(a) General rules—

(1) Voluntary self-testing and correction. The report or results of a self-test that a creditor voluntarily conducts (or authorizes) are privileged as provided in this section. Data collection required by law or by any governmental authority is not a voluntary self-test.

(2) Corrective action required. The privilege in this section applies only if the creditor has taken or is taking appropriate corrective action.

(3) Other privileges. The privilege created by this section does not preclude the assertion of any other privilege that may also apply.

(b) Self-test defined—

(1) Definition. A self-test is any program, practice, or study that:

(i) Is designed and used specifically to determine the extent or effectiveness of a creditor's compliance with the Act or this regulation; and

(ii) Creates data or factual information that is not available and cannot be derived from loan or application files or other records related to credit transactions.

(2) Types of information privileged. The privilege under this section applies to the report or results of the self-test, data or factual information created by the self-test, and any analysis, opinions, and conclusions pertaining to the self-test report or results. The privilege covers workpapers or draft documents as well as final documents.

(3) Types of information not privileged. The privilege under this section does not apply to:

(i) Information about whether a creditor conducted a self-test, the methodology used or the scope of the self-test, the time period covered by the self-test, or the dates it was conducted; or

(ii) Loan and application files or other business records related to credit transactions, and information derived from such files and records, even if the information has been aggregated, summarized, or reorganized to facilitate analysis.

(c) Appropriate corrective action—

(1) General requirement. For the privilege in this section to apply, appropriate corrective action is required when the self-test shows that it is more likely than not that a violation occurred, even though no violation has been formally adjudicated.

(2) Determining the scope of appropriate corrective action. A creditor must take corrective action that is reasonably likely to remedy the cause and effect of a likely violation by:

(i) Identifying the policies or practices that are the likely cause of the violation; and

(ii) Assessing the extent and scope of any violation.

(3) Types of relief. Appropriate corrective action may include both prospective and remedial relief, except that to establish a privilege under this section:

(i) A creditor is not required to provide remedial relief to a tester used in a self-test;

(ii) A creditor is only required to provide remedial relief to an applicant identified by the self-test as one whose rights were more likely than not violated; and

(iii) A creditor is not required to provide remedial relief to a particular applicant if the statute of limitations applicable to the violation expired before the creditor obtained the results of the self-test or the applicant is otherwise ineligible for such relief.

(4) No admission of violation. Taking corrective action is not an admission that a violation occurred.

(d) Scope of privilege—

(1) General rule. The report or results of a privileged self-test may not be obtained or used:

(i) By a government agency in any examination or investigation relating to compliance with the Act or this regulation; or

(ii) By a government agency or an applicant (including a prospective applicant who alleges a violation of §202.4(b)) in any proceeding or civil action in which a violation of the Act or this regulation is alleged.

(2) Loss of privilege. The report or results of a self-test are not privileged under paragraph (d)(1) of this section if the creditor or a person with lawful access to the report or results:

(i) Voluntarily discloses any part of the report or results, or any other information privileged under this section, to an applicant or government agency or to the public;

(ii) Discloses any part of the report or results, or any other information privileged under this section, as a defense to charges that the creditor has violated the Act or regulation; or

(iii) Fails or is unable to produce written or recorded information about the self-test that is required to be retained under §202.12(b)(6) when the information is needed to determine whether the privilege applies. This paragraph does not limit any other penalty or remedy that may be available for a violation of §202.12.

(3) Limited use of privileged information. Notwithstanding paragraph (d)(1) of this section, the self-test report or results and any other information privileged under this section may be obtained and used by an applicant or government agency solely to determine a penalty or remedy after a violation of the Act or this regulation has been adjudicated or admitted. Disclosures for this limited purpose may be used only for the particular proceeding in which the adjudication or admission was made. Information disclosed under this paragraph (d)(3) remains privileged under paragraph (d)(1) of this section.