CFPB Proposes New GLB Privacy Notice Rule for Financial Institutions | Practical Law

CFPB Proposes New GLB Privacy Notice Rule for Financial Institutions | Practical Law

The Consumer Financial Protection Bureau (CFPB) proposed a new way for financial institutions to deliver privacy notices required under the Gramm-Leach-Bliley Act (GLB Privacy Notices) to their customers.

CFPB Proposes New GLB Privacy Notice Rule for Financial Institutions

Practical Law Legal Update 9-567-9057 (Approx. 3 pages)

CFPB Proposes New GLB Privacy Notice Rule for Financial Institutions

by Practical Law Finance
Published on 13 May 2014 • USA (National/Federal)
The Consumer Financial Protection Bureau (CFPB) proposed a new way for financial institutions to deliver privacy notices required under the Gramm-Leach-Bliley Act (GLB Privacy Notices) to their customers.
On May 6, 2014, the Consumer Financial Protection Bureau (CFPB) proposed a new way for financial institutions to deliver privacy notices required under the Gramm-Leach-Bliley Act (GLB Privacy Notices) to their customers. Currently, financial institutions are required to send a notice annually, via mail, to customers apprising them of what personal information is collected, as well as how that information is collected, used and disclosed. If the institution provides personal information to an unaffiliated third party, the institution generally must notify the customer and give the customer the option to limit the information sharing.
Under the proposal, as an alternative to mailing GLB Privacy Notices individually to each customer, certain financial institutions may fulfill the notice requirement by including a brief disclosure in customer billing statements or other communications, stating that the required notice is available online. This brief disclosure about the online availability of the GLB Privacy Notice must be made at least annually. The GLB Privacy Notice must be posted on the financial institution's website in a conspicuous manner, and the institution must inform customers that a paper version of the notice is available upon request via a toll-free telephone number.
The proposal is intended to promote efficiency by reducing GLB Privacy Notice compliance costs for financial institutions and making GLB Privacy Notices more readily available to customers.
An institution would be able to avoid mailing GLB Privacy Notices and qualify for this new proposed notice mechanism if:
  • The institution does not share nonpublic personal information with nonaffiliated third parties, except in limited circumstances under 12 CFR 1016.13, 1016.14 or 1016.15.
  • The annual GBL Privacy Notice:
    • does not include an opt out pursuant to the Fair Credit Reporting Act (FCRA);
    • is not the only notice the institution provides to fulfill FCRA requirements under 15 U.S.C. 1681s-3 and subpart C of 12 CFR 1022.1 et al., if applicable;
    • has not changed since the last time the GLB Privacy Notice was provided to the customer; and
    • uses the model form issued by regulators.
The comment period for this proposal will remain open until June 12, 2014, 30 days after its publication in the federal register.