Congress restores consumer data-protection rules CFPB had quietly withdrawn
H.J.Res. 179 — Providing for congressional disapproval under chapter 8 of title 5, United States Code, of the rule submitted by the Bureau of Consumer Financial Protection relating to the withdrawal of the rule relating to "Consumer Financial Protection Circular 2022-04: Insufficient Data Protection or Security for Sensitive Consumer Information". · Filed by Maxine Waters (D-CA) · Introduced May 7, 2026 · Referred to committee
Your members of Congress
Enter a ZIP to see where your representative and both senators stood on this bill.
Looked up on this device — your ZIP is never stored on our servers.
What it does
This resolution uses the Congressional Review Act to block a CFPB rule that withdrew a 2022 data-protection guidance. The net effect: disapproving the withdrawal restores the 2022 circular, requiring financial institutions to maintain adequate data security and protection for sensitive consumer information.
Why we flagged it
The bill's operative mechanism is a Congressional Review Act disapproval that restores a withdrawn CFPB data-security circular. It is a procedural instrument of regulatory restoration, not substantive rulemaking.
What the text implies
- Restoring the 2022 circular may trigger compliance costs for financial institutions, which could be passed to consumers through higher fees or reduced services—a secondary cost not apparent from the consumer-protection framing.
- The resolution does not specify whether the restored circular applies retroactively or prospectively, creating potential ambiguity in enforcement and liability for institutions that relied on the withdrawal.
The full analysis lists 3 implications of this text.
Who it affects
Restoring the 2022 data-protection circular strengthens consumer safeguards against inadequate data security by financial institutions. Citizens regain explicit regulatory protections for sensitive financial information that the CFPB had withdrawn.