The fight for control of the Consumer Financial Protection Bureau may have significant effects on the bureau's mass acquisition of private financial records, according to privacy advocates.
The CFPB pools vast quantities of data for research purposes, including millions of people’s credit card records, which it says are anonymized, commercially available and tracked to help consumers, not to spy on them.
Critics doubt the adequacy of safeguards, however, and liken the credit data-collection to the National Security Agency’s monitoring of internet and phone records under laws that allow tracking of spies and terrorists.
Mick Mulvaney, who assumed command of the CFPB on Monday morning, has been broadly critical of the independent agency as a “rogue" organization.
Leandra English, the other claimant to the title of CFPB acting director, is pressing forward in court with backing from progressives who view her as a defender of the bureau’s status quo, although Mulvaney for the moment has been accepted by bureau leadership.
While Mulvaney has not singled out a desire to reform surveillance at the bureau, Republican allies have made it a major issue.
Leading critics include Mark Calabria, hired in February to be Vice President Mike Pence’s chief economist, and Senate Banking Committee Chairman Mike Crapo, R-Idaho, in has called the collection “an unwarranted, unwelcome intrusion into the private financial lives of millions of Americans.”
Calabria testified to Congress in 2015 that the CFPB’s collection, “particularly in the area of credit cards, poses significant threats to our Fourth Amendment protections.”
“These extensive data collections are in no way necessary for the CFPB to achieve its statutory mission,” he argued.
“For a variety of reasons, the CFPB has become a highly partisan issue. Were it to use the financial records of its critics in an attempt to silence or intimidate these critics, it would not be the first agency to do so,” Calabria warned.
The CFPB was established by the 2010 Dodd-Frank financial reform law and its monitoring work became controversial in 2013, when the efforts were likened to NSA programs revealed that year by former government contractor Edward Snowden.
A spokesperson for the CFPB defended the collection at the time, saying credit card information was purchased in bulk from the credit-reporting company Experian and did not offer granular detail on purchases or individual identities.
"Like other federal regulators, the CFPB is a data-driven agency and the CFPB uses anonymized industry data to better understand the markets it oversees," the spokesperson said. "The consumer credit history data and other information from industry data sources is used by CFPB staff to analyze industry trends, conduct research about household finances, and assess the impact of its proposed rules on consumers and industry.”
Documents acquired in 2013 by Judicial Watch, however, prompted concern about ambitions to monitor 80 percent of all U.S. credit card transactions and information on up to 95 percent of mortgages.
John Berlau, a senior fellow at the Competitive Enterprise Institute, told the Washington Examiner that he believes “it would be good policy and good politics for Mulvaney to get rid of it as quickly as he can.”
“It results in red tape but also it violates so many Americans’ privacy, having this NSA-like database and not for any national security purposes,” he said.
“The NSA at least is subject to congressional appropriations,” Berlau added, referring to the CFPB’s budgetary independence.
“They never were specific about how they anonymized that data,” he said.
Julian Sanchez, a senior fellow at the Cato Institute, said he believes Americans should at least be “moderately” concerned about the CFPB collection programs.
“Any large body of financial data is a potentially attractive target for hackers, and we’ve seen repeatedly — from the massive breach at the Office of Personnel Management to the theft of NSA cyberweapons — that the government often has trouble securing even it’s most highly sensitive information,” he said.“The private sector, of course, often has the same problem, but every independent repository of information increases the risk.”
Sanchez added: “My understanding is that CFPB does make efforts to mitigate those risks somewhat by taking steps to anonymize their records and scrub personally identifiable information — but it turns out to be very tricky to fully anonymize large data sets without also making them much less useful. It takes surprisingly few generic-seeming data points to substantially reidentify records if the attacker has access to outside data sets that can be used to hunt for correlations.”
J. Bradley Jansen, director of the Center for Financial Privacy and Human Rights, predicted that the collection efforts “will be reined in or killed.”
Jensen said if Mulvaney doesn’t curtail or end the collection, the Supreme Court might do so indirectly by revising the so-called third party doctrine in the case Carpenter v. United States, which deals with warrant protection for historical cellphone location records. Courts since the 1970s have held the third-party doctrine means Americans have no expectation of privacy over most records they voluntarily share with a business.
Although CFPB data-tracking has yet to yield significant and sustained bipartisan pushback from Congress, Republicans are unlikely to let up on the collection, which Florida Rep. Daniel Webster memorable declared in 2014 "is more than just NSA-style, this is more Gestapo-style collection of data."
Rep. Sean Duffy, R-Wis., another forceful critic, told the Washington Examiner in an emailed statement that he believes “the CFPB was a rotting, unaccountable agency” and that he hopes Mulvaney’s appointment "opens a larger conversation about the need to rein in the CFPB’s power and actually make it accountable to the American people.”
A spokesman for Mulvaney did not respond to a request for comment on whether he plans to roll back surveillance efforts after imposing first-day reforms that include a freeze on new hiring and regulations.