2015-06722. Disclosure of Consumer Complaint Narrative Data

AGENCY:

Bureau of Consumer Financial Protection.

ACTION:

Final Policy Statement.

SUMMARY:

The Bureau of Consumer Financial Protection (the “Bureau”) is issuing a final policy statement (“Final Policy Statement”) to provide guidance on how the Bureau plans to exercise its discretion to disclose publicly unstructured consumer complaint narrative data (“narratives” or “consumer narratives”) via its web-based, public facing database (the “Consumer Complaint Database” or “Database”). Only those narratives for which opt-in consumer consent is obtained and a robust personal information scrubbing standard and methodology applied will be eligible for disclosure. The Final Policy Statement supplements and amends the Bureau's existing policy statements establishing and expanding the Consumer Complaint Database.^[1]

DATES:

Applicability date: The Bureau will not publish any consented-to narrative for at least 90 days after publication in the Federal Register.

FOR FURTHER INFORMATION CONTACT:

Scott Pluta, Assistant Director, Office of Consumer Response, Bureau of Consumer Financial Protection, at [phone].

SUPPLEMENTARY INFORMATION:

Authority: 12 U.S.C. 5492(a), 5493(b)(3), (d), 5496(c)(4), 5511(b), (c), 5512, 5534(a), (b).

I. Overview

A. Final Policy Statement

Under the Final Policy Statement, the Bureau extends its existing practice of disclosing data associated with consumer complaints via the Consumer Complaint Database to include narratives for which opt-in consumer consent is obtained and a robust personal information scrubbing standard and methodology has been applied. The purposes of the Consumer Complaint Database include providing consumers with timely and understandable information about consumer financial products and services, and improving the functioning, transparency, and efficiency of markets for such products and services. The Bureau believes that adding additional information to the Consumer Complaint Database, here narratives and structured company responses, is consistent with and promotes these purposes.

II. Background

A. Complaint System

In the Bureau's previous notices of its policy statements, establishing and expanding the Consumer Complaint Database, the Bureau generally described how the Office of Consumer Response (“Consumer Response”) handles consumer complaints (collectively the “Complaint System”).^[2] This Final Policy Statement does not affect how a consumer's complaint is substantively handled by the Bureau. Consumer Response screens all complaints submitted by consumers based on several criteria, including whether the complaint should be routed to another regulator and whether the complaint is complete. Screened complaints are forwarded via a secure web portal to the appropriate company. The company then has 15 calendar days to provide an initial response and up to 60 calendar days to provide a final response. Companies have the ability within these timeframes to respond administratively to the Bureau, e.g., responding that no commercial relationship exists between the complaining consumer and the company in question. Typically, the company reviews the complaint, communicates with the consumer as needed, and determines what action to take in response. After the company responds to the consumer and the Bureau via the secure company portal, the Bureau invites the consumer to review the response and provide feedback. Some complaints are individually reviewed by Consumer Response investigations staff. All complaints are subject to follow-up and further investigation by Consumer Response and other parts of the Bureau.^[3]

The Bureau makes publicly available some data it collects as part of its complaint handling function, while continually striving to protect the sensitive information contained within that data. One way the Bureau currently accomplishes this is by sharing some fields from de-identified individual-level complaint data with the public through the Consumer Complaint Database. The Database was launched on June 19, 2012. It was initially populated with credit card complaint data but has since been expanded to include complaint data about other products, e.g., mortgages, bank accounts and services, student loans, vehicle and other consumer loans, credit reporting, money transfers, debt collection, payday loans, and prepaid cards. Data from complaints are disclosed in the Database the earlier of: (1) An initial response to the consumer and the Bureau (confirming a commercial relationship with the consumer) or (2) 15 calendar days after the complaint was sent to the company. Data from a complaint is not published in the Database if, among other reasons, the company suspects the complaint was submitted in furtherance of a fraud or it indicates to the Bureau that it does not have a commercial relationship with the consumer.

B. Overview of Public Comments

In its Proposed Policy Statement Regarding Disclosure of Unstructured Narrative Data From Consumer Complaints and Company Responses (“Proposed Policy Statement”), the Bureau proposed expanding its Consumer Complaint Database to include narratives submitted by consumers as well as public-facing narrative responses from companies.^[4] The Bureau received 137 unique comments from, among others, consumer groups, trade associations, companies, and individuals. In some cases, several organizations jointly submitted a single comment letter. One financial reform organization, Americans for Financial Reform (“AFR”), submitted a single set of comments on behalf of 49 consumer, civil rights, privacy, and open government groups.^[5] The Bureau reviewed unique comments from 39 individuals, as well as substantially identical comment letters from approximately 30,000 individuals expressing support for the Proposed Policy Statement.

Commenters provided feedback on numerous aspects of the Proposed Policy Statement. Almost all comments concerned the expansion of the Database to include narratives. Companies and their trade associations generally opposed the inclusion of narratives in the Database. Many industry commenters asserted that the publication of “unverified” consumer narratives would unfairly damage the reputations of companies. Several trade associations also commented that inclusion of unstructured narratives is contrary to the Bureau's stated mission of being data-driven.

Per the AFR's comment letter, consumer, civil rights, privacy, and open government groups supported the inclusion of narratives, asserting that among other things narratives would: “(1) Empower consumers with timely, valuable information pre-purchase, in order to prevent problems and reward companies that respect their customers, and post-purchase, in order to report unreasonable, unfair or deceptive practices and alert others in advance of problems; (2) allow others to assist the Bureau in detecting destructive patterns before they do extensive damage; and (3) encourage more people to use the Database, as it becomes a more useful tool, creating a cycle of increased information about consumer experiences in the financial services marketplace.” These groups and individual commenters endorsed the goals underlying the publication of consumer narratives.

Several commenters focused on normalization, or the use of some metric to provide context for data, for example, by including information on the number of accounts a company has for each particular product or service. Some industry commenters noted the risk of potential consumer re-identification and the impact certain laws may have on a company's ability to respond publicly to a consumer's complaint. Both trade associations and consumer groups submitted written comments advising the Bureau to be mindful of the privacy risks associated with narrative publication. Nonetheless, four nationally recognized privacy groups—Electronic Privacy Information Center, Privacy Rights Clearinghouse, Privacy Times, and World Privacy Forum—signed AFR's comment letter in support of the Proposed Policy Statement. Additionally, Privacy Rights Clearinghouse submitted an individual comment generally supportive of disclosing narratives.

Many submissions included comments directed to the Bureau's method of processing consumer complaints, i.e., the Complaint System. To the extent that these comments also related to the scope of the Proposed Policy Statement, the Bureau addresses them below. Whether addressed below or not, the Bureau welcomes operational feedback and intends to continue to refine its Complaint System over time.^[6]

III. Summary of Comments Received, Bureau Responses, and Resulting Policy Statement Changes

This section provides a summary of the comments received by subject matter to the Proposed Policy Statement. It also summarizes the Bureau's assessment of the comments by subject matter and, where applicable, describes the resulting changes that the Bureau is making in the Final Policy Statement including a change to how companies may respond publicly to individual complaints. All such changes concern the Consumer Complaint Database. There are no policy changes regarding the Bureau's issuance of its own complaint data reports, e.g., the Consumer Response Annual Report.

A. The Policy Statement Process

The Bureau is committed to transparency and robust engagement with the public regarding its actions. Although not required by law to do so, the Bureau voluntarily solicited and received public comments on the Proposed Policy Statement. A few commenters requested a 60-day response period as opposed to the 30 days originally provided, a request the Bureau granted.^[7] The Bureau received substantial public feedback expressing a range of viewpoints, and it has carefully considered the comments received, as described in detail below. As stated in the Final Policy Statement, the Bureau plans to monitor the effectiveness of its policy on an ongoing basis and to continue to engage with the public, including regulated entities, as it assesses the efficacy of the Final Policy Statement.

Several commenters commended the Bureau on providing the opportunity to comment on the Proposed Policy Statement. A number of trade associations commented that the proposal could not be finalized in a general statement of policy and was instead a binding legislative rule subject to the procedural requirements of notice and comment rulemaking.^[8] Several of these groups argued that rulemaking was required because the policy would obligate companies to provide public responses or else suffer reputational harm from unanswered complaint narratives. Some groups stated that the policy would impose new duties on the Bureau to verify the details contained in the narratives or to protect consumer privacy by removing information that could lead to consumer re-identification. Two groups commented that § 1022(c)(6)(A) of the Dodd-Frank Act, which requires the Bureau to issue rules concerning the confidential treatment of information, dictates that any decision involving confidential information has to be enacted as a legislative rule.^[9] These groups also commented that the proposal would effectively amend the Bureau's existing privacy regulations by releasing confidential information and therefore had to be enacted through notice and comment. Two groups pointed to the example of the Consumer Product Safety Commission, which provided details about its statutorily mandated database of consumer product safety complaints via a legislative rule. The groups argued that the Bureau was required to follow the same process in announcing this policy. Finally, several of these groups suggested that the importance of releasing consumer narratives or the interest in transparency meant that full notice and comment procedures were required.

The Final Policy Statement is meant to inform the public about the Bureau's intended use of its discretionary authority to release certain de-identified information. The planned addition of narratives to the Consumer Complaint Database is properly the subject of a policy statement and does not require formal rulemaking.^[10] The Bureau has made minor changes to the Final Policy Statement to clarify its nature as a general statement of policy. The policy neither binds private parties with any legal responsibilities nor creates any legal rights. As the Final Policy Statement makes clear, companies are under no obligation to recommend public-facing responses and will face no legal consequences by declining to do so. That some companies may decide it is worthwhile to recommend a public response does not rise to the level of a legal obligation.^[11] For their part, consumers are under no obligation to opt in to sharing their stories, as the consent language will make clear by stating that the decision whether to provide consent for public disclosure does not otherwise affect how the Bureau handles the complaint.

The Bureau is also not binding itself with new legal duties. As explained below, the Bureau is not committing to verify the details contained in each complaint narrative. Although the Bureau plans to scrub identifying information from the consumer narratives, it intends to do so in order to assist consumers and ensure its compliance with existing laws, rather than through the assumption of such a duty through the present Final Policy Statement. The addition of narratives to the Consumer Complaint Database is also in keeping with the Bureau's stated intent to continue refining the way it receives, shares, and makes use of consumer complaint information as well as with its past practice of making improvements to the Database.^[12] As part of advancing that effort, and in response to comments it received in response to the Proposed Policy Statement, the Bureau is also publishing a Request for Information on how it might create or enhance opportunities for consumers to share accounts of positive experiences they have had with providers of consumer financial products and services.

The suggestion that § 1022(c)(6)(A) requires the Bureau to finalize this policy as a legislative rule is unpersuasive. That provision mandates that the Bureau “prescribe rules regarding the confidential treatment of information” it obtains in exercising its authorities. The Bureau has previously prescribed rules regarding the confidential treatment of information.^[13] The disclosure contemplated by this policy is consistent with those rules, and therefore does not require an amendment to those rules. Finally, as noted previously, several commenters contend that the past practice of the Consumer Product Safety Commission, the general interest in transparency, or the importance of releasing consumer narratives require the Bureau to proceed via legislative rulemaking. None of these factors provides a legal basis for concluding that notice and comment rulemaking is required under the Administrative Procedure Act. The Bureau also notes that it has made the policy process transparent by voluntarily soliciting public comment and extending the comment period from 30 to 60 days.

B. Legal Authority for Consumer Complaint Database

In the Bureau's previous notices of its policy statements establishing and expanding the Consumer Complaint Database, the Bureau addressed in detail several comments related to the Bureau's authority to establish a Database.^[14] Several comments in response to the Proposed Policy Statement implicate the same or similar arguments concerning the Bureau's legal authority. The Bureau directs readers to and incorporates its prior discussions, and clarifies portions here.

As was true with respect to the Bureau's prior two policy statements, commenters contend that the Dodd-Frank Act expressly delineates the circumstances and manner in which the Bureau may collect, resolve, and share consumer complaints with others, and that a public-facing database is not explicitly included. Therefore, by adverse inference, they assert that the Dodd-Frank Act does not authorize the Database.

Similarly, as was true with respect to the Bureau's prior policy statements, commenters argue that § 1034 of the Dodd-Frank Act, which requires the Bureau to establish “reasonable procedures to provide a timely response to consumers . . . to complaints against, or inquiries concerning, a covered person,” ^[15] does not authorize the creation of a public-facing complaint database that, instead of aiding complainants, enables data mining and market research. Commenters also make arguments, similar to past comments, that § 1021 and § 1022 do not expressly grant authority for the Bureau to establish a public-facing database or disclose consumer complaint narratives to the public.^[16] They also contend that the Dodd-Frank Act's restrictions on publishing confidential information block the implementation of such a database, including narratives.

The Bureau has considered these comments and concluded that the Database is authorized by the Dodd-Frank Act. Among other things, § 1013(b)(3) authorizes the establishment of a unit “whose functions shall include establishing a single, toll-free telephone number, a Web site, and a database or utilizing an existing database to facilitate the centralized collection of, monitoring of, and response to consumer complaints regarding consumer financial products or services.” ^[17] Section 1034(a) directs the Bureau to establish “reasonable procedures to provide a timely response to consumers, in writing where appropriate, to complaints against, or inquiries concerning, a covered person . . .,” and § 1034(b) provides that “[a] covered person subject to supervision and primary enforcement by the Bureau pursuant to section 1025 shall provide a timely response, in writing where appropriate, to the Bureau, the prudential regulators, and any other agency having jurisdiction over such covered person concerning a consumer complaint or inquiry. . . .”^[18] These provisions require and establish conditions for specific methods of disclosure and responses, but do not express or imply any limit on the Bureau's authority to disclose consumer complaint information in other ways. The Database as described would facilitate and supplement, not contravene, these provisions. The Database is reasonably encompassed within the Bureau's authorities, especially in light of the Bureau's other statutory objectives and functions, including promoting financial education, providing timely information, and ensuring that markets operate transparently.^[19] In addition, with prescribed limitations, the Bureau has broad discretionary authority to release information obtained during the exercise of its statutory functions and the Database, as described in the Proposed Policy Statement, would not contravene any legal constraints on the Bureau.

Publication of such information would also be authorized by the Bureau's express authority pursuant to § 1022 to make certain information, including information from consumer complaints, public: Section 1022(c)(3)(B) states that the Bureau “may make public such information obtained by the Bureau under this section as is in the public interest, through aggregated reports or other appropriate formats designed to protect confidential information in accordance with paragraphs (4), (6), (8), and (9).” ^[20] This subparagraph permits the Bureau to disclose consumer complaint information in a non-aggregated format as long as the format is designed to protect confidential information in accordance with other specific provisions of § 1022(c). The Database would satisfy those criteria.

The disclosure of information contemplated by this policy is also consistent with subpart D of the Bureau's Final Rule on the Disclosure of Records and Information,^[21] which the Bureau promulgated pursuant to § 1022(c)(6). Commenters are correct to point out that subpart D generally restricts the authority of the Bureau to publicly disclose “confidential information,” including “confidential consumer complaint information.” ^[22] However, such disclosure restrictions only apply to the extent that consumer complaint information is confidential in nature. The Bureau's regulations define “confidential consumer complaint information” to mean “information received or generated by the [Bureau], pursuant to [sections 1013 and 1034 of the Dodd-Frank Act], that comprises or documents consumer complaints or inquiries concerning financial institutions or consumer financial products and services and responses thereto, to the extent that such information is exempt from disclosure pursuant to 5 U.S.C. 552(b) [FOIA].” ^[23] Because the information to be disclosed in the public database is disclosed with the consumer's express consent and not exempt from disclosure under FOIA, such information does not constitute “confidential consumer complaint information.” Accordingly, § 1022(c)(6)(A)'s grant of authority to issue rules regarding when the Bureau will treat information confidentially does not limit the Bureau's discretion to disclose information consistent with those rules, but provides further authority for the policy.

Furthermore, the Bureau intends to obtain consent from consumers to publish their complaint narratives. Obtaining written consent for disclosure aligns with requirements of 1022(c)(8), FOIA, the Privacy Act, and the Bureau's confidentiality rules. The Bureau does not intend to release a narrative until the consumer expressly consents to publication and the Bureau has determined that the narrative has been de-identified according to a robust scrubbing standard.

C. The Impact of the Disclosure of Consumer Complaint Narratives on Consumers

Comments from consumer groups, open government groups, privacy groups, and individual commenters asserted that the publication of narratives would empower consumers to better understand the context of the data currently provided in the Consumer Complaint Database. The Reporters Committee for Freedom of the Press, on behalf of nine major news organizations and press trade associations, supported the publication of all narratives regardless of consent, stating that the Database is an invaluable resource for journalists as the experiences reflected in the narratives contribute to the public's understanding of the relationships between consumers and financial institutions and inform the ongoing democratic debate regarding financial regulation. Consumer groups added that consumer narratives would be a valuable resource for researchers to identify trends in the business practices of companies, particularly as they relate to traditionally underserved consumers.

Some commenters noted that narratives would encourage companies to address the sources of common complaints. Consumer groups stated that the publication of narratives would allow companies to better compete through customer service, further increasing the improvement in customer care resulting from the introduction of the Database. Other consumer groups commented that narratives would aid consumer advocacy and legal aid groups in serving their communities by helping to identify local trends.

Industry commenters, by contrast, asserted that the publication of narratives in the Database would mislead consumers because the data is, in the commenters' words, unverified and unrepresentative. And despite the fact that the Bureau confirms the existence of a commercial relationship before publishing complaints, multiple commenters expressed concern that complaints, and thus narratives, from individuals without a commercial relationship with the relevant company would appear in the Database.

In general, the Bureau believes that greater transparency of information does tend to improve customer service and identify patterns in the treatment of consumers, leading to stronger compliance mechanisms and customer service. These have been features of the Consumer Complaint Database since its inception. In addition, disclosure of consumer narratives will provide companies with greater insight into issues and challenges occurring across their markets, which can supplement their own company-specific perspectives and lend more insight into appropriate practices. Other issues raised in the comments received by the Bureau are addressed below.

1. Consumer Narratives

a. Verification

In its 2012 Notice of Final Policy Statement, the Bureau addressed several comments related to the disclosure of unverified consumer complaints. In response to the Proposed Policy Statement, several trade associations and companies continued to express concern, stating that unverified complaint narratives are likely to mislead consumers. Some trade associations suggested that the Bureau should only disclose narratives after a substantive investigation by the Bureau had been completed on that particular complaint. Some industry comments recommended distinguishing between unverified and verified complaints. Consumer groups and privacy groups, on the other hand, commented that the lack of verification presented minimal risk of misleading consumers.

The Bureau incorporates its previous statements and analysis on this issue.^[24] The Bureau acknowledges that the Complaint System does not adjudicate the merits of each individual complaint disclosed in the Consumer Complaint Database, specifically stating on the Bureau's Web site that it does not “verify the accuracy of all facts alleged in complaints.” However, the Bureau does screen each complaint according to various criteria. The complaint is reviewed to determine whether it should be routed to another regulator. A determination is made whether each submission is a complaint, an inquiry, or feedback. Submissions in the latter two categories are not forwarded to the identified company for handling as complaints. Importantly, the commercial relationship between the company and the consumer is verified before disclosing it in the Database. The Bureau also verifies that the complaint is submitted by the identified consumer or by his or her specifically authorized representative before disclosure in the Database. Lastly, complaints are only forwarded to companies when they contain the required fields, including the complaint narrative, the consumer's requested resolution, and the consumer's contact information. The Bureau believes that with the information currently made public, supplemented by the contextual richness of the de-identified narratives, the public and the marketplace will have the capacity to assess all the data with the appropriate level of confidence.

b. Manipulation

Several trade associations and companies commented that third parties like debt negotiation companies could use complaint submission as a strategic tool to unfairly aid their clients. A company commenter claimed that at least one outside party has been using the company's name unlawfully to defraud consumers, and that several complaints have been mistakenly lodged against the company as a result. Specifically, a third party was contacting consumers under the name of the other company to collect money and defraud consumers, and subsequently, several consumers lodged complaints against the other company.

The Complaint System has a number of protections against manipulation. These protections were addressed in the 2012 Notice of Final Policy Statement.^[25] For example, while the process of submitting a complaint is designed to be user-friendly and straightforward, it does require deliberate action and a moderate time commitment by the consumer. According to the Bureau's own calculations, the average amount of time required to complete a complaint submission via the Web site is eight minutes. Consumers must also affirm to the government that the information they provide is true to the best of their knowledge and belief. Again, the commercial relationship between the consumer and company is confirmed by the company before any complaint data is disclosed in the Consumer Complaint Database. With regard to the example provided regarding fraudulent use of a company's identity: (1) Companies have the ability to alert the Bureau via an administrative response of any suspected fraud; (2) if properly identified by the company, such complaints do not appear in the Database; (3) if the Bureau finds any pattern of fraud by any entity within its jurisdiction, the Bureau can bring appropriate enforcement actions; and (4) in sending such complaints to the company, the Bureau is assisting company operations in quickly identifying and addressing instances of potential fraud.

c. Misidentification

Several trade associations and companies commented that consumers' confusion about consumer financial products and services would lead to mistaken identification of the company against which the complaint is lodged. For example, one company commented that a consumer is likely to lodge a complaint against a credit reporting agency, when the consumer's complaint should be against the data furnisher. Trade associations and other commenters suggested the inclusion of company relationships. For example, one consumer group recommended including the parent company when that company has multiple subsidiaries against which complaints are lodged.

As previously noted, companies have the ability to notify the Bureau if no commercial relationship exists between the consumer and the company; such complaints are not suitable for disclosure in the Consumer Complaint Database. Regarding the credit reporting example that was provided, the Bureau empowers the consumer to elect whom to submit a complaint against (dependent, as noted, on an existing commercial relationship). Specific to the suggestion regarding inter- and intra-company relationships, the Bureau is exploring expansion of the Database to include additional company relationship information.

d. Positive Feedback

Several trade associations and companies commented that the Consumer Complaint Database should include positive narratives about companies in conjunction with complaint narratives. One commenter suggested that if the Database is to function as a marketplace of ideas, then it should reflect the entire market and not solely consumers submitting complaints. Several trade associations stated that if the Database is to be likened to private web-based review sites, then positive feedback is necessary.

Consistent with these comments, the Bureau believes that the Bureau should share data that provides an unbiased perspective on company behavior toward consumers. At present, the Bureau already collects and shares some elements of positive feedback regarding company complaint handling. For example, the Consumer Complaint Database currently discloses information that can be used to highlight positive company behavior, e.g., companies with timely responses or low consumer dispute rates. However, the Bureau intends to further explore ways in which positive company behavior may be highlighted. Concurrent with the Final Policy Statement, the Bureau is publishing a Request for Information to solicit and collect input from the public on the potential collection, identification, and sharing of data and feedback specific to positive interactions with providers of consumer financial products and services.

e. Language Access

Several consumer groups commended the accessibility of the Bureau's contact center, with translation available in over 180 languages. These groups requested that the Bureau make the online complaint submission form available in multiple languages.

In addition to telephone support for non-English speaking consumers, the Bureau plans over time to make its online complaint intake form on consumerfinance.gov available in Spanish, and subsequently to explore making the form available in other languages as well. The Bureau is committed to providing persons with limited English proficiency meaningful access to its programs and services.

f. Third Party Submissions and Referrals

Several trade associations and companies raised concerns that narratives from third parties without authority to make a complaint on behalf of a consumer nevertheless would be published, and companies would be compelled to respond publicly. The Conference of State Bank Supervisors requested clarification on whether narratives within complaints referred from other government agencies would be disclosed.

This Final Policy Statement does not apply to complaints submitted by any third parties or via agency referral, and the Bureau does not intend to disclose such narratives at this time. The Complaint System affords companies the opportunity to alert the Bureau if they are unable to verify the commercial relationship with the consumer who submitted the complaint before the complaint is disclosed in the Consumer Complaint Database.

2. Company Responses

In its Proposed Policy Statement, the Bureau stated that:

Where the consumer provides consent to publish their narrative, the related company will be given the opportunity to submit a narrative response for inclusion in the Consumer Complaint Database. The company will be instructed not to provide direct identifying information in its public-facing response, and the Bureau will take reasonable steps to remove personal information from the response to minimize (but not eliminate) the risk of re-identification. The Company Portal will include a data field into which companies have the option to provide narrative text that would appear next to a consumer's narrative in the Consumer Complaint Database.^[26]

The Bureau received comments from companies and trade associations arguing that, because of business and legal considerations, they would be limited in their ability to provide meaningful public-facing unstructured narrative responses and that such responses would be impracticable or unhelpful. In response, the Bureau intends to adopt an alternative approach based on structured company responses, as discussed below.

a. Quality of Company Responses

Trade associations and companies both questioned the fairness of publicly disclosing consumer narratives because they argued that, under the Bureau's proposal, companies would be limited in their ability to provide public-facing unstructured narrative responses. Several companies, trade associations and individual commenters expressed concern that their ability to provide meaningful public-facing unstructured narrative responses would be limited by laws such as the Gramm-Leach-Bliley Act and Regulation P, the Fair Credit Reporting Act and Regulation V, and the Fair Debt Collection Practices Act. Commenters argued that, under the Bureau's proposal to permit voluntary narrative company responses, they might not be able to provide any public-facing response at all due to legal, business, and reputational considerations. These commenters argued that frank responses may be viewed negatively by the public and companies would be discouraged from attempting to articulate individualized responses. They argued that, in practice, voluntary public-facing company responses would not provide the balance suggested in the Proposed Policy Statement. Some commenters suggested various ways the Bureau could mitigate these concerns, including providing specific interpretive guidance. Consumer groups stated that making consumer narratives and company responses public would allow for consumers to make individual determinations regarding the quality of the company's service.

Responsive to company and trade association feedback, the Bureau acknowledges that unstructured company narratives may not effectively provide companies with a mechanism to balance a consumer's narrative. Therefore, the Bureau intends to provide companies with a finite list of optional structured responses from which they can choose. Within the secure web portal companies use to respond to complaints, the Bureau intends to add a set list of company responses, giving companies the ability to recommend a public-facing response addressing the substance of the consumer's complaint. Companies will be under no obligation to avail themselves of this opportunity. The Bureau plans to adopt company recommendations as a general matter, but it reserves discretion to assess whether there are good-faith bases for the recommendations. In addition, the Bureau plans to assess its review process over time. The Bureau plans for this functionality to apply to all consumer complaints disclosed via the Consumer Complaint Database (and not only those with consumer consent to disclose the associated narrative).

Although this approach was not specifically proposed by commenters, the Bureau believes that it should eliminate or significantly mitigate the concerns, raised by companies, arising from the risk of public disclosure of protected confidential information. Companies that voluntarily decide to provide a public-facing response will not be put in a position of assessing what level of detail will address a complaint while protecting confidential information. The Bureau believes companies will be more likely to recommend public-facing structured responses than they would be to provide unstructured public-facing responses, and that the reputational risks of recommending structured responses will be lower. The Bureau also believes that this approach will lead to more standardized information that may facilitate the Bureau's other functions and goals with respect to the Consumer Complaint System, such as monitoring and reporting on complaints.

Companies are ultimately responsible for ensuring their compliance with all legal requirements. The Bureau believes that its approach of making public-facing structured responses voluntary allows companies sufficient flexibility to assess legal, business, reputational, and other considerations relevant to the decision of whether to provide public-facing responses. Finally, while providing an opportunity for public-facing structured company responses offers significant benefits, the Bureau notes that the benefits of publicly disclosing unstructured consumer complaint narrative data, as explained in this Final Policy Statement, justify such disclosures, even absent an opportunity for public-facing company responses.

b. Public and Private Company Responses

The Bureau solicited feedback on whether any potentially public-facing company response should be distinct and in addition to the response companies currently send directly to the consumer. Several companies and trade associations commented that it should be distinct as the public response will have to be adapted to conform to applicable privacy laws. Several consumer groups and one company, on the other hand, commented that the same response, but in redacted form, should be publicly displayed in order to provide the public with the necessary context to interpret the data. Some trade associations commented that it would be operationally burdensome to create two separate responses.

The Bureau plans to ensure that companies have the option to provide both a private (to-consumer) response and recommended public-facing structured (to be shared via the Database) response to a consumer's complaint. One of the principal benefits for consumers of the Bureau's complaint handling services is the requirement that companies respond to the consumer and the Bureau remains committed to keeping the focus on assisting consumers with their complaints. Based on data available in the Consumer Complaint Database, approximately 62% of complaints are “closed with explanation” and the majority of those (75%) are not disputed by the consumer. The Bureau is concerned that mandating that the to-consumer company responses be made public could have a chilling effect on well-received, detailed responses to consumers, potentially leading to higher consumer dispute rates. Based on comments received by companies on this issue, this concern would appear to be well founded. Allowing the company the choice to provide one very detailed private communication to its consumer, as well as a separate public-facing response, would address the Bureau's, companies' and consumers' interests on this issue.

c. Response Time

Currently, companies have 15 days to provide an initial response to a consumer complaint. Several trade associations and companies commented that the response time should be extended in order to accommodate the drafting of a separate, public-facing response. Some comments recommended extending the initial response time to as many as 60 days.

The Bureau believes that the marginal increase in burden associated with voluntarily recommending a separate structured public response does not necessitate a deviation from the current complaint handling requirements, which themselves are designed to provide the complaining consumer with a timely response.

d. Timing of Narrative and Response Posting

Trade associations, consumer groups, and individual commenters supported the simultaneous posting of the consumer narrative and company response. One consumer group recommended posting the consumer narrative after 15 days, and posting the company's public response as it becomes available. Several commenters recommended 45 days; one company recommended 60 days. One commenter recommended publication after 35 days, to align generally with timing provided under the Fair Credit Reporting Act for consumer reporting agencies to reinvestigate and respond to consumer disputes.

There are at least three timing options regarding the disclosure of the consumer narrative and company response: (1) Disclose the consumer narrative and company response (if available) when the company provides an initial response, but no later than 15 days after the complaint is routed to the company (the system currently in place for non-narrative complaint data), (2) disclose the consumer narrative and company response (if available) 15 days after the complaint is routed to the company, or (3) disclose the consumer narrative when the company provides its public-facing response, but no later than 60 days after the complaint is routed to the company. Under all three options, the complaint's structured closure responses would continue to follow the current disclosure timing (option number 1) and the consumer narrative would only be disclosed once it is scrubbed of personal information. However, only option three guarantees that a public-facing company response, to the extent one is provided within the 60-day period, would be disclosed contemporaneously with the consumer narrative.

After careful consideration, therefore, the Bureau intends to adopt option number three. Option number one could force the company to choose between its desire to respond to and close complaints quickly versus its desire to provide an appropriate public facing response. Option number two may result in instances in which the company legitimately needs additional time, has appropriately communicated to the Bureau an “in progress” response (allowing for up to 60 days to respond), and yet the consumer narrative is made public on day 15 and possibly without an accompanying company response. Option three carries a similar risk to option number one, potentially creating the incentive for companies to delay providing an optional public-facing response for the full 60-day allowance (and thus delaying disclosure of the consumer narrative). However, erring on the side of fairness to companies by ensuring contemporaneous release, the Bureau plans to implement option three.

3. Maintaining the Complaint Database

a. Updates to Published Narratives

Several consumer groups commented that consumers should be allowed to update narratives to inform the public of the status of the complaint. Some trade associations asked that consumers be provided the ability to remove their narratives if they are satisfied with the complaint resolution.

Once given, at any point in the process, consumers will have the ability to withdraw their consent regarding publication of their narrative in the Consumer Complaint Database. At such time the consumer's narrative will be removed from the Database. However, data already downloaded by the public cannot be recalled by the Bureau. Based on the Bureau's experience to date reviewing consumer complaints, company responses, and ensuing resolutions, the Bureau believes that no additional back-and-forth functionality is necessary at this time.

b. Removal of Old Narratives

Several trade associations and one company commented that complaints and narratives should be removed from the database after a given step in the process or given amount of time, e.g., quarterly.

The Bureau believes that consumers and the marketplace are capable of independently assessing the value of complaints based in part on when those complaints were submitted and therefore has no plans to remove complaints from the Consumer Complaint Database based on their age or status.

c. Normalization

Several trade associations and companies commented that the unstructured narrative data should be accompanied by information providing context to the company's profile, including how many transactions the company conducts per year, how many complaints are received, and how many complaints are satisfactorily resolved.

The Bureau notes the general agreement by commenters that normalization would improve the quality of the data in the Consumer Complaint Database. As discussed in the Bureau's notices of its previous policy statements, data normalization is a complicated issue, and one that the Bureau is continuing to explore.^[27] The Bureau also notes that market participants, news organizations, and consumer groups can and have created normalized results.

d. Protected Group Information

Several consumer groups requested the inclusion of protected group information, such as sex, ethnicity, race, age, disability, marital status, or national origin, on complaint submissions. These comments noted that it would be helpful to have this information to identify trends in companies' business practices.

The Bureau agrees that the collection and public disclosure of protected group data has the potential to increase the quality of the dataset made available via the Consumer Complaint Database. However, there remain many open questions that the Bureau must first explore before moving forward on this suggestion, including the appropriateness of collecting protected group data, its representativeness, and the potential challenges with disclosing protected group data given the Bureau's sensitivity to re-identification risk.

Furthermore, as discussed elsewhere, the Bureau's Database scrubbing standard would remove demographic information such as gender, age, and race, and ethnicity provided by consumers in the text of their narratives.

D. Consumer Consent to Disclose Narratives

1. Opt-in Consumer Consent

Trade associations, consumer groups, and individual commenters supported the proposed opt-in feature requiring a consumer's consent in order for narratives to be eligible for publication. A trade association representing news organizations asserted its view that narratives are subject to disclosure under FOIA regardless of consumer consent. Based on this viewpoint, it urged that at most the Bureau should permit consumers to opt-out of publication as opposed to having to opt-in. Commenters also generally agreed that consumers should maintain the right to revoke their consent at any time.

A central tenet of the Bureau's work is to empower consumers; providing them with the option to opt-in (as opposed to requiring them to opt-out) and the right to withdraw their consent to publication of their narrative in the Consumer Complaint Database at any time advances that end.^[28] With respect to the comment about the application of the FOIA to narratives, the Chief FOIA Officer is authorized to grant or deny any request for a record of the CFPB, in accordance with the requirements of the FOIA and the Bureau's regulations. 12 CFR 1070.15. If the Bureau receives FOIA requests for records that are not published in the Consumer Complaint Database pursuant to this Final Policy Statement, the Chief FOIA Officer will determine whether to grant the request, or to deny it due to the applicability of FOIA exemptions.

2. Placement and Design of Consent

Some commenters discussed the appearance of the opt-in form. Consumer groups requested that the opt-in be presented to the consumer early in the complaint process so that consumers can consider the implications as they draft their complaints. One company recommended providing the option to opt-in only once the consumer has received a response and has had the opportunity to consider the implications of publication. Some consumer groups recommended that, to encourage publication, the opt-in option be displayed prominently on the consent form. Additionally, some commenters requested that consumers have a distinct field on the form in which they can specify what personal information they want excluded from their narrative.

The Bureau plans to place the opt-in consent at the submission phase of the complaint. The Bureau believes the decision whether or not to consent is most appropriate at the actual time of complaint submission. This decision is consistent with the practice of the Consumer Product Safety Commission, which also obtains consent to disclose complaint narratives in its public-facing database.

3. Elements of Informed Consent

Some commenters recommended including disclaimers with the opt-in feature that notify consumers of what the commenters perceived to be a risk of defamatory speech. Some trade associations and companies commented that the Bureau should inform consumers of the risks of narrative publication, including the possibility of re-identification. Trade associations and companies generally commented that the consumer should be notified of the company response procedure and risks of consenting to publication. One press group commented that the consumer should be notified that his or her narrative is subject (in the commenter's view) to FOIA disclosure. One consumer group commented that consumers should be notified that consenting to publication may provide additional assistance to other consumers facing similar issues. The Bureau agrees that when a consumer is making the decision whether or not to opt-in, it is essential that the consumer have the information to weigh appropriately the risks of consenting to the disclosure of their de-identified narrative against individual and public benefits of doing so. In support of that goal, in addition to the consent language, the Bureau intends to provide clear, easily understandable material describing the scrubbing standard, methodology, and publication process, the remaining risk to privacy, and the possibility of re-identification. The Bureau is committed to continuously improving these materials over time to empower the consumer to make the most appropriate choice for his or her individual needs and circumstances.

However, consumers do not waive any privacy interests they may have in the information merely by submitting it to the Bureau.^[29]

E. Personal Information Scrubbing Standard and Methodology

1. Scrubbing Standard and Methodology

The Bureau requested feedback on the standard and methodology it intends to utilize for scrubbing personal information in the narratives. This scrubbing standard would be applied comprehensively to all data shared via the Consumer Complaint Database. Consumer groups offered comments supporting the proposed use of modified Health Insurance Portability and Accountability Act (“HIPAA”) standards for scrubbing narratives. Some companies expressed concern that significant identifiers associated with major life events may remain, notwithstanding the scrubbing process. One company commented that scrubbing should be applied to all identifying information, including references to third parties. Another company noted the differences between health data and unstructured narratives, expressing concern that a HIPAA-based methodology would not be effective and that the Bureau has not provided sufficient detail on the scrubbing mechanism to be used. One privacy organization recommended that the Bureau scrub company responses.

The Bureau's Database scrubbing standard is modeled after the HIPAA Safe Harbor Method, which is generally considered to represent a best practice for de-identifying data. In addition to adopting most of the specific HIPAA identifiers, the Bureau also plans to remove: (1) Demographic information such as gender, age, race, and ethnicity; (2) appropriate analogues to HIPAA identifiers in the consumer financial domain, e.g., credit card numbers; and (3) identifiers which the Bureau knows appear in complaints and could reasonably be used to identify individuals, e.g., references to third parties other than the company that is the subject of the complaint. The scrubbing methodology contemplates a computer-based automated step and a quality assurance step or steps performed by human reviewers.

2. ZIP Codes

The Bureau requested feedback on whether to disclose 5-digit ZIP codes alongside redacted narratives.^[30] By and large the responses that were received supported two options. The majority of commenters suggested the Bureau disclose 5-digit ZIP codes, except where population in the ZIP code contains fewer than 10,000 people. The second most cited option recommended disclosing full 5-digit ZIP codes, regardless of population. On the other extreme, one commenter suggested that ZIP codes should be excluded altogether, with state or county being used as the geographic identifier.

While the Bureau acknowledges the unique value of detailed geographic data, it is also acutely aware of the heightened risk 5-digit ZIP codes can create for re-identification. Accordingly, the Bureau plans to disclose 5-digit ZIP codes, except where the population in the ZIP code contains fewer than 20,000 people. In such cases, the Bureau plans to disclose the 3-digit ZIP code, except where the 3-digit ZIP code population contains fewer than 20,000 people, in which case the Bureau does not intend to disclose any ZIP code data. While this approach represents a different approach than those suggested by most commenters, the Bureau believes that this option appropriately balances the utility of geographic data with the associated risk to individual consumer privacy. As with all elements of its scrubbing standard, the Bureau intends to make adjustments in the future guided by the goal of simultaneously maximizing data utility and individual privacy.

3. Re-identification

Several trade associations and companies commented that despite the proposed scrubbing methodology, an unacceptably high risk of re-identification will remain. Some commented that in areas with small populations, even scrubbed narratives could lead to re-identification based on other details not covered by HIPAA standards. One company also commented that the risk of narrative content being repeated through social media raises the possibility of re-identification by individuals familiar with the consumer. Consumer and privacy groups commented that the risk of re-identification is minimal, and offset by the benefits of the policy and rigor of the scrubbing standard.

As the Bureau stated in the Proposed Policy Statement, sharing data containing any personal information presents a tension between data utility and individual privacy. As a particular personal information scrubbing standard becomes more or less stringent, the utility of a given de-identified dataset may become respectively less or more useful. The publication of narratives involves risks, including the potential harm associated with the re-identification of actual consumers within the Consumer Complaint Database. The Bureau believes that it is appropriate to publish only those narratives for which opt-in informed consumer consent has been obtained, that have also been subjected to scrubbing under a robust personal information scrubbing standard and methodology.

F. Impact of Narrative Publication on Companies and the Marketplace

1. Reputational Harm

Trade associations commented that the public disclosure of unverified narratives would result in reputational harm to companies. Some comments argued that any perceived benefit to consumers through narrative publication would be outweighed by the reputational harm suffered by companies.

The Bureau takes seriously company and trade association concerns that financial institutions could incur intangible reputational damage as a result of the disclosure of narratives. As stated in previous policy statements, to a large extent, this risk is inherent in any release of complaint data. In deciding to release the structured complaint data, the Bureau considered this concern and concluded that, while there is always a risk that market participants will draw erroneous conclusions from available data, the marketplace of ideas would on the whole be able to determine what the data show and their relative importance. The Bureau believes this to be equally true with respect to narratives, and that consumer narrative publication will in fact make it easier for the marketplace to evaluate the rest of the complaint data by providing more information and context. Likewise, the Bureau also believes that the option for companies to provide public-facing structured responses will enhance the effectiveness of the Database and provide an opportunity for companies to enhance their reputation and mitigate potential concerns.

Consistent with these comments, the Bureau believes that the Database should include data that provides an unbiased perspective on company behavior toward consumers. Accordingly, in parallel to the finalization of the instant Final Policy Statement, the Bureau intends to further explore ways in which positive company behavior may be highlighted. Concurrent with the Final Policy Statement, the Bureau is publishing a Request for Information to solicit and collect input from the public on the potential collection, identification, and sharing of data and feedback specific to positive interactions with providers of consumer financial products and services.

2. Effect on Consumer Relations

Several companies, trade associations, and a public interest organization commented that publicly posting narratives could create disincentives for consumers to deal directly with companies to resolve their disputes. Some commenters requested that narratives only be posted after the consumer has directly contacted the company. A few trade associations commented that narrative publication would cause general harm to customer relations by making the process more adversarial.

The data collected from the Bureau's credit card intake form and survey work shows that the vast majority of consumers have already attempted, often several times, to resolve the complained-about issue with the company before seeking assistance from the Bureau. As previously stated, a central element of the Bureau's mission is to empower consumers; the Bureau believes that requiring consumers to contact the company before engaging the Bureau would work against that goal. Such an additional procedural hurdle may also discourage some number of consumers from submitting complaints, which would have the effect of depriving the Bureau of the information underlying the complaint. This could serve to undermine Bureau functions that rely, at least in part, on complaint data to inform their respective activities.

Similarly the Bureau is skeptical of concerns that disclosing narratives would create disincentives for consumers to deal directly with the company and would cause general harm to customer relations by making the process more adversarial. Feedback the Bureau has received suggests the introduction of the Consumer Complaint Database and the Bureau's activities generally have caused greater investment by companies in their customer service operations, which includes company complaint handling. The Bureau views this development as a positive step for customer service at companies that are making such investments.

3. The Appearance of Validating Complaints by the Act of Disclosing Them

Several trade associations, companies, and individual commenters stated that by including unverified comments on a government Web site, the narratives will be portrayed as being validated by the Bureau.

Similar concerns were previously raised and addressed by the Bureau in the 2012 Notice of Final Policy Statement.^[31] The Bureau acknowledged the possibility that some consumers may (or may be led to) draw erroneous conclusions from the data. That is true, however, for any market data. In recognition of this risk the Bureau provides the following disclaimer on the Consumer Complaint Database: “We don't verify all the facts alleged in these complaints but we take steps to confirm a commercial relationship between the consumer and company. Complaints are listed here after the company responds or after they have had the complaint for 15 calendar days, whichever comes first. We remove complaints if they don't meet all of the publication criteria. Data is refreshed nightly.” The Bureau believes this disclaimer to be sufficient to address the risk identified by commenters.

As discussed elsewhere, it is noteworthy that several other government agencies make consumer complaint narratives available, including the Consumer Product Safety Commission, the National Highway Transportation Safety Administration, and, pursuant to FOIA requests, the Federal Trade Commission.

4. Consumer Confusion and Lack of Context

Several trade associations commented that unstructured narrative data provides minimal benefit to consumers as required scrubbing would remove any useful information from the narrative and responses. Some trade association comments added that the Bureau's resources would be better utilized by providing more context for data already provided in the Database. Some consumer groups requested better organization of the data provided in the Database.

As noted previously, sharing data containing personal information presents a tension between data utility and individual privacy. The Bureau believes, based on the comments received from various consumer and privacy groups, that it is possible to strike a balance between these two important interests and still disclose a dataset that provides significant benefit to the marketplace. The Bureau will continually monitor this balance for opportunities to adjust its personal information scrubbing standard, which the Bureau intends to describe on its Web site. Furthermore, the Bureau is committed to the continuous improvement of the Consumer Complaint Database, which includes the addition of increasing levels of context, organization, and data normalization.

5. Increased Litigation

A few companies and trade associations commented that the publication of narratives would lead to increased litigation, either through potentially “defamatory” narratives posted by consumers or as a result of additional information available to prospective plaintiffs. One company expressed the concern that complaints and narratives could be sources of information appropriately left to be obtained during the discovery process. One trade association also commented that the privacy risks of published narratives could increase the risk of legal liability and heighten litigation costs. One legal aid organization commented that the availability of complaint narratives would help consumer advocacy groups to identify local trends of unlawful behavior and target legal efforts more effectively.

The Bureau believes the risk of increased litigation following the disclosure of narratives to be low. The closest analogs to the Bureau's plan for narrative disclosure are the Consumer Product Safety Commission's public-facing complaint database and the Federal Trade Commission's disclosures pursuant to FOIA requests; the Bureau is not aware of any information that those disclosures have increased litigation against companies. Ultimately, the Bureau believes there is significant value in making available Bureau complaint data to help in the identification of and calling attention to potentially unlawful behavior.

6. Increased Company Costs

Several trade associations and companies commented that the additional procedure of creating a second, public-facing response, and ensuring its compliance with potentially applicable laws, would increase operational costs for companies. Some of these commenters also emphasized the increased costs to the Bureau resulting from additional infrastructure necessary to publish narratives. One public interest group also highlighted the financial burden of producing additional responses to narratives.

As noted above, and in light of the comments received, the Bureau intends to provide companies with a finite list of optional structured responses that will allow them to recommend to the Bureau an optional public response to address the substance of consumers' complaints. The Bureau believes that this approach significantly decreases the operational costs of providing independent public-facing responses, as compared to the Bureau's proposal of providing separate narrative responses. Still, the Bureau acknowledges that additional effort and expense may be borne by companies in connection with preparing public-facing responses to consumer narratives. The Bureau has weighed these factors, in addition to the increased burdens on the Bureau's own complaint handling operation. The Bureau considers it a matter of fairness to provide companies with the opportunity to address publicly consumer complaints from the company's perspective. It is important to recognize that no company will be required to recommend a public-facing response, and it is entirely up to the company whether it wants to take advantage of this forum. The Bureau does not believe that the additional burden a company may bear in taking advantage of this opportunity, particularly given the Bureau's movement to structured responses and away from unstructured narrative company responses, outweighs the benefit of publicly disclosing narratives to consumers and the marketplace.

7. Confidentiality Agreements

One individual commented that the public posting of consumer narratives would create an incentive for companies to require consumers to sign non-disclosure agreements when creating an account. This commenter recounted an experience in which he submitted a complaint to the Bureau and when settling the matter with the company, the company asked him to sign a confidentiality agreement.

The Bureau's experience to date has not uncovered widespread company use of non-disclosure agreements in connection with the Consumer Complaint Database, and no company comments on the proposed Policy have indicated that companies intend to utilize non-disclosure agreements as gag orders in the way envisioned by this comment. The Bureau's market monitoring will remain alert to developments along these lines. However, the Bureau would likely look disfavorably upon agreements that require a consumer to withdraw his or her consent to have a narrative published as a condition of settlement.

IV. Implementing the Final Policy Statement

Following publication of the Final Policy Statement, the Bureau will turn to implementation of the policy. The Bureau intends to modify its Web site and online complaint intake form to collect informed opt-in consumer consent. In conjunction with the collection of consumer consent, the Bureau intends to finalize and post on its Web site the Consumer Complaint Database scrubbing standard. The Bureau will also modify the company web portal to add functionality to allow companies to provide the recommended public-facing responses, reach out to companies on the company web portal to offer training and provide technical support related to the policy. The Bureau will finalize its automated and manual review processes and then begin scrubbing narratives.

The Bureau will not disclose any scrubbed and consented-to narratives until sufficient time has elapsed to allow the Bureau to adequately complete and assess the above actions.

V. Final Policy Statement

The Bureau hears directly from the American public about their experiences with the nation's consumer financial marketplace. An important element of the Bureau's mission is the handling of individual consumer complaints regarding consumer financial products and services.

In June 2012, the Bureau began making de-identified individual-level complaint data available via its web-based, public-facing database (the “Consumer Complaint Database”). Since launch, the Consumer Complaint Database has been expanded to include additional consumer financial products and data fields as products have been added to its complaint handling system. Consistent with its strategic vision, the Bureau is committed to the continued growth and refinement of the Consumer Complaint Database in a manner that helps inform consumers and the marketplace while still protecting privacy and incorporating appropriate security controls.

A. Consumer Narratives

The Bureau plans to provide consumers who submit their complaints directly to the Bureau the opportunity to share their individual stories with other consumers and the marketplace by including consumer complaint narratives in the Consumer Complaint Database where consent for publication is first obtained from the consumer. Only those narratives for which opt-in consumer consent is obtained and a robust personal information scrubbing standard and methodology is applied will be eligible for disclosure.

B. Consumer Consent To Disclose Narratives

The Bureau intends to disclose only narratives for which informed consent has been obtained and that have been scrubbed for personal information. To obtain informed consumer consent, the Bureau plans to give consumers who submit a complaint the opportunity to check a consent box, with accompanying language that will state, among other things, and in plain language, that: (1) Whether or not consent is given will not otherwise impact how the Bureau handles the complaint; (2) if given, the consumer may thereafter inform the Bureau that the consumer withdraws consent at any time and the narrative will be removed from the Consumer Complaint Database; and (3) the Bureau will take reasonable steps to remove personal information from the complaint to address risk of re-identification.

C. Personal Information Scrubbing Standard and Methodology

Sharing data containing personal information presents a tension between data utility and individual privacy. As a particular personal information scrubbing standard becomes more or less stringent, the utility of a given de-identified dataset may become respectively less or more useful.

Within its judgment and discretion, and in order to address the risk of re-identification, the Bureau intends to apply to all publicly-disclosed narratives a robust personal information scrubbing standard and methodology. In designing its scrubbing standard, the Bureau relied heavily on guidance by the Department of Health and Human Services regarding de-identification of health data, as outlined in the Health Insurance Portability and Accountability Act (“HIPAA”) Privacy Rule.^[32] The Bureau's current scrubbing standard is modeled after the HIPAA Safe Harbor Method, which is generally considered to represent a best practice for de-identifying data. In addition to adopting (and removing) most of the specific HIPAA identifiers, the Bureau also plans to remove: (1) Demographic information such as gender, age, race, and ethnicity; (2) appropriate analogues to HIPAA identifiers in the consumer financial domain, e.g., credit card numbers; and (3) identifiers which the Bureau knows appear in complaints and could reasonably be used to identify individuals, e.g., personal information pertaining to third parties other than the company that is the subject of the complaint. All consumer complaint data shared via the Consumer Complaint Database will be subject to this standard and methodology, including, e.g., ZIP code. The Bureau plans to make this scrubbing standard available on the Bureau's Web site. The scrubbing methodology contemplates a computer-based automated step and a quality assurance step or steps performed by human reviewers.

D. Company Response

The Bureau plans to give companies the opportunity to respond publicly to the substance of the consumer complaints they receive from the Bureau. Within the secure web portal companies use to respond to complaints, the Bureau intends to add a set list of structured company response options; a responding company will be given an opportunity to recommend to the Bureau which option, if any, it would like included as a public-facing response to address the substance of the consumer's complaint. Companies will be under no obligation to avail themselves of this opportunity.

E. Continuous Improvement

The Bureau plans to implement a testing and continuous improvement process to ensure that as applied, the Bureau's standard and methodology for scrubbing personal information adequately protects consumers. The Bureau intends to continue to adjust its scrubbing standard and methodology, guided by the goal of simultaneously maximizing data utility and individual privacy.

VI. Effect of Policy Statement

This Policy Statement is intended to provide information regarding the Bureau's plans to exercise its discretion to publicly disclose certain data derived from consumer complaints. The Policy Statement does not impose any legal obligations on third parties, nor does it create or confer any substantive or procedural rights on third parties that could be enforceable in any administrative or civil proceeding.

Dated: March 12, 2015.

Richard Cordray,

Director, Bureau of Consumer Financial Protection.

Footnotes

1.  Disclosure of Certain Credit Card Complaint Data, 77 FR 37558 (June 22, 2012) (“2012 Notice of Final Policy Statement”); Disclosure of Consumer Complaint Data, 78 FR 21218 (Apr. 10, 2013) (“2013 Notice of Final Policy Statement”).

2.  2012 Notice of Final Policy Statement, 77 FR at 37559 (June 22, 2012); 2013 Notice of Final Policy Statement, 78 FR at 21219 (April 10, 2013).

3.  The Complaint System is described in more detail in the 2013 Consumer Response Annual Report (March 31, 2014) at: http://www.consumerfinance.gov/​reports/​2013-consumer-response-annual-report./​

4.  Disclosure of Consumer Complaint Narrative Data, 79 FR 42765, 42767 (July 23, 2014).

5.  This group included: Americans for Financial Reform; Alliance for a Just Society; Arkansas Community Organization; California Reinvestment Coalition; Connecticut Citizen Action Group; Center for Digital Democracy; Center for Responsible Lending; Community Legal Services, Philadelphia; Connecticut Fair Housing Center; Consumer Action; Consumer Federation of America; Consumers for Auto Reliability and Safety; Consumer Watchdog; Demos; Electronic Privacy Information Center; Empire Justice Center; Florida Alliance for Consumer Protection; Home Defenders League; International Union, United Automobile, Aerospace & Agricultural Implement Workers of America (UAW); Keystone Progress; Leadership Conference on Civil and Human Rights; Massachusetts Consumers' Coalition; MASSPIRG; Miami Valley Fair Housing Center, Dayton, Ohio; Missourians Organizing for Reform and Empowerment; NAACP; National Association of Consumer Advocates; National Consumer Law Center (on behalf of its low income clients); National Council of La Raza; National Fair Housing Alliance; National People's Action; New Economy Project; New Jersey Citizen Action; New Jersey Communities; United Oregon Consumer League; Privacy Rights Clearinghouse; Privacy Times; Project on Government Oversight; Public Citizen; Public Justice Center; South Carolina Appleseed Legal Justice Center; Southwest Center for Economic Integrity; Texas Legal Services Center; The Institute for College Access and Success; U.S.PIRG; Virginia Citizens Consumer Council; Woodstock Institute; and the World Privacy Forum.

6.  Consumer Response maintains several feedback mechanisms for participants in the Complaint System and has plans to expand this capability over time.

7.  Disclosure of Consumer Complaint Narrative Data, 79 FR 45183 (Aug. 4, 2014).

8.  The Administrative Procedure Act exempts general statements of policy from notice and comment. 5 U.S.C. 553(b)(A).

9.  12 U.S.C. 5512(c)(6)(A).

10.  To the extent any features of this policy were considered binding on any party, the Bureau believes they would constitute procedural rules, which are likewise exempt from the requirements of notice and comment. 5 U.S.C. 553(b)(A).

11.  See Ctr. for Auto Safety v. Nat'l Highway Traffic Safety Admin., 452 F.3d 798 (D.C. Cir. 2006) (agency's general statement of policy was not a binding legislative rule simply because it had practical effects, rather than legal consequences, for private parties). Several commenters rely on Electronic Privacy Information Center v. Department of Homeland Security, 653 F.3d 1 (D.C. Cir. 2011), but the Bureau does not believe that case supports their argument. The agency action in that case, in the court's view, imposed legally binding requirements on airline passengers to go through heightened security procedures or be barred from entering airport boarding areas. The opportunity to provide a public response narrative does not impose any similar binding requirement.

12.  See 2013 Notice of Final Policy Statement, 78 FR at 21226 (announcing planned changes to Public Complaint Database and stating Bureau's intention to study and solicit further public feedback on the efficacy of its complaint policies)(April 10, 2013); 2012 Notice of Final Policy Statement, 77 FR at 37568 (same)(June 22, 2012).

13.  Disclosure of Records and Information, 78 FR 11484 (Feb. 15, 2013).

14.  2012 Notice of Final Policy Statement, 77 FR at 37560-61 (June 22, 2012); 2013 Notice of Final Policy Statement, 78 FR at 21220 (April 10, 2013).

15.  12 U.S.C. 5534(a).

16.  Two commenters point to American Petroleum Institute v. SEC, 953 F. Supp. 2d 5 (D.D.C. 2013), in support of the argument that the Bureau lacks authority for the Database. In that case, the SEC contended that a statutory provision unambiguously required public disclosure of certain annual reports from regulated entities. The court held that the provision did not unambiguously require public disclosure and that the SEC had improperly cabined its discretion. Id. at 12-18. The Bureau believes American Petroleum Institute does not suggest the Bureau lacks authority to disclose consumer complaint narratives. That case addressed statutory provisions not at issue here. Moreover, the Bureau acknowledges its discretion with respect to the public disclosure described in the Policy Statement, and it does not believe that such disclosure is unambiguously required under the statute.

17.  12 U.S.C. 5493(b)(3)(A).

18.  12 U.S.C. 5534(a) & (b).

19.  12 U.S.C. 5511.

20.  12 U.S.C. 5512(c)(3)(B) (emphasis added).

21.  12 CFR 1070.40 through 1070.47.

22.  12 CFR 1070.41 (prohibiting Bureau employees from disclosing confidential information other than as provided in subpart D); 12 CFR 1070.2 (defining “confidential information” to include “confidential consumer complaint information”).

23.  12 CFR 1070.2(g).

24.  2012 Notice of Final Policy Statement, 77 FR at 37561 (June 22, 2012); 2013 Notice of Final Policy Statement, 78 FR at 21221 (April 10, 2013).

25.  2012 Notice of Final Policy Statement, 77 FR at 37562 (June 22, 2012).

26.  Disclosure of Consumer Complaint Narrative Data, 79 FR at 42768 (July 23, 2014).

27.  2012 Notice of Final Policy Statement, 77 FR at 37564 (June 22, 2012); 2013 Notice of Final Policy Statement, 78 FR at 21222 (April 10, 2013).

28.  “Our Mission” http://www.consumerfinance.gov/​strategic-plan/​.

29.  The Bureau emphasizes that the consent procedure described in the text for authorizing public disclosure of narratives may not be adequate to satisfy consent requirements under other statutes and regulations that the Bureau administers or enforces.

30.  Disclosure of Consumer Complaint Narrative Data, 79 FR at 42769 (July 23, 2014).

31.  2012 Notice of Final Policy Statement, 77 FR at 37562 (June 22, 2012).

32.  45 CFR 164.514.