(a) Non-disclosure. Except as required by law or as provided in this part, no current or former employee or contractor or consultant of the CFPB, or any other person in possession of confidential information, shall disclose such confidential information by any means (including written or oral communications) or in any format (including paper and electronic formats), to:

(1) Any person who is not an employee, contractor, or consultant of the CFPB; or

(2) Any CFPB employee, contractor, or consultant when the disclosure of such confidential information to that employee, contractor, or consultant is not relevant to the performance of the employee's, contractor's, or consultant's assigned duties.

(b) Disclosures to contractors and consultants. CFPB contractors or consultants may receive confidential information only if such contractors or consultants certify in writing to treat such confidential information in accordance with these rules, Federal laws and regulations that apply to Federal agencies for the protection of the confidentiality of personally identifiable information and for data security and integrity, as well as any additional conditions or limitations that the CFPB may impose.

(c) Disclosure of materials derived from confidential information. Nothing in this subpart shall limit the discretion of the CFPB to disclose materials that it derives from or creates using confidential information to the extent that such materials do not identify, either directly or indirectly, any particular person to whom the confidential information pertains.

(d) Disclosability of confidential information provided to the CFPB by other agencies. Nothing in this subpart requires or authorizes the CFPB to disclose confidential information that another agency has provided to the CFPB to the extent that such disclosure contravenes applicable law or the terms of any agreement that exists between the CFPB and the agency to govern the CFPB's treatment of information that the agency provides to the CFPB.