WASHINGTON — Sen. Elizabeth Warren, D-Mass., is asking acting Consumer Financial Protection Bureau Director Mick Mulvaney to account for recent directives limiting agency staff members’ ability to access or acquire electronic data, saying the moves hamper critical agency operations.
“The CFPB cannot fulfill its core functions without collecting personally identifiable information,” Warren said in a Jan. 4 letter to Mulvaney. “Given how integral these data are to these basic CFPB functions, I fear that the freeze in data collection has in practice fundamentally changed how the CFPB interacts with its regulated entities, particularly in the Division of Supervision, Enforcement and Fair Lending. My staff has obtained internal CFPB documents that confirm these fears.”
At issue are a handful of directives issued by Mulvaney and his support staff soon after President Trump tapped him to lead the bureau on an interim basis following the resignation of former director Richard Cordray on Nov. 24. On Dec. 4, Mulvaney told staff not to collect any personally identifiable data, citing data security shortcomings described in a pair of reports by the Federal Reserve and the CFPB inspector general (both agencies share a single inspector general).
Warren said that an email sent by Paul Sanford, the CFPB's assistant director for supervision and examinations, on Dec. 4 told bank examiners not to send “any type of information request or a monitoring request … until we issue additional guidance.” Warren — citing “several sources” — also said that the data collection freeze has prevented agency lawyers from “reviewing electronic evidence they obtain in discovery.”
The data freeze effectively prevents CFPB staff from carrying out their duties, Warren said, and vastly exceeds any data security concerns that may have been cited by the Inspector General.
“Director Mulvaney claims that the cybersecurity issues at the agency are so serious that it justifies ignoring congressional mandates, but the IG reports on which he bases his claims demonstrate that the agency's cybersecurity policies are robust and any problems with them are not nearly serious enough to support the action Director Mulvaney has taken,” Warren said. “In any case, the IG did not recommend halting the collection of data as a result of his findings.”
Warren’s letter includes a series of questions — including why the data freeze was considered necessary, which members of the CFPB staff were consulted, and what the observed effect of the freeze has been among supervision and enforcement staff — for Mulvaney to answer by Jan. 19. The letter also requested a staff briefing by no later than Jan. 12.
Mulvaney's leadership at the CFPB has been eventful.
Cordray had designated Deputy Director Leandra English to be acting director after he resigned based on a succession clause in the CFPB's organizing statute. But the White House cited the president's authority under the Federal Vacancies Reform Act of 1998 to name an acting head of an agency, and tapped Mulvaney — who was already serving as White House Office of Management and Budget director — to fill the role.
English sued the White House for the job, and a federal judge named Mulvaney the rightful director until a formal ruling on the matter is decided. In the meantime, Mulvaney has frozen or rolled back several pending rules and assigned political operatives to oversee the work of career staff.