H.J.Res. 179119th CongressIntroduced May 7, 2026

Providing for congressional disapproval under chapter 8 of title 5, United States Code, of the rule submitted by the Bureau of Consumer Financial Protection relating to the withdrawal of the rule relating to "Consumer Financial Protection Circular 2022-04: Insufficient Data Protection or Security for Sensitive Consumer Information".

IntroducedFinance and Financial SectorSubstantive

Sponsor: Rep. Waters, Maxine [D-CA-43]
Committees: Financial Services Committee (primary)
Last action: May 7, 2026

Bottom line

This resolution seeks to reverse a CFPB decision to withdraw guidance on consumer data protection, aiming to reinforce data security requirements for financial institutions.

What it actually does

This joint resolution utilizes the Congressional Review Act (CRA) to disapprove a specific rule issued by the Bureau of Consumer Financial Protection (CFPB) on May 12, 2025. The CFPB's rule had previously withdrawn "Consumer Financial Protection Circular 2022-04: Insufficient Data Protection or Security for Sensitive Consumer Information." By disapproving this withdrawal rule, the resolution aims to nullify the CFPB's action, thereby effectively reinstating or maintaining the force of the original Circular 2022-04, which provides guidance on data protection for sensitive consumer information.

Proponents argue

Supporters of this resolution argue that robust data protection standards are critical for safeguarding consumers from financial fraud and identity theft. They contend that the CFPB's original Circular 2022-04 provided necessary clarity and enforcement mechanisms to ensure financial institutions adequately protect sensitive information. Disapproving the withdrawal would reaffirm Congress's commitment to consumer privacy and hold financial entities accountable for data breaches, preventing potential harm to millions of Americans.

Opponents contend

Opponents of this resolution, or those who supported the CFPB's withdrawal rule, might argue that Circular 2022-04 imposed overly burdensome or unclear compliance requirements on financial institutions, potentially stifling innovation or increasing operational costs without a commensurate benefit to consumer protection. They may contend that the CFPB's withdrawal was a necessary step to reduce regulatory burden or to allow for more flexible, risk-based approaches to data security that are better suited to evolving technological landscapes.

The bill text is extremely short and straightforward, allowing for quick comprehension.

Section 1

Congressional Disapproval of CFPB Rule on Circular Withdrawal

prominently featuredstraightforward

This provision states that Congress disapproves the rule submitted by the Bureau of Consumer Financial Protection (CFPB) on May 12, 2025, which concerned the withdrawal of "Consumer Financial Protection Circular 2022-04: Insufficient Data Protection or Security for Sensitive Consumer Information." As a result of this disapproval, the CFPB's withdrawal rule would have no legal effect, meaning the original Circular 2022-04 would effectively remain in force, requiring financial entities to maintain specific data protection standards for sensitive consumer information.

GroupImpactMechanismScale

GroupConsumersImpactIncreased data security and protection against fraud.MechanismFinancial institutions are required to adhere to CFPB guidance on data protection.ScaleBroad, affecting all consumers whose sensitive financial data is handled by regulated entities.

GroupFinancial Institutions (e.g., banks, credit unions, lenders)ImpactIncreased compliance burden and potential costs related to data security measures.MechanismReinstatement of CFPB Circular 2022-04's requirements for data protection.ScaleBroad, affecting all entities regulated by the CFPB.

GroupBureau of Consumer Financial Protection (CFPB)ImpactCongressional override of a regulatory decision, potentially impacting agency autonomy.MechanismUse of the Congressional Review Act to nullify a CFPB rule.ScaleSpecific to this regulatory action, but sets a precedent for CRA use.

Supporters argue

Supporters argue that this provision is essential to ensure financial institutions maintain high standards for protecting sensitive consumer data, thereby preventing breaches and safeguarding financial privacy. They believe the original circular provided crucial guidance that should not have been withdrawn.

Critics contend

Opponents (or those who supported the CFPB's withdrawal) might argue that this provision imposes unnecessary or overly prescriptive regulations on financial institutions, potentially hindering their ability to innovate or adapt to new security challenges. They may prefer a more flexible regulatory approach or believe the CFPB's withdrawal was justified.

Tradeoffs

The provision balances the desire for strong consumer data protection against concerns about regulatory burden and flexibility for financial institutions. It also highlights the tension between congressional oversight and agency regulatory discretion.

About this analysis. AI-Generated from the official bill text and available committee reports. Gaps in available data are noted explicitly. Verify important details with the official Congress.gov record.