On September 12, the Bureau of Consumer Financial Protection (Bureau) issued a final rule that amends the procedures used by the public to obtain information from the Bureau under the Freedom of Information Act (FOIA), the Privacy Act of 1974, and in legal proceedings.

A number of the rule’s amendments simply align policy with practice.  For example, the rule codifies the Bureau’s practice of using the same identity verification procedures for both Privacy Act requests and first-party FOIA requests.  The rule also requires the Bureau to acknowledge and provide requesters with tracking numbers for FOIA requests that have not been perfected – something the Bureau does already.

Other amendments were required by the FOIA Improvement Act of 2016 – the rule establishes a minimum of 90 days for requesters to file an administrative appeal, requires the Bureau to provide dispute resolution services at various times throughout the FOIA process, and it also details the miscellaneous circumstances where the Bureau may not assess fees.

There are also some rule amendments that were apparently proposed by the National Archives and Records Administration’s Office of Government Information Services (OGIS).  Adopting OGIS suggestions, the rule narrows the delegation authority of the Bureau’s Chief FOIA Officer, clarifies the form and content requirements for a FOIA request and a request for expedited processing, and allows requests for expedited processing to be made at any time.  Previously, requesters were only able to seek expedited process with their initial request.

Finally, the rule makes minor revisions to what are known as the Touhy Regulations, which set forth procedures to be followed with respect to subpoenas, court orders, or other requests or demands for any Bureau information, whether contained in the files of the Bureau or acquired by a Bureau employee as part of the performance of that employee’s duties or by virtue of employee’s official status.  The rule also describes the Bureau’s procedures for considering such requests or demands for official information.

Notably, the rule does not revise the provisions regarding the protection of confidential information or the procedures for sharing confidential information with other government agencies. These provisions have been of significant concern to industry since they were finalized in February 2013 because they allow the Bureau to make discretionary disclosures of confidential information to state AGs.  It is thus no wonder that the state AGs wrote a comment letter in support of this final rule.

This rule takes effect on October 12, 2018.