The Consumer Financial Protection Bureau (CFPB) has finalized a rule to promote more effective privacy disclosures from financial institutions to their customers.
The new rule, which was proposed in May, allows companies that limit their consumer data-sharing and meet other requirements to post their annual privacy notices online rather than delivering them individually, the CFPB explains.
‘Consumers need clear and accessible information about how their personal information is being used in the marketplace, but some of these requirements were redundant,’ says Richard Cordray, CFPB director. "Posting privacy notices online will make it easier for consumers to access these important policies, while also making it cheaper for financial institutions to provide disclosures."
The Gramm-Leach-Bliley Act (GLBA) generally requires that financial institutions send annual privacy notices to customers. These notices must describe whether and how the financial institution shares consumers' non-public personal information. If the institution does share this information with an unaffiliated third party, it typically must notify consumers of their right to opt out of the sharing and inform them how to do so.
Under the CFPB's new rule, financial institutions will be able to post privacy notices online instead of distributing an annual paper copy, as long as they satisfy certain conditions such as not sharing data in ways that would trigger consumers' opt-out rights.
The new rule applies to both banks and those non-banks that are within the CFPB's jurisdiction under the GLBA. Institutions that choose to rely on this new method of delivering privacy notices will be required to use the model disclosure form developed by federal regulatory agencies in 2009, the CFPB notes.
Under the new rule, if an institution qualifies for and wants to rely on the online disclosure method, it will have to inform consumers annually about the availability of the disclosures. Previously, institutions were required to send consumers a separate communication about privacy disclosures.
The new rule also allows institutions to include a notice on a regular consumer communication, such as a monthly billing statement for a credit card – letting consumers know that the annual privacy notice is available online and in paper by request at a provided telephone number. If an institution chooses not to use the new disclosure method, it will need to continue to deliver annual privacy notices to its customers using other delivery methods.
Other benefits of the new rule include the following, according to the CFPB: constant access to privacy policies, limited data sharing, better education about privacy policies for consumers and cost savings for companies to notify consumers of privacy practices. The bureau estimates that about $17 million could be saved by the industry annually if institutions choose the new online disclosure method.
The CFPB says it is finalizing the rule largely as it was proposed in May, with a number of technical, clarifying and minor revisions. The rule will be effective immediately upon publication in the Federal Register.
The final rule is available here.