ALEXANDRIA, Va.—Credit unions are being reminded that they can now post the annual privacy notice online.
NCUA has issued a regulatory letter (14-RA-11) that the online alternative is now currently permissible to traditional mailing or hand-delivering a printed notice.
The online option resulted from a final rule recently issued by the Consumer Financial Protection Bureau (http://www.cutoday.info/Fresh-Today/CFPB-Rule-Allows-Online-Privacy-Disclosure-Posting). The rule allows FIs to streamline the information reporting if they satisfy certain conditions, such as not sharing data in ways that would trigger consumers’ opt-out rights. The new rule applies to both banks and nonbanks that are within the CFPB’s jurisdiction under Gramm-Leach-Bliley Act.
Institutions that use the new method are required to use the model disclosure form developed by federal regulatory agencies in 2009.
In its letter, NCUA outlined under what conditions CUs can use the new delivery method:
- The CU does not disclose customers’ nonpublic personal information to nonaffiliated third parties other than for purposes for which Regulation P provides an exception from opt-out requirements.
- The CU does not include an “opt out” under the Fair Credit Reporting Act (FCRA) on its annual privacy notice.
- The CU previously has satisfied the affiliate marketing provisions of FCRA and its implementing regulation, Regulation V, if applicable, or the annual privacy notice is not the only notice provided to satisfy those requirements.
- The information in the CU’s most recent privacy notice has not changed other than to eliminate categories of information shared or parties with which the CU shares customer information.
- The CU uses the form provided in the appendix to Regulation P for annual privacy notice.
NCUA also detailed that credit unions must post in a clear and conspicuous manner on an account statement, coupon book, or a notice or disclosure that the CU’s privacy notice has not changed and list the web address that takes the consumer directly to the page where the privacy notice is posted.
- The notice must include a telephone number the consumer may call to order a copy of the policy by mail.
- The notice must be posted in a clear and conspicuous manner on a page of the CU’s website on which the only content is the privacy notice. No login or password should be required to access the information.
- The CU must mail its current privacy notice within 10 calendar days of receiving a telephone request.
Related