Attachment_5_CFPB_Privacy_Policy.pdf

DECEMBER 6, 2012

CFPB PRIVACY POLICY

Our Commitment to Privacy

2 OUR COMMITMENT TO PRIVACY, DECEMBER 6, 2012

The central mission of the Consumer Financial Protection Bureau (“CFPB” or “Bureau”) is to make markets for consumer financial products and services work for Americans—whether they are applying for a mortgage, choosing among credit cards, or using any number of other consumer financial products.

Markets cannot work for American consumers unless there is trust between consumers and the agency that works to protect them. Before we collect personally identifiable information (“PII”)1, we tell you what we are collecting, why we are collecting it, and how we are going to use it. We only collect the minimum amount of PII necessary to achieve the task, whether it is to advocate for you personally or to work on consumer issues broadly. We work to ensure that the PII we have about you is accurate, relevant, timely, and complete. We hold ourselves accountable for handling your PII appropriately and we train all of our employees to make sure they know how to ensure that your PII remains protected.

1 The Office of Management and Budget has defined “personally identifiable information” as “information which can be used to distinguish or trace an individual's identity, such as their name, social security number, biometric records, etc. alone, or when combined with other personal or identifying information which is linked or linkable to a specific individual, such as date and place of birth, mother’s maiden name, etc.” Office of Management and Budget, M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, May 22, 2007.

3 OUR COMMITMENT TO PRIVACY, DECEMBER 6, 2012

Our commitment to privacy At the CFPB, we have nine privacy principles that guide when and how we collect, use, share, and protect your PII:

Purpose of Collection: The CFPB will state the purpose and legal authority for collecting PII.

Openness and Transparency: The CFPB will tell you about the PII we collect from you, as well as how we will protect it, use it, and share it. We will provide an easy way for you to learn about what is happening to your PII.

Data Minimization: The CFPB will limit the collection of PII to what is needed to accomplish the stated purpose for its collection. The CFPB will keep

PII only as long as needed to fulfill its stated purpose.

Limits on Uses and Sharing of Information: The CFPB will provide notice about how we plan to use and share the PII that we collect from you. We will only use or share your PII in a manner compatible with the notice, as stated in the Privacy Act, or as explicitly mandated or authorized by law.

Data Quality and Integrity: The CFPB will make reasonable efforts to ensure that all PII it maintains is accurate, relevant, timely, and complete.

Security: The CFPB must protect PII from loss, unauthorized access or use, destruction, modification, or unintended or inappropriate disclosure.

Individual Participation: The CFPB will, in most cases, give you the ability to access your PII and allow you to correct or amend it if it is inaccurate.

Awareness and Training: The CFPB will train all Bureau employees about how to secure your information properly to ensure that it remains protected.

Accountability and Auditing: The CFPB will ensure accountability in the handling of your PII through strict policies and procedures communicated to all

Bureau employees. Independent auditors hold the Bureau accountable for complying with these policies and procedures. We also conduct our own internal audits to ensure that we are meeting our responsibilities, and take swift and immediate action if we uncover any violations of law or our policies or procedures.

4 OUR COMMITMENT TO PRIVACY, DECEMBER 6, 2012

What is a Chief Privacy Officer?

The CFPB’s Chief Privacy Officer (“CPO”) is the Bureau’s Senior Agency Official for Privacy, and is responsible for all of the CFPB’s privacy compliance and operational activities. The CPO evaluates the privacy implications of legislative, regulatory, and other policy proposals and ensures that the technology used by the CFPB upholds privacy protections. The CPO is responsible for ensuring that all employees are familiar with information privacy laws, regulations, policies, and procedures and understand the serious consequences and ramifications of inappropriate access, use, or disclosure of PII. The CPO ensures completion of

System of Records Notices (“SORN”), and Privacy Impact Assessments (“PIA”). The CPO is also responsible for ensuring that the CFPB only collects, uses, maintains, and disseminates Social

Security numbers when required to do so by statute or regulation.

Training CFPB employees The CFPB trains all employees to maintain strict confidentiality, protection, and respect for PII they encounter in the course of their duties.

The CPO provides specific training for all operational units that handle PII.

Limiting access to CFPB information The CFPB only allows access to PII to authorized individuals with a legitimate need for access.

CFPB employees will:

Only access PII as authorized and as needed to carry out official duties.

Disclose PII only as authorized by law.

5 OUR COMMITMENT TO PRIVACY, DECEMBER 6, 2012

Ensure that they protect and dispose of PII in accordance with applicable laws, regulations, and CFPB policies and procedures.

Only use PII for the purposes it was collected, unless other purposes are explicitly mandated or authorized by law.

Establish and maintain appropriate administrative, technical, and physical safeguards to protect PII.

CFPB system owners and managers will:

Meet all responsibilities for employees related to PII as outlined above.

Follow applicable laws, regulations, and CFPB policies and procedures in the development, implementation, and operation of information systems under their control.

Conduct a risk assessment to identify privacy risks and determine the appropriate security controls to protect against risk.

Ensure that only PII that is necessary and relevant for legally mandated or authorized purposes is collected.

Third parties

Third parties, such as banks or other government agencies that have access to information collected by the CFPB, shall comply with requirements of memoranda of understanding

(“MOUs”) drafted to address, among other matters, privacy issues.

6 OUR COMMITMENT TO PRIVACY, DECEMBER 6, 2012

For more information about CFPB’s privacy program You can learn more by visiting the CFPB’s privacy website, www.consumerfinance.gov/privacy-office or by contacting us directly.

Chief Privacy Officer

Consumer Financial Protection Bureau

1700 G St. NW

Washington DC 20552 privacy@cfpb.gov