by Jeff Sovern
Yesterday I expressed doubt about whether it matters if the CFPB backs off on investigating Equifax. Now I'm wondering if I was wrong to do so. I hadn't given enough thought to the CFPB's supervisory responsibilities over collection bureaus. Vox has an article which reports:
A CFPB spokesperson said in an email to Vox that the bureau is authorized to take “supervisory and enforcement action against certain institutions engaged in unfair, deceptive, or abusive acts or practices, or that otherwise violate federal consumer financial laws,” including the failure of institutions to engage in “reasonable data security practices” in connection with consumer report information. “As noted previously, the bureau is looking into Equifax’s data breach and response,” the spokesperson said. “Reports to the contrary are incorrect. The bureau cannot comment further at this time.”
I believe the CFPB is the only federal agency with supervisory responsibility over credit bureaus (the FTC, which is also investigating, has enforcement powers), so a CFPB investigation may make sense in terms of, among other things, helping the Bureau figure out how to supervise credit bureaus going forward. But now it appears that the CFPB is denying that it has stopped investigating the Equifax breach; the statement just quoted above says that the Bureau is looking into the breach. Kate Berry at the American Banker has suggested that the Bureau is simply taking a backseat to the FTC, the lead investigator, and that it may in fact be coordinating with the FTC rather than abandoning its investigation. Unfortunately, because Interim Director Mulvaney has backed off of protecting consumers in other matters, claims that he has done so here as well are completely plausible.
