Much has been written recently about the change in leadership at the Consumer Financial Protection Bureau (CFPB), the ongoing litigation for control of the agency and the impact that new leadership will likely have on CFPB enforcement, supervision and rulemaking. In the midst of all of this excitement, a mundane district court opinion interpreting the Freedom of Information Act (FOIA) could have important implications for companies subject to the CFPB’s jurisdiction. In a rare case where industry, the old CFPB and the new CFPB share a common goal—maximum protection against disclosure of information provided by companies to the CFPB—the court issued a split decision. On the one hand, it held that information provided to the CFPB in response to a Civil Investigative Demand (CID) should be considered to have been produced under compulsion and thus more readily subject to disclosure in response to a FOIA request. At the same time, the court held that debt collectors subject to the CFPB’s supervision are entitled to the protections against disclosure of FOIA Exemption 8, a ruling whose logic should similarly apply to other nonbank entities subject to CFPB supervision.

On December 14, 2017, the federal district court in Washington DC issued an opinion in the case of Frank LLP v. CFPB. Frank LLP is a class action law firm that filed several FOIA requests with the CFPB concerning the CFPB’s enforcement action against debt collector Encore Capital Group, Inc. The ruling addressed the validity of two CFPB FOIA policies that concerned information provided to the CFPB (a) in response to CIDs and (b) by non-bank entities subject to the CFPB’s supervision. 

FOIA Protections for CID Material

On the first issue, the question before the court related to FOIA Exemption 4, which protects from disclosure “trade secrets and commercial or financial information obtained from a person [that is] privileged or confidential.”1 Companies routinely mark their productions in response to CIDs as FOIA exempt, relying in part on Exemption 4. The DC Circuit, however, has taken a bifurcated approach to Exemption 4, providing greater protection against disclosure for information that is produced to the government on a voluntary basis than that produced on a mandatory basis.2 The rationale for this rule is that greater protections will induce more voluntary cooperation with the government but that such inducement is not necessary where the government has compelled the production of the information at issue.

Accordingly, information provided voluntarily is considered “confidential” and shielded from disclosure under Exemption 4 if it “is of a kind that would customarily not be released to the public by the person from whom it was obtained.”3 Information provided pursuant to legal compulsion, by contrast, is considered “confidential” and shielded from disclosure only if its disclosure “would be likely either (1) to impair the Government’s ability to obtain necessary information in the future; or (2) to cause substantial harm to the competitive position of the person from whom the information was obtained.”4 

The CFPB policy at issue in the Frank case was to treat information produced in response to CIDs as voluntarily provided. Such a policy would support withholding information produced to the agency that is “of a kind that would customarily not be released to the public by the person from whom it was obtained.” That is a fairly broad rule that would protect most information produced in response to a CID.

CIDs are akin to administrative subpoenas and are not self-enforcing. That is, the agency cannot punish a failure to comply with a CID; it must instead seek a court order directing compliance. Relying on the non-self-executing nature of CIDs, the CFPB argued that information provided by CID recipients should be considered voluntarily provided. The court rejected this argument and held instead that CID productions should be considered compulsory because— assuming the CID seeks information “relevant to a violation” within the CFPB’s enforcement jurisdiction—production of the information ultimately could be compelled by the CFPB seeking a court order.

The implications of the court’s ruling are that Exemption 4 will serve to shield information provided in response to a CID only to the extent that the information constitutes a trade secret or if its disclosure “would be likely either (1) to impair the Government’s ability to obtain necessary information in the future; or (2) to cause substantial harm to the competitive position of the person from whom the information was obtained.” This is obviously a higher bar to meet than the “customarily not … released to the public” test that would otherwise apply.

The result of the court’s ruling is that companies in receipt of CIDs who might otherwise comply with CID requests that are questionable in nature might have additional incentives to push back and not produce the requested information for fear of its subsequent disclosure. While Exemption 4 is not the only potentially applicable exemption in cases seeking information produced to the CFPB in response to a CID,5 Exemption 4 is the one exemption that is focused on the confidential nature of the information from the perspective of the company. If it withstands judicial scrutiny, the ruling in Frank may make it harder for CID respondents to shield such information from third parties. And, unlike litigation where such information is often produced pursuant to a protective order prohibiting its further dissemination, there is no bar on a FOIA requester publicly disseminating information it receives from the government in response to a FOIA request. 

Alternatively, the ruling may prompt new CFPB leadership to be more open to proceed via truly voluntary production as opposed to CIDs. Such an approach, which could entail target companies conducting internal investigations and sharing the results with the CFPB, could save both the agency and respondents the substantial resources that come with the inherently inefficient CID process.

FOIA Protections for Non-Bank Supervised Entities

The other aspect of the Frank opinion should be welcome news to non-banks subject to the CFPB’s supervisory authority. Exemption 8 of the FOIA protects from disclosure information “contained in or related to examination, operating or condition reports prepared by, on behalf of, or for the use of an agency responsible for the regulation or supervision of financial institutions.”6 It traditionally has applied to prudential regulators who supervise depository institutions and has protected their examination reports and related materials from disclosure. While the CFPB indisputably regulates financial institutions, and thus would appear to fall within the confines of Exemption 8, the DC Circuit has suggested that Exemption 8 only applies to the examination of financial institutions.7 That is, the fact that an agency regulates some financial institutions does not necessarily mean that its examination reports of non-financial institutions would be exempt from disclosure under FOIA. 

Against this background, the Frank court was asked to determine whether the CFPB’s policy of interpreting Exemption 8 to apply to non-bank entities such as debt collectors that the CFPB supervises was appropriate. The court held that it was. Although the court noted that the primary purpose served by Exemption 8 was to “prevent runs on banks” in the event that adverse supervisory information was made public—a purpose entirely inapplicable to nondepository institutions such as debt collectors— the exemption was also intended to “encourage cooperation between financial institutions and their regulators.” The latter purpose, of course, does apply to non-depository institutions that are subject to CFPB supervision. With this background, the court held that “debt collectors – as a link in the credit-management chain – fit comfortably within [the] scope” of the term “financial institution” for purposes of Exemption 8.

Although the court’s holding is limited to debt collectors, it should apply equally to most if not all other non-depository institutions subject to the CFPB’s supervision. The Dodd-Frank Act provides the CFPB with supervisory authority only with respect to mortgage lenders and servicers, payday lenders, private student loan lenders and other “covered persons” as determined by the CFPB. The enumerated categories subject to supervision are readily seen as “a link in the credit-management chain” and would seem to readily qualify as “financial institutions.” The additional “covered persons” the CFPB can supervise are, by definition, only those who offer or provide a consumer financial product or service and thus are also likely to be deemed “financial institutions” under the logic of Frank. Put simply, if debt collectors are sufficiently “financial” to qualify for Exemption 8 protections, so too should most if not all industries that the CFPB does or could supervise. And that is good news for those entities, as Exemption 8 is “particularly broad” and should serve as a bulwark against disclosure of much of the information provided by supervised entities to the CFPB in the course of supervisory activities. 


Preventing the disclosure of information provided to the CFPB by companies subject to enforcement investigations or supervisory examinations may be one of the few issues on which old and new CFPB leadership—as well as industry—agree. Unfortunately, the Frank court’s opinion may make it harder for the CFPB to protect from disclosure information that has been provided to it in response to CIDs. That, in turn, may have an impact on how companies respond to CIDs. Or it may help prompt a new approach to enforcement investigations. At the same time, the court’s opinion suggests that supervised non-banks can feel relatively comfortable that the same FOIA protections that traditionally apply in the bank supervision context are likely to apply to them as well.