This subpart does not apply to requests for official information made pursuant to subpart B, C, or E of this part.

(a) Non-disclosure. Except as required by law or as provided in this part, no current or former employee or contractor or consultant of the CFPB, or any other person in possession of confidential information, shall disclose such confidential information by any means (including written or oral communications) or in any format (including paper and electronic formats), to:

(1) Any person who is not an employee, contractor, or consultant of the CFPB; or

(2) Any CFPB employee, contractor, or consultant when the disclosure of such confidential information to that employee, contractor, or consultant is not relevant to the performance of the employee's, contractor's, or consultant's assigned duties.

(b) Disclosures to contractors and consultants. CFPB contractors or consultants must treat confidential information in accordance with this part, other Federal laws and regulations that apply to Federal agencies for the protection of the confidentiality of personally identifiable information and for data security and integrity, as well as any additional conditions or limitations that the CFPB may impose. CFPB contractors or consultants may receive confidential information only if such contractors or consultants certify in writing to treat such confidential information in accordance with the requirements identified in this paragraph (b).

(c) Disclosure of materials derived from confidential information. The CFPB may, in its discretion, disclose materials that it derives from or creates using confidential information to the extent that such materials do not identify, either directly or indirectly, any particular person to whom the confidential information pertains.

(d) Disclosure of confidential information with consent. Where practicable, the CFPB may, in its discretion and in accordance with applicable law, disclose confidential information that directly or indirectly identifies particular persons if the CFPB obtains prior consent from such persons to make the disclosure.

(e) Nondisclosure of confidential information belonging to other agencies. Nothing in this subpart requires or authorizes the CFPB to disclose confidential information belonging to another agency that has been provided to the CFPB (either directly or through a holder of the information such as a financial institution) to the extent that such disclosure contravenes applicable law or the terms of any agreement that exists between the CFPB and the agency to govern the CFPB's treatment of information that the agency provides to the CFPB.

(a) Discretionary disclosure of confidential supervisory information or confidential investigative information by the CFPB. The CFPB may, in its discretion, and to the extent consistent with applicable law, disclose confidential supervisory information or confidential investigative information concerning a person or its service providers to that person or to its affiliates.

(b) Further disclosure of confidential supervisory information. Unless directed otherwise by the Associate Director for Supervision, Enforcement and Fair Lending:

(1) Any supervised financial institution lawfully in possession of confidential supervisory information of the CFPB provided directly to it by the CFPB pursuant to paragraph (a) of this section may disclose such information, or portions thereof, to its affiliates and to the following individuals to the extent that the disclosure of such confidential supervisory information is relevant to the performance of such individuals' assigned duties:

(i) Its directors, officers, trustees, members, general partners, or employees; and

(ii) The directors, officers, trustees, members, general partners, or employees of its affiliates.

(2) Any supervised financial institution or affiliate thereof that is lawfully in possession of confidential supervisory information of the CFPB provided directly to it by the CFPB pursuant to paragraph (a) of this section may disclose such information, or portions thereof, to:

(i) Its certified public accountant, legal counsel, contractor, consultant, or service provider;

(ii) Its insurance provider pursuant to a claim made under an existing policy, provided that the Bureau has not precluded indemnification or reimbursement for the claim; information disclosed pursuant to this paragraph (b)(2)(ii) may be used by the insurance provider solely for purposes of administering such a claim; or

(iii) Another person, with the prior written approval of the Associate Director for Supervision, Enforcement and Fair Lending.

(3) Where a supervised financial institution or its affiliate discloses confidential supervisory information of the CFPB pursuant to paragraph (b) of this section:

(i) The recipient of such confidential supervisory information shall not, without the prior written approval of the Associate Director for Supervision, Enforcement and Fair Lending, utilize, make, or retain copies of, or disclose confidential supervisory information for any purpose, except as is necessary to provide advice or services to the supervised financial institution or its affiliate; and

(ii) The supervised financial institution or its affiliate disclosing the confidential supervisory information shall take reasonable steps to ensure that the recipient complies with paragraph (b)(3)(i) of this section.

(4) Nothing in this paragraph (b) authorizes a supervised financial institution or affiliate thereof to further disclose confidential information belonging to another agency.

(c) Further disclosure of confidential investigative information. Nothing in this subpart shall prohibit any person lawfully in possession of confidential investigative information of the CFPB pursuant to paragraph (a) of this section from further disclosing that confidential investigative information.

(a) Required disclosure of confidential information to agencies. The CFPB shall:

(1) Disclose a draft of a report of examination of a supervised financial institution prior to its finalization, as provided in 12 U.S.C. 5515(e)(1)(C), and disclose a final report of examination, including any and all revisions made to such a report, as provided in 12 U.S.C. 5512(c)(6)(C)(i), to a Federal or State agency with jurisdiction over that supervised financial institution, provided that the CFPB receives from the agency reasonable assurances as to the confidentiality of the information disclosed; and

(2) Disclose confidential consumer complaint information to a Federal or State agency to facilitate preparation of reports to Congress required by 12 U.S.C. 5493(b)(3)(C) and to facilitate the CFPB's supervision and enforcement activities and its monitoring of the market for consumer financial products and services, provided that the agency shall first give written assurance to the CFPB that it will maintain such information in confidence, including in a manner that conforms to the standards that apply to Federal agencies for the protection of the confidentiality of personally identifiable information and for data security and integrity.

(b) Discretionary disclosure of confidential information to agencies. (1) Upon receipt of a written request that contains the information required by paragraph (b)(2) of this section, the CFPB may, in its discretion, disclose confidential information to a Federal or State agency to the extent that the disclosure of the information is relevant to the exercise of the agency's statutory or regulatory authority or, with respect to the disclosure of confidential supervisory information, to a Federal or State agency having jurisdiction over a supervised financial institution.

(2) To obtain access to confidential information pursuant to paragraph (b)(1) of this section, an authorized officer or employee of the agency shall submit a written request to the Director. The request shall include the following:

(i) A description of the particular information, kinds of information, and where possible, the particular documents to which access is sought;

(ii) A statement of the purpose for which the information will be used;

(iii) A statement certifying and identifying, as required by paragraph (b)(1) of this section, the agency's statutory or regulatory authority that is relevant to the requested information or, with respect to a request for confidential supervisory information, the agency's jurisdiction over a supervised financial institution;

(iv) A statement certifying and identifying the agency's legal authority for protecting the requested information from public disclosure; and

(v) A certification that the agency will maintain the requested confidential information in confidence, including in a manner that conforms to the standards that apply to Federal agencies for the protection of the confidentiality of personally identifiable information and for data security and integrity, as well as any additional conditions or limitations that the CFPB may impose.

(c) Negotiation of standing requests. The CFPB may negotiate terms governing the exchange of confidential information with Federal or State agencies on a standing basis, as appropriate.

The CFPB may, to the extent permitted by law, disclose confidential consumer complaint information as it deems necessary to investigate, resolve, or otherwise respond to consumer complaints or inquiries concerning consumer financial products and services or a violation of Federal consumer financial law.

(a) The CFPB may disclose confidential information, in accordance with applicable law, as follows:

(1) To a CFPB employee, as that term is defined in § 1070.2 and in accordance with § 1070.41;

(2) To either House of the Congress or to an appropriate committee or subcommittee of the Congress, as set forth in 12 U.S.C. 5562(d)(2), provided that, upon the receipt by the CFPB of a request from the Congress for confidential information that a financial institution submitted to the CFPB along with a claim that such information consists of a trade secret or privileged or confidential commercial or financial information, or confidential supervisory information, the CFPB shall notify the financial institution in writing of its receipt of the request and provide the institution with a copy of the request;

(3) In investigational hearings and witness interviews, or otherwise in the investigation and administration of enforcement actions, as is reasonably necessary, at the discretion of the CFPB;

(4) In an administrative or court proceeding to which the CFPB is a party. In the case of confidential investigative information that contains any trade secret or privileged or confidential commercial or financial information, as claimed by designation by the submitter of such material, or confidential supervisory information, the submitter, or the CFPB, in its discretion, may seek an appropriate order prior to disclosure of such material in a proceeding;

(5) In CFPB personnel matters, as necessary and subject to appropriate protections;

(6) To agencies in summary form to the extent necessary to confer with such agencies about matters relevant to the exercise of the agencies' statutory or regulatory authority; or

(7) As required under any other applicable law.

(b) [Reserved]

(a) To the extent permitted by law and as authorized by the Director in writing, the CFPB may disclose confidential information other than as set forth in this subpart.

(b) Prior to disclosing confidential information pursuant to paragraph (a) of this section, the CFPB may, as it deems appropriate under the circumstances, provide written notice to the person to whom the confidential information pertains that the CFPB intends to disclose its confidential information in accordance with this section.

(c) The authority of the Director to disclose confidential information pursuant to paragraph (a) of this section shall not be delegated. However, a person authorized to perform the functions of the Director in accordance with law may exercise the authority of the Director as set forth in this section.

(a) Further disclosure prohibited. (1) All confidential information made available under this subpart shall remain the property of the CFPB, unless the General Counsel provides otherwise in writing.

(2) Except as set forth in this subpart, no supervised financial institution, Federal or State agency, any officer, director, employee or agent thereof, or any other person to whom the confidential information is made available under this subpart, may further disclose such confidential information without the prior written permission of the Director.

(3) No person obtaining access to confidential information pursuant to this subpart may make a personal copy of any such information, and no person may remove confidential information from the premises of the institution or agency in possession of such information except as permitted under this subpart or by the CFPB.

(b) Third party requests for information. (1) A supervised financial institution, Federal or State agency, any officer, director, employee or agent thereof, or any other person to whom the CFPB's confidential information is made available under this subpart, that receives from a third party a legally enforceable demand or request for such confidential information (including but not limited to, a subpoena or discovery request or a request made pursuant to the Freedom of Information Act, 5 U.S.C. 552, the Privacy Act of 1974, 5 U.S.C. 552a, or any State analogue to such statutes) should:

(i) Inform the General Counsel of such request or demand in writing and provide the General Counsel with a copy of such request or demand as soon as practicable after receiving it;

(ii) To the extent permitted by applicable law, advise the requester that:

(A) The confidential information sought may not be disclosed insofar as it is the property of the CFPB; and

(B) Any request for the disclosure of such confidential information is properly directed to the CFPB pursuant to its regulations set forth in this subpart; and

(iii) Consult with the General Counsel before complying with the request or demand, and to the extent applicable:

(A) Give the CFPB a reasonable opportunity to respond to the demand or request;

(B) Assert all reasonable and appropriate legal exemptions or privileges that the CFPB may request be asserted on its behalf; and

(C) Consent to a motion by the CFPB to intervene in any action for the purpose of asserting and preserving any claims of confidentiality with respect to any confidential information.

(2) Nothing in this section shall prevent a supervised financial institution, Federal or State agency, any officer, director, employee or agent thereof, or any other person to whom the information is made available under this subpart from complying with a legally valid and enforceable order of a court of competent jurisdiction compelling production of the CFPB's confidential information, or, if compliance is deemed compulsory, with a request or demand from either House of the Congress or a duly authorized committee of the Congress. To the extent that compulsory disclosure of confidential information occurs as set forth in this paragraph (b)(2), the producing party shall use its best efforts to ensure that the requestor secures an appropriate protective order or, if the requestor is a legislative body, use its best efforts to obtain the commitment or agreement of the legislative body that it will maintain the confidentiality of the confidential information.

(c) Additional conditions and limitations. The CFPB may impose any additional conditions or limitations on disclosure or use under this subpart that it determines are necessary.

(d) Return or destruction of records. Except with respect to confidential investigative information disclosed pursuant to § 1070.42(a), the CFPB may require any person in possession of CFPB confidential information to return the records to the CFPB or destroy them.

(e) Non-waiver of CFPB rights. Except as provided in § 1070.42(c), the disclosure of confidential information to any person in accordance with this subpart does not constitute a waiver by the CFPB of its right to control, or impose limitations on, the subsequent use and dissemination of the information.

(f) Non-waiver of privilege—(1) In general. The CFPB shall not be deemed to have waived any privilege applicable to any information by transferring that information to, or permitting that information to be used by, any Federal or State agency.

(2) Rule of construction. Paragraph (f)(1) of this section shall not be construed as implying that any person waives any privilege applicable to any information because paragraph (f)(1) of this section does not apply to the transfer or use of that information.

(g) Reports of unauthorized disclosure. Any person that obtains confidential information under this subpart shall, as soon as possible and without unreasonable delay, notify the CFPB upon the discovery of any further disclosures made in violation of this subpart.

Nothing in this subpart shall limit the discretion of the Office of the Inspector General of the Board of Governors of the Federal Reserve System and the Consumer Financial Protection Bureau to disclose confidential information as needed in accordance with the Inspector General Act of 1978, 5 U.S.C. App. 3.