April 25, 2023
Partner Lucy Morris comments for American Banker article on CFPB data breach
According to an article in American Banker, the Consumer Financial Protection Bureau has not yet notified 256,000 consumers, nearly two months after data was potentially compromised by a bank examiner with access to supervisory information and large-scale data collections. The article states the CFPB said it is still working with financial institutions to notify consumers about the Feb. 14 breach in which a now-former bank examiner sent supervisory information on 45 institutions, and personal identifiable information on 256,000 consumers at seven institutions to his personal email account.
Hudson Cook partner Lucy Morris, a former CFPB Deputy Enforcement Director, told American Banker, "Mistakes happen, and that's what institutions always tell the bureau, and so the table has been turned, Just like they expect companies to fully identify and remediate errors, they should do the same."
The bureau has strict rules around companies disclosing confidential supervisory information with financial institutions being required to get permission to disclose. Several experts said the bureau now has special insight into understanding what a company goes through when a typical breach occurs.
"The enormous amount of highly sensitive information that they ask for in exams and other sensitive information in other contexts, and the expectation that it will all be provided quickly and easily," Morris said. "And here they have their own problems."
She added that "companies always say they shouldn't be punished with UDAAP and law enforcement penalties, and now the bureau can see that for themself."
Subscribers to American Banker can read the full article here
About Lucy Morris
Lucy is a partner in the firm's Washington, DC office and a former Deputy Enforcement Director at the CFPB. Lucy counsels financial institutions and others in complying with federal consumer financial laws and prohibitions against unfair, deceptive, or abusive trade practices. She is an experienced advocate and litigator, representing clients in government investigations, examinations, and enforcement actions before federal and state agencies, including the CFPB, FTC, U.S. Department of Justice, and state AG offices.