A joint resolution providing for congressional disapproval under chapter 8 of title 5, United States Code, of the rule submitted by the Bureau of Consumer Financial Protection relating to the withdrawal of the rule relating to "Consumer Financial Protection Circular 2022-04: Insufficient Data Protection or Security for Sensitive Consumer Information".

Key Points

• This resolution uses the Congressional Review Act to block the CFPB from withdrawing its 2022 circular on consumer data protection. If passed, the withdrawal would have no legal force, meaning the original data security guidance would remain in effect.
• The original 2022 circular established that companies failing to adequately protect sensitive consumer data were violating federal consumer protection law. The CFPB moved to withdraw that circular in May 2025, and this resolution aims to reverse that withdrawal.
• Sen. Rosen of Nevada introduced the resolution, which has been referred to the Senate Committee on Banking, Housing, and Urban Affairs. As a Congressional Review Act resolution, it would need to pass both chambers and be signed by the president to take effect.
• If enacted, banks and financial companies would continue to face potential enforcement action for failing to protect sensitive consumer information like Social Security numbers, bank account details, and other personal data. This is meant to help prevent data breaches and identity theft.