CFPB Employee Sent 256,000 Consumers’ Financial Data To Personal Email

In a major black eye for the bloated bureaucratic brainchild of Elizabeth Warren, the Consumer Financial Protection Bureau notified Congress that a bureau employee sent confidential data associated with 256,000 people to the employee’s personal email address. 

And that’s not all. The now-former employee also sent confidential supervisory information relating to 45 financial institutions, a CFPB spokesman told The Wall Street Journal, which broke the story. There’s no indication yet that the information went any further; nor has a motive been announced. 

The information related to people doing business with seven institutions, but most were associated with one firm. The CFPB has so far declined to identify the affected institutions or the bad employee.  

The ever-selective Feds took a light-handed approach to the massive breach. Rather than rolling an armored car to the employee’s house, the government simply asked the former employee to delete the emails and provide an “attestation” that he or she had done so. However, as of Wednesday, the employee hadn’t even done that.  

Most frustrating thing about #CFPB data breach is that having all that data was unnecessary for actually doing their job, as I pointed out years ago https://t.co/EYdissJmjy

— Mark Calabria (@MarkCalabria) April 19, 2023

In 2017, CFPB’s inspector general recommended narrowing employee access to sensitive data, noting some employees had access to data they’d never need to use in their job. 

Though we’re only learning about this incident now, members of Congress were notified almost a month ago — on March 21. Joe Public was left in the dark. So much for the CFPB’s touted commitment to “improving transparency.” Legislators likewise sat on it. 

Now that the secret’s out, Republicans — who’ve long warned about the privacy risks associated with the CFPB’s ambitious collection of consumer data — are pouncing. 

“Why should the CFPB be trusted to collect more data, burdening financial institutions and potentially limiting services for consumers, when they themselves have demonstrated an irresponsible handling of consumers’ financial information?” asked Sen. Tim Scott, ranking member of the Senate banking committee. 

The CFPB spokesman reassured the Journal that the data didn’t include bank account numbers or anything that can be used to access an account. 

In February, the Supreme Court said it would evaluate whether the CFPB may legally continue to receive federal funding. In October, the Fifth Circuit Court of Appeals declared the CFPB’s funding is unconstitutional because its budget comes from the Federal Reserve rather than congressional appropriations. 

That made Pocahontas heap angry: 

This is a lawless and reckless decision. @CFPB has returned billions of dollars to Americans by doing its job, and its funding is clearly constitutional. Extreme right-wing judges are throwing into question every rule the CFPB enforces to protect consumers and businesses alike. https://t.co/rktOfC46R5

— Elizabeth Warren (@SenWarren) October 19, 2022