CFPB Circular 2022-04 Consumer Data Protection (Congressional Review)

Current understanding

A joint resolution has been introduced under the Congressional Review Act (chapter 8 of title 5) to disapprove the Bureau of Consumer Financial Protection’s rule withdrawing Consumer Financial Protection Circular 2022-04, which had addressed insufficient data protection or security for sensitive consumer information as a potential UDAAP concern. If enacted, the disapproval would nullify the withdrawal, effectively restoring the circular’s guidance that inadequate data security practices by covered financial entities can constitute an unfair act or practice. Status: introduced; passage would reinstate agency-level expectations on data-security safeguards for consumer financial data.

Evidence log

• 2026-05-13 — A joint resolution providing for congressional disapproval under chapter 8 of title 5, United States Code, of the rule submitted by the Bureau of Consumer Financial Protection relating to the withdrawal of the rule relating to “Fair Credit Reporting; Background Screening”.: cross-connection with sjres133-cfpb-background-screening-rule-withdrawal: Both are Congressional Review Act actions targeting CFPB consumer-data instruments; this one addresses an FCRA background-screening rule withdrawal. (novelty: 2)
• 2026-05-11 — Providing for congressional disapproval under chapter 8 of title 5, United States Code, of the rule submitted by the Bureau of Consumer Financial Protection relating to the withdrawal of the rule relating to “Consumer Financial Protection Circular 2022-07: Reasonable Investigation of Consumer Reporting Disputes”.: 2026-04 — Companion CRA disapproval resolution introduced targeting the CFPB’s withdrawal of Circular 2022-07 (reasonable investigation of consumer reporting disputes), indicating a broader congressional pattern of contesting CFPB rescissions of 2022-era consumer-data circulars. (novelty: 2)
• 2026-04-13 — A joint resolution providing for congressional disapproval under chapter 8 of title 5, United States Code, of the rule submitted by the Bureau of Consumer Financial Protection relating to the withdrawal of the rule relating to “Consumer Financial Protection Circular 2022-04: Insufficient Data Protection or Security for Sensitive Consumer Information”.: cross-connection with servicemember-payment-data-privacy: Both address data security obligations for entities handling consumer financial data, with the CRA resolution operating at the general UDAAP-guidance level while HR8787 targets a specific servicemember population. (novelty: 2)

Open questions

Related