WASHINGTON–The Consumer Financial Protection Bureau has finalized a rule that allows FIs to post privacy notices online instead of distributing an annual paper copy.
The rule allows FIs to streamline the information reporting if they satisfy certain conditions, such as not sharing data in ways that would trigger consumers’ opt-out rights. The new rule applies to both banks and nonbanks that are within the CFPB’s jurisdiction under Gramm-Leach-Bliley Act (GLBA).
Institutions that choose to rely on this new method of delivering privacy notices will be required to use the model disclosure form developed by federal regulatory agencies in 2009.
"Consumers need clear and accessible information about how their personal information is being used in the marketplace, but some of these requirements were redundant," said CFPB Director Richard Cordray. "Posting privacy notices online will make it easier for consumers to access these important policies, while also making it cheaper for financial institutions to provide disclosures."
The GLBA generally requires that financial institutions send annual privacy notices to customers. These notices must describe whether and how the financial institution shares consumers’ nonpublic personal information, the CFPB explained. If the institution does share this information with an unaffiliated third party, it typically must notify consumers of their right to opt out of the sharing and inform them of how to do so.
Under the new rule, if an institution qualifies for and wants to rely on the online disclosure method, it will have to inform consumers annually about the availability of the disclosures. Previously, institutions were required to send consumers a separate communication about privacy disclosures. The new rule allows institutions to include a notice on a regular consumer communication, such as a monthly billing statement for a credit card, letting consumers know that the annual privacy notice is available online and in paper by request at a provided telephone number. If an institution chooses not to use the new disclosure method, it will need to continue to deliver annual privacy notices to its customers using other delivery methods.
The CFPB stated the benefits of the new rule include constant access to privacy policies, limited data sharing, educating consumers, and lower costs to notify consumers of privacy practices.
The CFPB anticipates that the rule will reduce the expense for companies to provide annual privacy notices, possibly by as much as $17 million industry-wide.
The final rule is available at: http://files.consumerfinance.gov/f/201410_cfpb_final-rule_annual-privacy-notice.pdf