Consumer Financial Protection Circular 2022-04: Insufficient Data Protection or Security for Sensitive Consumer Information

The Consumer Financial Protection Bureau (Bureau or CFPB) has issued Consumer Financial Protection Circular 2022-04, titled, "Insufficient Data Protection or Security for Sensitive Consumer Information." In this circular, the Bureau responds to the question, "Can entities violate the prohibition on unfair acts or practices in the Consumer Financial Protection Act (CFPA) when they have insufficient data protection or information security?"