News

April 25, 2023

Partner Lucy Morris comments for American Banker article on CFPB data breach

According to an article in American Banker, the Consumer Financial Protection Bureau has not yet notified 256,000 consumers, nearly two months after data was potentially compromised by a bank examiner with access to supervisory information and large-scale data collections. The article states the CFPB said it is still working with financial institutions to notify consumers about the Feb. 14 breach in which a now-former bank examiner sent supervisory information on 45 institutions, and personal identifiable information on 256,000 consumers at seven institutions to his personal email account.

Hudson Cook partner Lucy Morris, a former CFPB Deputy Enforcement Director, told American Banker, "Mistakes happen, and that's what institutions always tell the bureau, and so the table has been turned, Just like they expect companies to fully identify and remediate errors, they should do the same."

The bureau has strict rules around companies disclosing confidential supervisory information with financial institutions being required to get permission to disclose. Several experts said the bureau now has special insight into understanding what a company goes through when a typical breach occurs.

"The enormous amount of highly sensitive information that they ask for in exams and other sensitive information in other contexts, and the expectation that it will all be provided quickly and easily," Morris said. "And here they have their own problems."

She added that "companies always say they shouldn't be punished with UDAAP and law enforcement penalties, and now the bureau can see that for themself."

Subscribers to American Banker can read the full article here

About Lucy Morris

Lucy is a partner in the firm's Washington, DC office and a former Deputy Enforcement Director at the CFPB. Lucy counsels financial institutions and others in complying with federal consumer financial laws and prohibitions against unfair, deceptive, or abusive trade practices. She is an experienced advocate and litigator, representing clients in government investigations, examinations, and enforcement actions before federal and state agencies, including the CFPB, FTC, U.S. Department of Justice, and state AG offices.

Hudson Cook, LLP provides articles, webinars and other content on its website from time to time provided both by attorneys with Hudson Cook, LLP, and by other outside authors, for information purposes only. Hudson Cook, LLP does not warrant the accuracy or completeness of the content, and has no duty to correct or update information contained on its website. The views and opinions contained in the content provided on the Hudson Cook, LLP website do not constitute the views and opinion of the firm. Such content does not constitute legal advice from such authors or from Hudson Cook, LLP. For legal advice on a matter, one should seek the advice of counsel.