2012-16247. Confidential Treatment of Privileged Information

AGENCY:

Bureau of Consumer Financial Protection.

ACTION:

Final rule.

SUMMARY:

The Bureau of Consumer Financial Protection (Bureau) is amending its rules relating to the confidential treatment of information by adding a new section providing that the submission by any person of any information to the Bureau in the course of the Bureau's supervisory or regulatory processes will not waive or otherwise affect any privilege such person may claim with respect to such information under Federal or State law as to any other person or entity. In addition, the Bureau has amended its regulations to provide that the Bureau's provision of privileged information to another Federal or State agency does not waive any applicable privilege, whether the privilege belongs to the Bureau or any other person.

DATES:

This rule is effective August 6, 2012.

FOR FURTHER INFORMATION CONTACT:

John R. Coleman, Senior Litigation Counsel, Office of General Counsel, Bureau of Consumer Financial Protection, 1700 G Street NW., Washington, DC 20552, at [phone].

SUPPLEMENTARY INFORMATION:

I. Background

Title X of the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act) established the Bureau as an independent agency within the Federal Reserve System responsible for regulating the offering and provision of consumer financial products and services under the Federal consumer financial laws.^[1] The Bureau's mission is to “implement and, where applicable, enforce Federal consumer financial law consistently for the purpose of ensuring that all consumers have access to markets for consumer financial products and services and that markets for consumer financial products are fair, transparent, and competitive.” ^[2] Congress equipped the Bureau with a number of tools to achieve this mission, including: broad authority to promulgate rules to regulate the consumer financial marketplace; a mandate to educate and inform consumers to make better informed financial decisions; the ability to bring enforcement actions to remedy violations of Federal consumer financial law; and the authority to supervise institutions for compliance with Federal consumer financial law.

This final rule amends the Bureau's rules relating to the confidential treatment of information, 12 CFR part 1070, subpart D, in order to facilitate the exercise of the Bureau's authorities by ensuring that the confidentiality of privileged information is not vitiated by any person's disclosure of such information to the Bureau in the course of its supervisory or regulatory processes, or by the Bureau's exchange of privileged information with another Federal or State agency.

The Bureau is in the process of reviewing comments received on other aspects of the interim final rule that governs the Bureau's disclosure of records and information. See 76 FR 44242 (July 22, 2011) (codified at 12 CFR part 1070). The Bureau intends to issue a final rule in response to those comments in the future.

II. Section-by-Section Analysis

A. Addition of 12 CFR 1070.48

Background

The Bureau has authority to supervise and examine insured depository institutions and credit unions with total assets of more than $10,000,000,000 as well as their affiliates and service providers, in order to assess their compliance with Federal consumer financial law, to obtain information about their activities subject to such laws and their associated compliance systems or procedures, and to detect and assess risks to consumers and to markets for consumer financial products and services.^[3] This supervisory authority, and all related “powers and duties,” transferred to the Bureau from the prudential regulators on July 21, 2011.^[4] In addition, in accordance with the goal of ensuring that Federal consumer law is “enforced consistently, without regard to the status of a person as a depository institution, in order to promote fair competition[,]” ^[5] Congress also provided the Bureau with nearly identical authority to supervise certain nondepository institutions.^[6] The entities subject to the Bureau's supervisory authority are referred to herein as “supervised entities.”

The Bureau's supervision program is focused on supervised entities' “ability to detect, prevent, and correct practices that present a significant risk of violating the law and causing consumer harm.” ^[7] Thus, while the Bureau is committed to remedying violations of Federal consumer financial law, the primary goal of the Bureau's supervision program is to prevent violations of law or consumer harm from occurring. To this end, supervised entities are expected “to have an effective compliance management system adapted to [their] business strategy and operations.” ^[8] Indeed, every “CFPB examination will include review and testing of components of the supervised entity's compliance management system.” ^[9]

An independent audit program and regular self-testing for violations of Federal consumer financial law are essential elements of a strong compliance program.^[10] Supervised entities sometimes rely upon counsel to conduct these analyses. As a consequence, in exercising its supervisory authority, the Bureau may request from its supervised entities information that may be subject to one or more statutory or common law privileges, including the attorney-client privilege and attorney work product protection.^[11] Certain supervised entities have expressed concern, based on cases decided outside of the supervisory context,^[12] that compliance with the Bureau's supervisory requests for such information may result in a waiver of any applicable privilege with respect to third parties.

On January 4, 2012, the Bureau issued a bulletin, CFPB Bulletin 12-01, in which it stated its view that “because entities must comply with the Bureau's supervisory requests for information, the provision of privileged information to the Bureau would not be considered voluntary and would thus not waive any privilege that attached to such information.” ^[13] Further, the Bulletin observed that the prudential regulators' authority to examine very large depository institutions and credit unions, and their affiliates, for compliance with Federal consumer financial law, as well as all related powers and duties, transferred to the Bureau on July 21, 2011.^[14] The Bureau interprets this transfer of authority as including the ability, codified at 12 U.S.C. 1785(j) & 1828(x), to obtain privileged information without waiving any applicable privilege claimed by the provider of the information.

On March 15, 2012, in order to provide further reassurances to its supervised entities, the Bureau published a notice and request for comment regarding its proposal to add a new section to its rules relating to the confidential treatment of information that would provide that any person's submission of information to the Bureau in the course of the Bureau's supervisory or regulatory processes will not waive any privilege such person may claim with respect to such information as to any other person or entity.^[15] The proposed rule was intended to provide protections for the confidentiality of privileged information substantively identical to the statutory provisions that apply to the submission of privileged information to the prudential regulators, and State and foreign bank regulators.^[16] The notice of proposed rulemaking reiterated the position set forth in CFPB Bulletin 12-01 that the submission of privileged information to the Bureau would not, under existing law, result in a waiver of any applicable privilege, and explained that the Bureau was exercising its rulemaking authority to codify this result in order to provide maximum assurances of confidentiality to the entities subject to its supervisory or regulatory authority. As a result, the proposed rule was intended to govern any claim, in Federal or State court, that a person has waived any applicable privilege, including the privilege for attorney work product, by providing such information to the Bureau in the exercise of its supervisory or regulatory processes.^[17]

Response to Comments

The Bureau received 26 comment letters regarding the proposed rule. These comments were submitted on behalf of twenty trade associations (one letter was submitted on behalf of five trade associations), eight individual financial institutions, and two individuals. A majority of the comments supported adoption of the proposed rule; however, several commenters recommended that the Bureau not adopt the proposed rule, but wait for Congress to address institutions' concerns regarding privilege waiver through the enactment of legislation. Although the Bureau has expressed support for legislation codifying the Bureau's view that the submission of privileged information to the Bureau does not result in a waiver,^[18] the Bureau does not believe such legislation is necessary. As discussed below, Congress has delegated to the Bureau the authority to issue regulations to ensure the confidentiality of information submitted to the Bureau and to facilitate the exercise of its supervisory authority. Delegated rulemaking authority is designed to relieve Congress of the obligation to anticipate and address every issue that arises in an agency's administration of the laws entrusted to its care.^[19] Accordingly, while the Bureau continues to support appropriate legislation, the possibility of future congressional action does not counsel against the Bureau's exercise of its existing authority to protect the confidentiality of information it obtains in the course of its supervisory or regulatory processes.

Some commenters disagreed with the Bureau's position, stated in the notice of proposed rulemaking, that the Bureau has the authority to compel privileged information and that the submission of privileged information to the Bureau pursuant to this authority does not waive any applicable privilege because it is not voluntary.^[20] Commenters argued that, for this reason, the rule will not effectively preserve the privileged nature of information submitted to the Bureau. The Bureau continues to adhere to the position that it can compel privileged information pursuant to its supervisory authority. The prudential regulators have consistently taken the view that they can compel privileged information pursuant to their supervisory authority,^[21] and the case law that directly addresses the issue supports the view that the submission of privileged information to a supervisory agency is not voluntary and therefore does not result in a privilege waiver.^[22] The Bureau's authority in this regard is not, however, a prerequisite to its authority to promulgate the rule.

The validity and effectiveness of the rule depends on the scope of the Bureau's rulemaking authority, not on the Bureau's authority to compel privileged information.^[23] In the preamble to the proposed rule, the Bureau noted that it had issued CFPB Bulletin 12-01, which took the position “that, like the prudential regulators, its supervisory authority encompasses the authority to compel supervised entities to provide privileged information and, therefore, a supervised entity's submission of privileged information to the Bureau in response to a request is not a voluntary disclosure that would result in the waiver of any applicable privilege.” ^[24] Consistent with this view of the law, the Bureau observed that the effect of the proposed rule would be to codify the result courts considering claims of waiver would reach in the absence of the rule; thus, the rulemaking would give further assurance to regulated entities regarding the issue of waiver.^[25] The Bureau was clear, however, that the proposed rule would protect the privileged nature of information submitted to the Bureau even assuming courts would have reached a different determination under existing law.^[26] Thus, the Bureau did not indicate in the notice of proposed rulemaking that its authority to promulgate the proposed rule depends on its authority to compel privileged information, or that the proposed rule would codify the Bureau's claimed authority to compel privileged information. To the contrary, the Bureau stated that “the rule does not impose obligations on covered persons to provide information; rather, any requirement to provide information stems from the Bureau's authority under existing law.” ^[27]

In fact, the rule is authorized by the rulemaking authority delegated to the Bureau in the Dodd-Frank Act. In the notice of proposed rulemaking, the Bureau cited three sources of rulemaking authority that support the rule. First, the Bureau relied on “its authority to `prescribe rules regarding the confidential treatment of information obtained from persons in connection with the exercise of its authorities under Federal consumer financial laws.' ” <sup>[28]</sup> The Bureau also relied upon “its general rulemaking authority to `prescribe rules * * * as may be necessary or appropriate to enable the Bureau to administer and carry out the purposes and objectives of the Federal consumer financial laws, and prevent evasions thereof,” and its authority to “prescribe rules to facilitate the supervision of [nondepository institutions] and assessment and detection of risks to consumers.” ^[29] As the Bureau noted, the proposed rule is an appropriate means to facilitate the Bureau's supervision program because, by providing supervised entities greater assurances that their privileges will be maintained, it encourages the free flow of information that is essential to an effective supervision program.^[30] With respect to large depository institutions and credit unions and their affiliates, the rule is also supported by the Bureau's interpretation of Dodd-Frank Act section 1061(b) as including within its grant to the Bureau of all powers and duties relating to the prudential regulators' transferred supervisory authority the power, codified at 12 U.S.C. 1785(j) & 1828(x), to receive privileged information from supervised entities without effecting a waiver. The rule is intended to codify the Bureau's interpretation of section 1061 in this respect.

Commenters generally agreed that an effective supervision program requires that the Bureau be able to obtain privileged information, and that the proposed rule would facilitate such access. As one trade association commenter observed, “the Bureau needs to have a trusting and open relationship with its supervised entities, which includes having appropriate access to certain privileged information.” A large financial services provider agreed that the proposed rule would “yield numerous benefits, chief among them encouraging the free flow of information between supervised persons and their counsel and between supervised persons and the CFPB.” Another trade association agreed that “the preservation of existing legal privileges * * * is vitally important to the functioning of an effective regulatory and supervisory framework.” Commenters also generally agreed with the Bureau that the same standards should apply to entities supervised by the Bureau as to entities currently or formerly supervised by the prudential regulators. These comments confirm the Bureau's judgment in the exercise of its rulemaking authorities that the rule will ensure the confidentiality of information it obtains in the course of its supervisory or regulatory processes and is necessary or appropriate to administer or facilitate the exercise of its supervisory responsibilities.

No commenters argued that the rule was not within the plain text of the rulemaking authority upon which the Bureau relies, but some commenters suggested that Congress's failure to amend 12 U.S.C. 1828(x) to include the Bureau when it enacted the Dodd-Frank Act raises the negative inference that Congress did not intend the Bureau to accomplish the same end through an exercise of its rulemaking authority. The text of both the Federal Deposit Insurance Act and the Dodd-Frank Act suggest otherwise. First, 12 U.S.C. 1828(x) itself cautions against construing the protections it affords to information submitted to the Federal banking agencies as suggesting that “any person waives any privilege applicable to information that is submitted or transferred under any circumstance to which [it] does not apply.” 12 U.S.C. 1828(x)(2)(A). Second, nothing in either the Federal Deposit Insurance Act or the Dodd-Frank Act suggests that Congress intended depository institutions or credit unions with more than $10,000,000,000 in assets, or nondepository entities subject to supervision by the Bureau, to be entitled to less protection for the confidentiality of their information than smaller depository institutions or credit unions supervised for compliance with Federal consumer financial law by the prudential regulators or state bank regulators. To the contrary, Congress explicitly authorized the Bureau to exercise its authority—including the rulemaking authority relied upon here—to ensure that “Federal consumer financial law is enforced consistently, without regard to the status of a person as a depository institution, in order to promote fair competition.” ^[31] Thus, the Bureau does not believe that Congress's silence regarding this provision of the Federal Deposit Insurance Act suggests that the Bureau lacks the rulemaking authority to promulgate section 1070.48. Congress has entrusted the Bureau with administering and implementing Title X of the Dodd-Frank Act, the Consumer Financial Protection Act of 2010,^[32] and the Bureau is adopting section 1070.48 pursuant to the rulemaking authorities expressly provided under that law. Accordingly, section 1070.48 is a valid exercise of the Bureau's rulemaking authority and will govern third parties' claims of waiver based on the submission of privileged information by any person to the Bureau.^[33]

Several commenters asked the Bureau to make clear that the rule would apply to the submission of privileged information by insured depository institutions or credit unions with $10,000,000 or less in assets, as defined in section 1026(a) of the Dodd-Frank Act. As the commenters note, although the prudential regulators retain primary supervisory authority over these institutions, the Bureau has authority, at its discretion, to participate in the prudential regulators' examinations of these institutions on a sampling basis.^[34] The Bureau may also require reports from smaller depository institutions and credit unions as necessary to support its implementation of Federal consumer financial law, to support its examination of these institutions, and “to assess and detect risks to consumers and consumer financial markets.” ^[35] Although the need for the rule has arisen primarily in the context of the Bureau's supervision of larger depository institutions and credit unions, the term “person” used by section 1070.48 is not intended to be limited to such institutions, but is intended to be interpreted broadly in accordance with the definition of that term in 12 CFR 1070.2. Accordingly, to the extent smaller depository institutions or credit unions submit privileged information to the Bureau in the course of the Bureau's supervisory or regulatory processes, section 1070.48 will govern any claim, in Federal or State court, that such submission resulted in a waiver of the privilege.

Commenters also sought clarification as to whether the rule would apply to claims that institutions have waived protections afforded to attorney work product by submitting such information to the Bureau. The Bureau does intend the rule's reference to “privilege” to encompass “any privilege” that applies to information submitted by the Bureau, including the attorney work product protection. In fact, in discussing the need for the rule in the notice of proposed rulemaking, the Bureau began by observing that it “will at times request from its supervised entities information that may be subject to one or more statutory or common law privileges, including, for example, the attorney-client privilege and attorney work product protection.” ^[36] The Bureau believes that interpreting the term “privilege” as including the protection afforded by the work product doctrine is consistent with courts' treatment of the term,^[37] and with the purpose of the rule. Section 1070.48 is intended to facilitate the free flow of information between the Bureau and its supervised institutions by reassuring such institutions that the submission of information to the Bureau will not affect the institutions' ability to protect it from disclosure to third parties. This purpose is served by construing the term privilege, as used in the section 1070.48, to include attorney work product. Accordingly, the Bureau interprets the term “privilege” to include the protection afforded by the work product doctrine.

Several commenters asked the Bureau to reaffirm its policy, as expressed in CFPB Bulletin 12-01, that it will request privileged information only in limited circumstances. As noted in CFPB Bulletin 12-01, the Bureau recognizes the important interests served by the common law privileges, in particular the attorney-client privilege. The Bureau understands that compliance with Federal consumer financial law is served by policies that do not discourage those subject to its supervisory or regulatory authority from seeking the advice of counsel. Accordingly, the Bureau continues to adhere to its policy to request submission of privileged information only when it determines that such information is material to its supervisory objectives and that it cannot practicably obtain the same information from non-privileged sources. The Bureau also continues to adhere to its policy of giving “due consideration to supervised institutions' requests to limit the form and scope of any supervisory request for privileged information.” ^[38] The Bureau believes that its policies regarding requests for privileged information are consistent with those of the prudential regulators.^[39]

In light of these policies, the Bureau disagrees with the contention of several commenters that the final rule will have the effect of chilling attorney-client communications within supervised entities. To the contrary, the final rule encourages and strengthens communications between supervised entities and their attorneys by providing additional protections for the confidentiality of those communications. As the Bureau made clear in the notice of proposed rulemaking, the rule itself does not require the submission of privileged information, but instead merely provides protections for privileged information that is submitted to the Bureau, voluntarily or otherwise. As stated above, to the extent the Bureau requests privileged information from supervised entities, it will do so only when it determines that such information is material to its supervisory objectives and that it cannot practicably obtain the same information from non-privileged sources.

Commenters also expressed concern regarding the Bureau's disclosure to other agencies of attorney-client or work product privileged information submitted to the Bureau in the course of its supervisory process. The Bureau's policy for the treatment of confidential supervisory information generally is expressed in CFPB Bulletin 12-01, which states, in pertinent part:

[T]he Bureau will not routinely share confidential supervisory information with agencies that are not engaged in supervision. Except where required by law, the Bureau's policy is to share confidential supervisory information with law enforcement agencies, including State Attorneys General, only in very limited circumstances and upon review of all the relevant facts and considerations. The significance of the law enforcement interest at stake will be an important consideration in any such review. However, even the furtherance of a significant law enforcement interest will not always be sufficient, and the Bureau may still decline to share confidential supervisory information based on other considerations, including the integrity of the supervisory process and the importance of preserving the confidentiality of the information.^[40]

This policy applies to the Bureau's treatment of all confidential supervisory information, including the instances in which the Bureau is asked to share with a law enforcement agency confidential supervisory information that is also subject to the attorney-client or work product privileges. The Bulletin's presumption against sharing confidential supervisory information would be even stronger in such instances.

As stated in CFPB Bulletin 12-01, “[b]y articulating its policy regarding its treatment of confidential supervisory information, the Bureau does not intend to limit its use of such information in administrative or judicial proceedings, subject to appropriate protective orders.” ^[41]

Conclusion

For the foregoing reasons, the Bureau adopts the proposed rule without modification.

B. Amendment of Section 1070.47(c)

On July 28, 2011, the Bureau issued an interim final rule providing that “[t]he provision by the CFPB of any confidential information pursuant to [12 CFR part 1070, subpart D] does not constitute a waiver, or otherwise affect, any privilege any agency or person may claim with respect to such information under federal law.” 12 CFR 1070.47(c). In the notice of proposed rulemaking, the Bureau proposed readopting this rule in modified form to create a non-waiver provision substantively similar to that codified in section 11 of the Federal Deposit Insurance Act,^[42] with the exception that the rule will also apply to the disclosure of privileged information to State agencies in addition to Federal agencies. The primary purpose of the proposed rule is to protect the privileges of the Bureau in the context of a joint investigation or coordinated examination. The rule will, however, also foreclose claims that any other person's privilege has been waived by the Bureau's disclosure of that person's privileged information to another Federal or State agency.

The Bureau received comparatively few comments related to its proposed revision of section 1070.47(c). As noted, some commenters expressed concern regarding the Bureau's treatment of attorney-client and attorney work product privileged information obtained in the course of its supervisory or regulatory processes, including whether the Bureau intends to provide such privileged information to other Federal or State agencies. One commenter suggested that the term “State agency” in section 1070.47(c) be defined to exclude State attorneys general, and suggested that the Bureau should not share with a State agency the privileged information of a regulated entity that relates to pending or anticipated litigation between the State agency and the entity.

As addressed above in the discussion of section 1070.48, the ordinary presumption that the Bureau will not share confidential supervisory information is even stronger when the confidential supervisory information is also subject to the attorney-client or work product privilege. Although section 1070.47(c) will protect any person's privileged information from claims of waiver, it is primarily intended to protect the Bureau's privileges—including, for example, its examination privilege, its deliberative process privilege, and its law enforcement privilege—in the context of a coordinated examination or joint investigation.^[43] For this reason, the Bureau declines to define the term “State agency” as excluding State attorneys general. If the Bureau were to share privileged information obtained from a person in the course of its supervisory or regulatory functions with another agency, for example a prudential regulator, the information would remain the property of the Bureau.^[44] The agency receiving any person's privileged information from the Bureau would be required to maintain the confidentiality of the information and would be prohibited from further disclosure of such information without the Bureau's consent.^[45]

Several commenters raised a specific concern regarding whether the corporate entity created by State regulators to administer the National Mortgage Licensing System (NMLS) will be considered a “State agency” for purposes of section 1070.47(c). According to the commenters, State regulators often use the NMLS to exchange confidential information of related companies. The Secure and Fair Enforcement for Mortgage Licensing Act (S.A.F.E. Act) protects the confidentiality of information exchanged by State and Federal agencies through the NMLS, and expressly provides that information provided to the NMLS “may be shared with all State and Federal regulatory officials with mortgage industry oversight authority without the loss of privilege or the loss of confidentiality protections provided by Federal or State laws.” 12 U.S.C. 5111(a); see also 12 CFR 1008.3 (implementing regulation). One commenter expressed concern that a court could find that this provision does not extend to the sharing of information relating to nonbank lenders. To address this concern, the commenter suggested adding an additional rule of construction to section 1070.47(c) to make clear that the term “State agency” includes any entity employed by a state agency to carry out its statutory responsibilities. The Bureau declines to adopt this suggestion because, in its view, the confidentiality provisions of the S.A.F.E. Act and its implementing regulations provide the necessary assurances of confidentiality.

Commenters also sought clarification that section 1070.47(c), like section 1070.48, would apply to attorney work product, as well as other types of privileged information. For the reasons set forth in the discussion of section 1070.48, the Bureau affirms that section 1070.47(c) is intended to apply to attorney work product and other privileged information.

Conclusion

For the foregoing reasons, the Bureau adopts the proposed rule without modification.

III. Legal Authority

A. Rulemaking Authority

The final rule is based on the Bureau's authority to “prescribe rules regarding the confidential treatment of information obtained from persons in connection with the exercise of its authorities under Federal consumer financial laws.” ^[46] As explained above, section 1070.48 will ensure that the confidential nature of privileged information obtained by the Bureau in the course of any supervisory or regulatory process is not waived, destroyed, or modified by compliance with the Bureau's requests for information. The revised version of section 1070.47(c) ensures that the sharing of information with Federal and State agencies mandated or authorized by Title X of the Dodd-Frank Act does not affect the confidential and privileged nature of the information. This protection is an appropriate use of the Bureau's authority to prescribe rules regarding the confidential treatment of information. Where any privileged information or material is submitted to the Bureau or shared by the Bureau as described in the final rule, the final rule prohibits discovery or disclosure of that information or material as if, and to the extent that, the privilege had not been waived.

In addition, the Bureau relies on its general rulemaking authority to “prescribe rules * * * as may be necessary or appropriate to enable the Bureau to administer and carry out the purposes and objectives of the Federal consumer financial laws, and to prevent evasions thereof.” ^[47] The supervision and other authorities provided by Title X of the Dodd-Frank Act are components of “Federal consumer financial law.” As explained above, the final rule is a necessary and appropriate measure to ensure that the Bureau is able to implement these authorities, and to do so consistently “without regard to the status of a person as a depository institution, in order to promote fair competition.” ^[48] As explained above, the final rule will promote candid dialogue between supervised entities and the Bureau, again furthering the purposes and objectives of Federal consumer financial law. In addition, by providing greater certainty to supervised entities, the final rule will also prevent evasions of the Bureau's supervisory and other authorities because supervised entities might improperly attempt to rely upon the risk of waiving privilege in order to evade or hamper the Bureau's supervision. The final rule is also meant to codify the Bureau's interpretation of section 1061(b) of the Dodd-Frank Act as granting the Bureau the prudential regulators' authority, codified at 12 U.S.C. 1785(j) and 1828(x), to obtain privileged information from very large depository institutions and credit unions and their affiliates without effecting a waiver.

Finally, the Bureau also relies on its authority to “prescribe rules to facilitate the supervision of [nondepository institutions] and assessment and detection of risks to consumers.” ^[49] For the reasons discussed above, the final rule will facilitate the Bureau's supervision of nondepository institutions and thereby enhance the Bureau's ability to assess and detect risks to consumers.

B. Section 1022(b)(2) of the Dodd-Frank Act

In developing the final rule, the Bureau considered potential benefits, costs, and impacts, and has consulted or offered to consult with the prudential regulators and the Federal Trade Commission, including regarding consistency with any prudential, market, or systemic objectives administered by such agencies.^[50] The Bureau did not receive comments regarding the notice of proposed rulemaking's analysis of the proposed rule's potential benefits, costs, and impacts.

Section 1070.48 of the final rule provides that the submission by any person of information to the Bureau in the course of the Bureau's supervisory or regulatory processes does not waive or otherwise affect any privilege such person may claim with respect to such information under Federal or State law as to any other person or entity. Section 1070.47(c) of the final rule provides that the Bureau's provision of privileged information to another Federal or State agency does not waive any applicable privilege.

As explained above, the Bureau anticipates that section 1070.48 will most often apply in the context of a supervised entity's involuntary submission of privileged information to the Bureau.^[51] In these circumstances, the final rule will not result in a determination regarding the privileged nature of information different than that which would have been reached in the absence of the rule, and would not be expected to impose costs on consumers or to impact consumers' access to consumer financial products or services. In circumstances in which section 1070.48 results in a determination regarding the privileged nature of information different than that which would be reached under existing law, the final rule will benefit covered persons by preserving any applicable privilege a covered person may claim in response to a third party's claim of waiver. Furthermore, in that scenario, the final rule could impose a potential cost on consumers or covered persons involved in subsequent third-party litigation regarding a supervised entity to the extent the rule, as opposed to existing law, prevents them from discovering or using privileged information subject to the rule pursuant to a theory of waiver. The final rule could also benefit consumers, however, by facilitating the Bureau's ability to supervise covered persons and service providers and thereby detect and prevent risks to consumers.

The Bureau also believes that courts applying the principles of the common law would be unlikely to find a waiver of any applicable privilege in most circumstances in which it will share privileged information with another Federal or State agency. For example, the Bureau believes it unlikely that a court would find a waiver if it were to share its privileged deliberative work product with Federal or State agencies in the context of a coordinated examination or joint investigation. In circumstances in which the rule does result in a determination regarding waiver different than that which would be reached under existing law, section 1070.47(c)'s only effect would be to preserve the confidentiality of privileged information and, therefore, would not impose material costs on consumers or covered persons for the same reasons as set forth above in relation to section 1070.48. Accordingly, section 1070.47(c) is not expected to impose material costs on consumers or covered persons or to impact consumers' access to consumer financial products or services.

Finally, although the final rule would apply to privileged information submitted by depository institutions or credit unions with $10,000,000,000 or less in assets as described in section 1026 of the Dodd-Frank Act, it has no unique impact upon such institutions. Nor does the final rule have a unique impact on rural consumers.

IV. Regulatory Flexibility Act

The Regulatory Flexibility Act (RFA), as amended by the Small Business Regulatory Enforcement Fairness Act of 1996, requires each agency to consider the potential impact of its regulations on small entities, including small businesses, small governmental units, and small not-for-profit organizations.

The RFA generally requires an agency to conduct an initial regulatory flexibility analysis (IRFA) and a final regulatory flexibility analysis (FRFA) of any rule subject to notice-and-comment rulemaking requirements, unless the agency certifies that the rule will not have a significant economic impact on a substantial number of small entities. The Bureau did not perform an IFRA because it determined and certified that the proposed rule, if adopted, would not have a significant economic impact on a substantial number of small entities. The Bureau did not receive any comments regarding its certification, and is adopting the proposed rule without change.

A FRFA is not required for the proposed rule because it will not have a significant economic impact on a substantial number of small entities. The proposed rule does not impose obligations or standards of conduct on any entities. In any event, as noted, the submission by any person of any information to the Bureau in the course of the Bureau's supervisory or regulatory processes or the Bureau's later disclosure of such submitted material generally does not waive or otherwise affect any privilege such person may claim with respect to such information under Federal or State law as to any other person or entity. The final rule is intended to codify this result in order to give further assurance to entities subject to the Bureau's authority. Any requirement to provide information stems from the Bureau's authority under existing law, not the final rule. To the extent that the final rule alters existing law, it protects any applicable privilege under Federal or State law that a covered person that provides information to the Bureau may claim.

Accordingly, the undersigned hereby certifies that the final rule will not have a significant economic impact on a substantial number of small entities.

List of Subjects in 12 CFR Part 1070

• Confidential business information
• Consumer protection
• Privacy

Authority and Issuance

For the reasons set forth in the preamble, the Bureau amends 12 CFR part 1070, subpart D, as set forth below:

PART 1070—DISCLOSURES OF RECORDS AND INFORMATION

1. The authority citation for part 1070 continues to read as follows:

Authority: 12 U.S.C. 3401; 12 U.S.C. 5481 et seq.; 5 U.S.C. 552; 5 U.S.C. 552a; 18 U.S.C. 1905; 18 U.S.C. 641; 44 U.S.C. ch. 30; 5 U.S.C. 301.

Subpart D—Confidential Information

2. Amend § 1070.47 by revising paragraph (c) to read as follows:

§ 1070.47

Other Rules Regarding Disclosure of Confidential Information.

* * * * *

(c) Non-waiver. (1) In general. The CFPB shall not be deemed to have waived any privilege applicable to any information by transferring that information to, or permitting that information to be used by, any Federal or State agency.

(2) Rule of construction. Paragraph (c)(1) of this section shall not be construed as implying that any person waives any privilege applicable to any information because paragraph (c)(1) does not apply to the transfer or use of that information.

3. Add § 1070.48 to read as follows:

§ 1070.48

Privileges not affected by disclosure to the CFPB.

(a) In general. The submission by any person of any information to the CFPB for any purpose in the course of any supervisory or regulatory process of the CFPB shall not be construed as waiving, destroying, or otherwise affecting any privilege such person may claim with respect to such information under Federal or State law as to any person or entity other than the CFPB.

(b) Rule of construction. Paragraph (a) of this section shall not be construed as implying or establishing that—

(1) Any person waives any privilege applicable to information that is submitted or transferred under circumstances to which paragraph (a) of this section does not apply; or

(2) Any person would waive any privilege applicable to any information by submitting the information to the CFPB but for this section.

Dated: June 26, 2012.

Richard Cordray,

Director, Bureau of Consumer Financial Protection.

Footnotes

1.  See Public Law 111-203, section 1011(a) (2010).

2.  See Dodd-Frank Act section 1021(a), 12 U.S.C. 5511(a).

3.  See Dodd-Frank Act section 1025(b)(1), (d), 12 U.S.C. 5515(b)(1), (d); see also Dodd-Frank Act section 1029A, 12 U.S.C. 5511 note (stating that this provision becomes effective on the designated transfer date, established by the Secretary of the Treasury as July 21, 2011).

4.  See Dodd-Frank Act section 1061, 12 U.S.C. 5581. The prudential regulators are the Office of the Comptroller of the Currency (OCC), the Board of Governors of the Federal Reserve System (Board), the Federal Deposit Insurance Corporation (FDIC), the National Credit Union Administration (NCUA), and the former Office of Thrift Supervision (OTS). See Dodd-Frank Act section 1002(24), 12 U.S.C. 5481(24). Although the prudential regulators retained primary authority to supervise smaller depository institutions and credit unions for compliance with Federal consumer financial law, the Bureau has certain supervisory authorities with respect to these institutions, as well as the service providers to a substantial number of such institutions. See Dodd-Frank Act sections 1061(c)(1)(B), 1026(b), (c), (e), 12 U.S.C. 5581(c)(1)(B), 5516(b), (c), (e).

5.  See Dodd-Frank Act section 1021(b)(4), 12 U.S.C. 5511(b)(4).

6.  See Dodd-Frank Act section 1024(b), 12 U.S.C. 5514(b). The Bureau also has supervisory authority over service providers to such institutions. See Dodd-Frank Act section 1024(e), 12 U.S.C. 5514(e).

7.  See Consumer Financial Protection Bureau, Supervision and Examination Manual, Overview at 3 (“CFPB Examination Manual”), available at www.consumerfinance.gov/​guidance/​supervision/​manual/​.

8.  CFPB Examination Manual, Compliance Management Review (CMR) at 1.

9.  Id. The Bureau has adopted the Federal Financial Institution Examination Council's (FFIEC) Uniform Consumer Compliance Rating System. Institutions are eligible for the highest rating in this system only if the Bureau determines that they have “[a]n effective compliance program, including an efficient system of internal procedures and controls.” CFPB Examination Manual, Examinations at 9.

10.  CFPB Examination Manual, CMR at 8-12.

11.  The final rule applies to “any privilege” that applies to information obtained by the Bureau.

12.  See In re Pacific Pictures Corp., 679 F.3d 1121, 1127 (9th Cir. 2012) (collecting cases).

13.  CFPB Bulletin 12-01, at 2, available at http://files.consumerfinance.gov/​f/​2012/​01/​GC_​bulletin_​12-01.pdf.

14.  See Dodd-Frank Act section 1061(b), 12 U.S.C. 5581(b).

15.  See 77 FR 15286, 15286 (March 15, 2012) (hereinafter “notice of proposed rulemaking”).

16.  Id. at 15287.

17.  Id. at 15289.

18.  See How Will the CFPB Function Under Richard Cordray?: Hearing Before the Subcomm. on TARP, Fin. Serv. & Bailouts of Pub. & Private Programs of the H. Comm. on Oversight & Gov't Reform, 112th Cong. (2012) (Statement of Richard Cordray).

19.  See United States v. Mead, 533 U.S. 218, 229 (2001) (“Congress * * * may not have expressly delegated authority or responsibility to implement a particular provision or fill a particular gap. Yet it can still be apparent from the agency's generally conferred authority and other statutory circumstances that Congress would expect the agency to be able to speak with the force of law when it addresses ambiguity in the statute or fills a space in the enacted law, even one about which `Congress did not actually have an intent' as to a particular result.”) (quoting Chevron, U.S.A., Inc. v. Natural Res. Def. Council, 467 U.S. 837, 845 (1984)). As noted, the Bureau's exercise of rulemaking authority is consistent with Congress's broad grant to the Bureau of all powers and duties “relat[ing]” to the prudential regulators' transferred supervision authority, and by its emphasis on the need for consistent regulatory treatment of depository and nondepository institutions.

20.  See 77 FR at 15288 & n. 16 (citing Boston Auction Co. v. W. Farm Credit Bank, 925 F. Supp. 1478, 1481-82 (D. Haw. 1996) (no waiver where documents provided to examiners from the Farm Credit Administration because disclosure not voluntary); Vanguard Sav. & Loan Assn v. Banks, No. 93-cv-4267, 1995 WL 555871, at *5 (E.D. Pa. Sept. 18, 1995) (holding that the disclosure of work product privileged information to state bank regulator is “involuntary” and, therefore, does not waive the privilege); United States v. Buco, Crim. No. 90-10252-H, 1991 WL 82459, at *2 (D. Mass. May 13, 1991) (holding that “the public interest served by encouraging the free flow of information between the banks and their Federal regulators is substantial; a rule which provided that a bank generally waived its attorney-client privilege as to materials submitted to federal regulators would substantially impair that interest.”).

21.  See, e.g., OCC Interpretive Letter, 1991 WL 338409 (Dec. 3, 1991); Statement of Scott Alvarez, General Counsel of the Board of Governors of the Federal Reserve System, before the H. Fin. Servs. Comm. at 2 (May 17, 2012) (“The Federal Reserve examines, on a regular basis, institutions for which we have been granted supervisory authority by Congress and, through that authority, has complete and unfettered access to an institution's most sensitive financial information and processes, including information that would otherwise be privileged and not subject to public disclosure.”) available at http://financialservices.house.gov/​UploadedFiles/​HHRG-112-BA00-WState-SAlvarez-20120517.pdf.

22.  See supra n. 20. Reliance upon case law outside of the supervisory context is misplaced as doing so ignores the “well established distinction between supervision and law enforcement.” Cuomo v. Clearing House Assoc., 557 U.S. 519, 129 S. Ct. 2710, 2717 (2009).

23.  Indeed, the Bureau intends the rule to also govern claims of waiver related to the voluntary submission of privileged information to the Bureau.

24.  See 77 FR at 15288.

25.  Id. at 15290.

26.  Id.

27.  Id.

28.  See id. at 15289-90 (quoting Dodd-Frank Act section 1022(c)(6)(A), 12 U.S.C. 5512(c)(6)(A)).

29.  See id. at 15290 (citing Dodd-Frank Act sections 1022(b)(1), 1024(b)(7)(A), 12 U.S.C. 5512(b)(1) 5514(b)(7)(A)).

30.  See, e.g., In re Subpoena Served Upon the Comptroller of the Currency, and Sec'y of the Bd. of Governors of the Fed. Reserve Sys., 967 F.2d 630, 634 (D.C. Cir. 1992) (“Because bank supervision is relatively informal and more or less continuous, so too must be the flow of communication between the bank and the regulatory agency. Bank management must be open and forthcoming in response to the inquiries of bank examiners, and the examiners must in turn be frank in expressing their concerns about the bank. These conditions simply could not be met as well if communications between the bank and its regulators were not privileged.”)

31.  See Dodd-Frank Act section 1021(b)(4), 12 U.S.C. 5511(b)(4). In similar circumstances, the United States Court of Appeals for the Third Circuit expressly refused to “infer an intention to prohibit [a] selective waiver rule from Congress's” failure to enact a statutory selective waiver provision sought by the Securities and Exchange Commission. See Westinghouse Elec. Corp. v. Republic of Philipines, 951 F.2d 1414, 1427 n.15 (1991).

32.  See Dodd-Frank Act section 1022(a); 12 U.S.C. 5512(a).

33.  See Westinghouse, 951 F.2d at 1427 (suggesting that it would not have found a waiver if the SEC's confidentiality rule had “justified a reasonable belief on Westinghouse's part that the attorney-client privilege w[ill] be preserved.”).

34.  See Dodd-Frank Act sections 1061(c)(1)(B), 1026(c); 12 U.S.C. 5581(c)(1)(B), 5516(c).

35.  See Dodd-Frank Act section 1026(b); 12 U.S.C. 5516(b).

36.  See 77 FR at 15286.

37.  The protection afforded to information subject to the work product doctrine is often referred to as a privilege, albeit a qualified one. See Edna S. Epstein, The Attorney-Client Privilege and Work Product Doctrine, 792 (5th ed. 2007) (“The words `doctrine,' `immunity,' and `privilege' (among others) have been used in naming the protection given work product. Any of the terms is probably appropriate.”); see also United States v. Nobles, 422 U.S. 225, 237 (1975); Solis v. Food Emp'r Labor Relations Ass'n, 644 F.3d 221, 231 (4th Cir. 2011); Hernandez v. Tanninen, 604 F.3d 1095, 1100 (9th Cir. 2010).

38.  See CFPB Bulletin 12-01 at 3.

39.  See, e.g., Office of the Comptroller of the Currency, Access to Privileged Information, 2000 WL 226431 (Feb. 2000).

40.  CFPB Bulletin 12-01, at 5.

41.  Id.

42.  See 12 U.S.C. 1821(t).

43.  See 77 FR at 15289.

44.  See 12 CFR 1070.47(a).

45.  Id.

46.  See Dodd-Frank Act section 1022(c)(6)(A); 12 U.S.C. 5512(c)(6)(A).

47.  See Dodd-Frank Act section 1022(b)(1), 12 U.S.C. 5512(b)(1); see also Dodd-Frank Act sections 1012(a)(10), 12 U.S.C. 5492(a)(10) (authorizing the Bureau to establish policies with respect to “implementing the Federal consumer financial laws through rules, orders, guidance, interpretations, statements of policy, examinations, and enforcement actions * * * ”).

48.  See Dodd-Frank Act section 1021(b)(4), 12 U.S.C. 5511(b)(4); see also Dodd-Frank Act section 1021(a), 12 U.S.C. 5511(a).

49.  See Dodd-Frank Act section 1024(b)(7)(A), 12 U.S.C. 5514(b)(7)(A). This rulemaking does not concern supervisory requirements or coordinated registration systems for nondepository institutions. Accordingly, the Bureau has determined that consultation with state agencies is not appropriate. See Dodd-Frank Act section 1024(b)(7)(D), 12 U.S.C. 5514(b)(7)(D).

50.  Specifically, section 1022(b)(2)(A) calls for the Bureau to consider the potential benefits and costs of a regulation to consumers and covered persons, including the potential reduction of access by consumers to consumer financial products or services; the impact on depository institutions and credit unions with $10 billion or less in total assets as described in section 1026 of the Act; and the impact on consumers in rural areas. The manner and extent to which the provisions of section 1022(b)(2) apply to a rule of this kind that does not establish standards of conduct is unclear. Nevertheless, to inform this rulemaking more fully, the Bureau performed the described analyses and consultations.

51.  Notably, section 1070.48 does not require the submission of information; rather, any requirement to provide information stems from the Bureau's authority under existing law.