U.S. agency monitoring millions of Americans' financial records, Rep. Sean Duffy says

Seizing on revelations that the National Security Agency has been scooping up the phone and Internet communications of ordinary Americans, U.S. Rep. Sean Duffy, R-Wis., is sounding new alarms about citizen surveillance by another, relatively new government agency.

In a July 17, 2013 interview on "Opinion Journal," a Wall Street Journal online show, he invoked the National Security Agency in making his attack on the Consumer Financial Protection Bureau.

"The CFPB is collecting financial information, monitoring financial information, of millions of Americans, and they have no clue that it’s going on. It’s again this NSA push of having more information on more Americans," Duffy said.

He added:

"We know in politics, oftentimes people will sample data, to see what the president’s approval rating is or disapproval rating is. The CFPB could do the same thing to find out information about financial transactions. But instead of sampling data, they’re actually collecting it and storing it for up to 10 years. This is absolutely crazy."

So, Duffy’s claim is that the Consumer Financial Protection Bureau collects and monitors financial information of millions of Americans, without their knowledge, and stores it for up to 10 years -- the implication being that bureau is keeping data on individuals’ personal accounts.

Let's do some information gathering of our own.

What CFPB does

The Consumer Financial Protection Bureau, which launched in July 2011, is charged with protecting consumers from abusive practices in financial services and regulating the terms of mortgages, student loans, credit cards and other transactions.

"We gather and analyze available information to better understand consumers, financial services providers and consumer financial markets," the bureau says.

For example, a bureau report in June 2013 found that overdraft penalties represent well over half of banks' fees from consumer checking accounts,

The law creating the bureau prohibits it from collecting data "for purposes of gathering or analyzing the personally identifiable financial information of consumers."

But that doesn’t personally identifiable information isn’t being collected.

A disclosure

Suspicion about the bureau’s work ratcheted up in April 2013 when Bloomberg News reported it was demanding records from banks and was buying anonymous information about at least 10 million consumers from various companies.

The article said the bureau was paying the Experian credit-monitoring company up to $8.4 million to provide data on 5 million to 10 million consumers. The bureau was also buying auto loan information from the company and payday loan data from another credit-reporting company, the article said.

Duffy spokeswoman Cassie Smedile also pointed out that the bureau’s April 2013 strategic plan says the bureau will "acquire and maintain a credit card database at the summary and loan levels covering approximately 80 percent of the credit card marketplace."

So, the first part of Duffy’s claim is accurate. The Consumer Financial Protection Bureau is obtaining from third parties financial data involving millions of Americans without any direct notification from the bureau to consumers.

But what about the rest of Duffy’s message, which suggests the bureau keeps financial data on actual individuals, monitors it and stores it for up to 10 years?

Bureau makes its case

A week before Duffy made his claim, the House Subcommittee on Financial Institutions and Consumer Credit held a hearing specifically to examine how the Consumer Financial Protection Bureau collects and uses consumer data.  Duffy is a member of the committee.

The bureau’s acting deputy director, Stephen Antonakes, testified that the bureau’s data collection on individuals is very limited.

Featured Fact-check

Derrick Van Orden

stated on April 1, 2024 in X, formerly Twitter

You can vote in-person absentee at your clerk’s office on Monday before Election Day.

The bureau collects personally identifiable information only when consumers are seeking help with a complaint against a business, he said, or when "we're using our supervisory tool, conducting examinations of the banks, the credit unions and the nonbanks under our jurisdiction."

When Duffy asked about news indicating the bureau was buying information about at least 10 million consumers, Antonakes replied: "Congressman, we're not monitoring any individual American. We're collecting broad data on markets to understand how varied markets work."

At the same time, Antonakes said he didn’t know how many millions of Americans were involved in the data the bureau has collected. And he said the bureau needs years’ worth of complete data, not a sampling of data like pollsters might use, to do its work.

Duffy’s evidence

We asked Duffy’s spokeswoman for evidence that the Consumer Financial Protection Bureau was monitoring data on individual Americans and storing it for up to 10 years.

She cited a July 2013 lawsuit filed against the bureau by a firm that says it is fighting the bureau’s demand for "thousands of personally identifiable" financial documents of individuals considering bankruptcy. The documents contain data such as names, addresses, phone numbers, amount of debt owed and creditor information, the firm alleges in a news release in which Duffy is quoted.

Duffy’s spokeswoman also cited a contract -- revealed by the Judicial Watch conservative group, which litigates on public corruption and other issues -- that the Consumer Financial Protection Bureau has with a firm to store and analyze credit card information.

The firm can get access to "non-public confidential information and personally identifiable information," the contract says, although the firm is barred from disclosing any of the data to any third party without permission from the bureau. The contract also states that "most if not all" of the data the firm will handle will be "confidential supervisory information," but that some records will contain sensitive, personally identifiable information.

Judicial Watch has published documents from the Consumer Financial Protection Bureau showing the bureau wants to track the financial records of 5 million Americans.

The bureau acknowledged the program and said all data collected is "anonymized," according to a U.S. News & World Report article.

Other evidence

We put Duffy’s claim to Bradley Jansen, director of the Center for Financial Privacy and Human Rights in Washington, D.C., which says it defends privacy, civil liberties and market economics, and Florida attorney Justin Angelo, who represents banks and other businesses that are regulated by the Consumer Financial Protection Bureau.

They agreed the bureau has collected and is monitoring financial data involving millions of Americans, but that’s not the same as monitoring the financial activity of individuals.

They also agreed it’s likely the bureau cannot collect all of the data it does without obtaining personally identifiable information in the process, even if the data is not being collected for that reason.

How the bureau is collecting data and safeguarding it will be the focus of a government audit.

On July 12, 2013, three days after the House subcommittee hearing on the bureau’s data collection practices, the U.S. Government Accountability Office agreed to review the bureau’s collection and analysis of credit records.

U.S. Sen. Mike Crapo, R-Idaho, who requested the review, says some of the bureau’s contracts  with third-party data collectors would enable the bureau to monitor an individual consumer’s financial activity on a monthly basis.

But Crapo has also said the GAO review is needed because it’s unclear what personally identifiable information is being kept by the bureau. He said: "While CFPB officials have stated the CFPB is not collecting personally identifiable information, we do not know what information it collects, on how many accounts, or how this information is being used. We also need to know whether the CFPB is truly not collecting personally identifiable information from the data it is collecting or purchasing."

It’s worth noting that when Crapo raised similar concerns two months earlier, bureau director Richard Cordray responded in part by saying that while the bureau is creating a national mortgage database with "loan-level" data, and had bought 10 years of credit data representing 4 percent of Americans, none of that data contains personally identifiable information.

Our rating

Invoking the surveillance activities of the National Security Agency, Duffy said the federal Consumer Financial Protection Bureau is "collecting financial information, monitoring financial information of millions of Americans" without their knowledge and "storing it for up to 10 years."

The implication was that bureau is keeping data on millions of individuals’ personal accounts.

The bureau is collecting information, even 10 years’ worth of some data, involving millions of Americans. That’s being done through third parties without consumers’ knowledge

But even a critic who has made claims similar to Duffy’s, in asking for a review of the bureau, says he doesn’t know what information the bureau collects and whether it contains personally identifiable information.

For a statement that is partially accurate but leaves out important details, we give Duffy a Half True.