(a) In general
Subject to rules prescribed by the Bureau, a covered person shall make available to a consumer, upon request, information in the control or possession of the covered person concerning the consumer financial product or service that the consumer obtained from such covered person, including information relating to any transaction, series of transactions, or to the account including costs, charges and usage data. The information shall be made available in an electronic form usable by consumers.

(b) Exceptions
A covered person may not be required by this section to make available to the consumer—

(1) any confidential commercial information, including an algorithm used to derive credit scores or other risk scores or predictors;

(2) any information collected by the covered person for the purpose of preventing fraud or money laundering, or detecting, or making any report regarding other unlawful or potentially unlawful conduct;

(3) any information required to be kept confidential by any other provision of law; or

(4) any information that the covered person cannot retrieve in the ordinary course of its business with respect to that information.

(c) No duty to maintain records
Nothing in this section shall be construed to impose any duty on a covered person to maintain or keep any information about a consumer.

(d) Standardized formats for data
The Bureau, by rule, shall prescribe standards applicable to covered persons to promote the development and use of standardized formats for information, including through the use of machine readable files, to be made available to consumers under this section.

(e) Consultation
The Bureau shall, when prescribing any rule under this section, consult with the Federal banking agencies and the Federal Trade Commission to ensure, to the extent appropriate, that the rules—

(1) impose substantively similar requirements on covered persons;

(2) take into account conditions under which covered persons do business both in the United States and in other countries; and

(3) do not require or promote the use of any particular technology in order to develop systems for compliance.