12 U.S.C. § 5533 — Consumer rights to access information

(a) In general. Subject to Bureau^* rules, a covered person^* must, when a consumer^* asks, provide information in its control or possession about the consumer financial product or service^* the consumer obtained from that person^*. This includes information about a transaction or series of transactions and the account, including costs, charges, and usage data. The information must be provided in an electronic form consumers can use. (b) Exceptions. The person need not provide: (1) confidential commercial information, including an algorithm used to derive credit^* scores or other risk scores or predictors; (2) information collected to prevent fraud or money laundering, detect other unlawful or potentially unlawful conduct, or make a report about it; (3) information another law requires to remain confidential; or (4) information the person cannot retrieve in the ordinary course of business. (c) No duty to maintain records. This section does not require a covered person to maintain or keep consumer information. (d) Standardized formats. By rule, the Bureau must set standards promoting standardized information formats, including machine-readable files, for information provided under this section. (e) Consultation. When issuing a rule, the Bureau must consult federal banking agencies and the Federal Trade Commission to ensure, when appropriate, that the rules: (1) impose substantively similar requirements; (2) account for business conditions in the United States and other countries; and (3) do not require or encourage a particular technology for compliance systems.