Since Mick Mulvaney’s appointment by President Trump as CFPB Acting Director, there have been widespread media reports about Mr. Mulvaney’s plans to impose a freeze on the CFPB’s collection of personally identifiable information (PII), such as individual loan level data, until the CFPB improves its data security systems.  Mr. Mulvaney’s concerns about the CFPB’s data security systems were reportedly prompted in part by reports issued by the Office of Inspector General for the CFPB that found deficiencies in the CFPB’s data security practices.

Since the CFPB has not yet issued any information regarding the freeze’s implementation, its full scope and impact remain unclear.  However, in connection with assisting clients to prepare for CFPB exams, we have learned that the freeze is having a significant impact on the flow of information to CFPB examiners.  Moreover, it appears that because CFPB examiners may not yet have clear direction regarding how they should implement the freeze, they are taking different approaches.

Prior to the freeze, companies had been submitting information requested by CFPB examiners by uploading documents to the CFPB’s Extranet.  We understand the CFPB has temporarily halted use of the Extranet, however, apparently in response to Mr. Mulvaney’s concerns, and it appears that CFPB Supervision management is grappling with how to sufficiently address Mr. Mulvaney’s concerns so that scheduled examinations can proceed.  For example, examination teams have preliminarily described different approaches for how to establish workarounds, including providing all responses printed onto paper, to be shredded at the conclusion of the exam, or providing company computers for examiners to view company responses which may include PII.  The freeze and such workarounds will likely increase the burden for companies undergoing examinations but may also reduce the scope of what examiners will be able to review.

It also remains unclear how the freeze will impact other supervisory submissions, such as supporting documents submitted in connection with responses to Potential Action and Request for Response (PARR) letters.  We are working closely with clients to assist them with issues raised by the new “freeze”-related procedures.