WASHINGTON—BCFP Acting Director Mick Mulvaney announced the Bureau will begin collecting personally identifiable information after a six-month hold on the practice.
Mulvaney put the hold in place because of what he said were cybersecurity concerns.
Mulvaney, in an email to staff last week, said that an independent review by outside experts revealed "externally facing Bureau systems appear to be well-secured." During a Senate Banking Committee hearing in April, Mulvaney had noted a large number of lapses (not necessarily breaches) where sensitive information from the Bureau was released. He also indicated that the BCFP will release a report soon regarding its data collection.
The BCFP's strategic plan for 2018-2022 included an objective to "safeguard the Bureau's information and systems" by maintaining a strong cybersecurity program and bringing its IT investments in line with federal security standards and priorities, NAFCU noted in its analysis.
In a letter to Mulvaney in January, NAFCU President and CEO Dan Berger applauded the Bureau "for initiating a thorough review of the CFPB's data security systems and freezing collection of personally identifiable information until weaknesses are addressed."
"NAFCU hopes that the CFPB's renewed commitment to strengthening its data security will address these problems and mitigate privacy risks associated with the unprecedented scope of [Home Mortgage Disclosure Act (HMDA)] data collection," Berger wrote.