Comment from Anonymous

I submit this comment as a current CFPB employee in response to the Bureau’s proposed addition of Routine Use (18) to the “CFPB.009-Employee Administrative Records System,” published at 91 FR 29464 (May 20, 2026), Docket Number CFPB-2026-0016. I urge the Bureau to withdraw this routine use or substantially revise it before it goes into effect. 1. The routine use will chill protected speech and whistleblowing. I have spoken to the press about working conditions at the Bureau as part of my union-protected right, and I am afraid that this change will allow the Bureau to retaliate against me. Employees like me who report misconduct, file EEO complaints, or otherwise engage in legally protected activity may reasonably fear that their personnel records could later be disclosed to “demonstrate the accountability of individuals covered by this system.” A standard this broad gives the Bureau discretion to release personnel information about an employee at the center of a controversy — including one who blew the whistle on the Bureau itself or on a supervisor. Even if never invoked against a particular employee, the mere possibility predictably discourages employees from coming forward. 2. Employees receive no advance notice and have no real recourse. The routine use contains no requirement that the affected employee be notified before disclosure, let alone given an opportunity to object. By the time an employee could file suit under the Privacy Act, the information would already be in the public domain, which could mean irreversible reputational harm. A damages action after the fact does not restore privacy that has already been lost. 3. The routine use is inconsistent with the Privacy Act’s purpose-compatibility requirement. Records in this system were collected for human capital administration — payroll, benefits, leave, retirement, and similar functions. Disclosure to the news media for the purpose of “preserving confidence in the integrity of the Bureau” is not compatible with the purpose for which the information was originally collected, as required under 5 U.S.C. 552a(a)(7) and (b)(3). The Bureau’s invocation of the FOIA “clearly unwarranted invasion of personal privacy” balancing test does not cure this defect; FOIA governs requester-initiated access to existing records, not agency-initiated routine uses that must independently satisfy the Privacy Act’s compatibility standard. 4. FOIA standard is referenced but not actually incorporated. The notice invokes the FOIA “clearly unwarranted invasion of personal privacy” standard but does not state that the extensive body of FOIA caselaw and DOJ guidance interpreting that phrase will limit the Bureau's application. Without express incorporation, the phrase is reduced to a bare label without any binding precedent constraining the Bureau's discretion. The Bureau should either expressly incorporate the FOIA caselaw and DOJ guidance as binding interpretive authority for this routine use, or explain what standard will govern in its absence. 5. “Legitimate public interest” is impermissibly vague and overbroad. The two examples given — preserving “confidence in the integrity of the Bureau” and demonstrating “accountability” — are not limiting principles; they could justify disclosure in almost any circumstance an agency wished to defend its own conduct or distance itself from an employee. The notice provides no definition, no list of factors, and no examples of what would not qualify. This leaves employees unable to anticipate what conduct might trigger disclosure, and leaves the public with no meaningful check on the Bureau’s exercise of discretion. 5. The routine use is inconsistent with governing privacy guidance. OMB Circular A-108 and the Fair Information Practice Principles call for transparency, purpose specification, use limitation, and individual participation in decisions affecting one’s own records. A routine use authorizing public disclosure with no employee notice, no defined criteria, and no opportunity to be heard runs counter to each of these principles. 6. The SORN timeline itself undermines meaningful public participation. Comments due date and the routine use effective date are on the same day. Allowing the comment period to close and the policy to take effect simultaneously affords the Bureau no realistic opportunity to consider public input before implementation, contrary to the spirit of the Privacy Act’s public comment requirement. For these reasons, I respectfully request that the Bureau withdraw proposed Routine Use (18), or, at minimum, delay its effective date, add a requirement of advance notice to the affected employee, implement a procedure for employees to object to the disclosure, incorporate FOIA caselaw and DOJ guidance on FOIA, and define “legitimate public interest” with specific, narrowing criteria before any disclosures occur.