January 08, 2018

Senator Warren Presses Mulvaney, English for Details on CFPB Data Collection Freeze

Warren Concerned Mulvaney Used Cybersecurity as Pretext to Hobble Critical Agency Functions

Text of the letter available here (PDF)

Washington, DC - United States Senator Elizabeth Warren (D-Mass.) on Friday sent a letter to Mick Mulvaney, Director of the Office of Management and Budget, and Leandra English, Acting Director of the Consumer Financial Protection Bureau (CFPB), expressing concern about Mr. Mulvaney's decision to freeze the collection of consumer data by the CFPB.  

On December 4th, citing concerns by the Inspector General (IG) on the CFPB's information security controls, Mr. Mulvaney announced that he was freezing the collection of all personal information by the CFPB.  On the morning of this announcement, examiners at the CFPB were directed to stop requesting any information from regulated entities. According to reports, enforcement lawyers may have also been banned from reviewing any new electronic evidence obtained in discovery.  

In her letter, Senator Warren raised a number of concerns about the impact of the data collection freeze on the agency's core functions. "CFPB cannot fulfill its core functions without collecting personally identifiable information," wrote Senator Warren. "Given how integral these data are to these basic CFPB functions, I fear that the freeze in data collection has in practice fundamentally changed how the CFPB interacts with its regulated entities..."
Senator Warren also expressed concern about Mr. Mulvaney's justification for shutting down data collection and highlighted the discrepancy between the modest risks cited in recent reports by the agency's IG and the actions taken by Mr. Mulvaney in response.  The letter noted that in the one report issued by the IG, the CFPB outperformed nearly all other financial regulators on the quality of its cybersecurity practices and pointed out that the CFPB had already implemented most of the recommendations made in another recent cybersecurity report by the IG. The IG did not recommend freezing data collection in either of its reports.

"This fact pattern indicates actions taken by Director Mulvaney were not necessary to address cybersecurity problems at CFPB," Senator Warren wrote. "Instead, Director Mulvaney's actions appear to be aimed at hobbling the agency by inappropriately using the IG reports as a pretext."

To better understand Mr. Mulvaney's decision, Senator Warren asked for additional information on how the data collection freeze has impacted the CFPB's operations and requested that her staff be briefed on the topic.