March 25, 2013 -- On March 18th, the Consumer Financial Protection Bureau's final rule on Disclosure of Records and Information ("the Rule") became effective.

The Rule establishes procedures for obtaining information from the CFPB under the Federal Freedom of Information Act ("FOIA"), the Privacy Act of 1974 ("the Privacy Act"), and in legal proceedings. It also establishes the CFPB's rules for treatment and disclosure of confidential consumer complaint, investigative and supervisory information, as well as CFPB information that may be exempt from disclosure under 522(b) of FOIA (which exempts from its scope, inter alia, confidential trade secrets and other confidential commercial or financial information).

Part B of the Rule implements FOIA. It is to be read together with Part E, which implements the Privacy Act, and applies only to CFPB records concerning individuals that are retrievable by an individual's name or other personally identifiable information. Excluding such individual information, Part B provides that subject to the exemptions and exclusions under §522(b) and (c) of FOIA, the CFPB generally "shall promptly make its records available to any person pursuant to a request that conforms to the Rule's procedures."

Thus, excluding records concerning individuals, Part B grants the public an enforceable right to access CFPB records absent FOIA's statutory exemptions or exclusions. Part B also gives the CFPB the right to make discretionary disclosures and to elect not to apply a FOIA exemption, "if not otherwise precluded by law" if, in processing a particular request, the Bureau "finds no necessity of applying the exemption."

In addition, Part B imposes an affirmative duty upon corporations and other entities from whom the CFPB obtains business information ("Submitters"), to designate, "at the time of submission or at a reasonable time thereafter," any information that the Submitter considers protected from disclosure under the FOIA exemption for confidential trade secrets and commercial and financial information.

If a Submitter of business information has designated documents as entitled to the FOIA exemption, or the CFPB has reason to believe the information is entitled to such protection, the CFPB must notify the Submitter on receipt of a request encompassing that information and afford the Submitter 10 days to provide a detailed basis for its objection to disclosure. Any objection must specify all grounds for withholding the information under FOIA. However, the CFPB may overrule the Submitter's objections and nevertheless disclose the documents 10 days after notifying the objecting Submitter that its objections have been overruled and the information will be disclosed. The Submitter's sole remedy at that point is to sue to enjoin disclosure of the information in Federal court within the 10 day period. The CFPB is also not required to give any notice of receipt of a request for the Submitter's information if it determines a designation is "obviously frivolous," or if the disclosure is required by statute.

Thus, the regulation gives the CFPB authority to elect not to apply FOIA exemptions, and in addition, to overrule Submitters' objections to disclosure of their business information. Moreover, if the Submitter did not designate its information as exempt from disclosure under FOIA at the time of submission, then, unless the CFPB independently determines the information is exempt, the entity which provided the information is not entitled to notice that a request for its information as been received.

The full text of the Rule may be found here: https://www.federalregister.gov/articles/2013/02/15/2013-01737/disclosure-of-records-and-information