPB but does not  provide credit card data on an ongoing basis. We compared CFPB’s policies and practices against  Dodd-Frank Act requirements, Office of Management and Budget (OMB)  guidance, and recommendations of the National Institute for Standards  and Technology (NIST). We reviewed prior audit work conducted by the Inspector  General for the Federal Reserve and CFPB in this area. More than 1,000 arbitration case records  from the American Arbitration Association  from January 2010 through 2012.
Why GAO Did This Study

Congress created CFPB in 2010 as an independent agency to regulate the provision of consumer financial products and services, such as mortgages and student loans. CFPB has begun collecting consumer financial data from banks, credit unions, payday lenders, and other institutions. GAO was mandated to examine CFPB's collection of consumer financial data. This report addresses (1) the scope, purposes, uses, and authorities of CFPB consumer financial data collections and (2) CFPB's compliance with laws and federal requirements, including government-wide privacy and information security requirements.
GAO reviewed laws, regulations, and contracts pertaining to CFPB's data collections; reviewed privacy and information security policies; reviewed inspector general reports on CFPB's information security program; assessed how CFPB applied NIST's framework for managing risks of storing data; examined access controls on the system maintaining consumer financial data; and interviewed CFPB and other regulatory officials, privacy experts, and representatives from randomly selected financial institutions.

What GAO Found

To carry out its statutory responsibilities, the Consumer Financial Protection Bureau (CFPB) has collected consumer financial data on credit card accounts, mortgage loans, and other products through one-time or ongoing collections. As the following table shows, these large-scale data collections varied from about 11,000 consumer arbitration case records from a trade association to 173 million mortgage loans from a data aggregator. Of the 12 large-scale collections GAO reviewed, 3 included information that identified individual consumers, but CFPB staff indicated that those 3 were not subject to statutory restrictions on collecting such information. Other regulators, such as the Board of Governors of the Federal Reserve System (Federal Reserve) and the Office of the Comptroller of the Currency (OCC), collect similarly large amounts of data.
CFPB has taken steps to protect and secure these data collections. For example, it created a data intake process that brings together staff with relevant expertise to consider the statutory, privacy, and information security implications of proposed consumer financial data collections. CFPB staff described a process for anonymizing large-scale data collections that directly identify individuals. In addition, CFPB had taken steps to implement an information security program that is consistent with Federal Information Security Management Act requirements, according to the Office of Inspector General for the Federal Reserve and CFPB. GAO found that CFPB had implemented logical access controls for the information system that maintains the consumer financial data collections and was appropriately scanning for problems or vulnerabilities. CFPB also established a risk-management process for the information system that maintains consumer financial data consistent with guidelines developed by the National Institute of Standards and Technology (NIST).
However, GAO determined that additional efforts are needed in several areas to reduce the risk of improper collection, use, or release of consumer financial data.
Written procedures and documentation: CFPB lacks written procedures and comprehensive documentation for a number of processes, including data intake and information security risk assessments. The lack of written procedures could result in inconsistent application of the established practices. For example, CFPB unnecessarily retained sensitive data in two collections GAO reviewed, but its staff said they plan to remove this information. GAO recommends CFPB establish or enhance written procedures for (1) data intake, including reviews of proposed data collections for compliance with applicable legal requirements and restrictions; (2) anonymizing data; (3) assessing and managing privacy risks; and (4) monitoring and auditing privacy controls; and (5) documenting results of information security risk-assessments consistently and comprehensively.
Implementation of privacy and security steps: CFPB has not yet fully implemented a number of privacy control steps and information security practices, which could hamper the agency's ability to identify and monitor privacy risks and protect consumer financial data. GAO recommends CFPB take or complete action to (1) develop a comprehensive written privacy plan that brings together existing privacy policies and guidance; (2) obtain periodic independent reviews of its privacy practices; (3) develop and implement targeted privacy training for staff responsible for working with sensitive personal information; (4) update remedial action plans to include all identified weaknesses and realistic planned remediation dates that reflect priorities and resources; and (5) include an evaluation of compliance with contract provisions relating to information security in CFPB's review of the service provider that processes consumer financial data on its behalf.
Paperwork Reduction Act compliance: Under the Paperwork Reduction Act (PRA), agencies generally must obtain Office of Management and Budget (OMB) approval when collecting data from 10 or more entities to minimize burden and maximize the practical utility of the information collected. CFPB and OCC collect, on an ongoing basis, credit card data from different institutions—representing about 87 percent of outstanding credit card balances—and agreed to share data. However, OMB staff said the agencies' collections and data-sharing agreement may warrant OMB review and approval. Additional consultation with OMB regarding these collections and the data-sharing agreement would help both agencies ensure they are fully complying with the law. Furthermore, OCC had not obtained OMB approval for its credit card and mortgage data collections, which each included more than nine entities. Without approval, OCC lacks reasonable assurance that its collections comply with PRA requirements intended to reduce burden. GAO recommends (1) CFPB consult further with OMB about its credit card collection and data-sharing agreement, and (2) OCC seek OMB approval for its credit card and mortgage data collections.
a CFPB has access to credit card data from additional credit card issuers through an information-sharing agreement with the Office of the Comptroller of the Currency, which collects more than 500 million total accounts on a monthly basis. When combined, these data contain information about 87 percent of outstanding credit card balances by volume as of March 2014.
b CFPB removed information that directly identifies individuals from the files staff use to analyze these data.

What GAO Recommends

GAO makes 11 recommendations to enhance CFPB's privacy and information security and 1 recommendation to OCC to ensure its data collections comply with appropriate disclosure requirements. CFPB and OCC agreed with GAO's recommendations and noted steps they plan to take or have taken to address them.