CFPB Finalizes Rule to Ease GLBA Privacy Notice Requirements

As we previously reported, to be able to rely on the online posting method to satisfy privacy notice requirements under the Gramm-Leach-Bliley Act (GLBA), a financial institution must:

• Use the federal model privacy form adopted by federal regulators under GLBA;

• Not engage in information sharing that triggers customer opt-out rights under GLBA (i.e., sharing with unaffiliated third parties outside of certain exceptions) or Section 603(d)(2)(A)(iii) of the Fair Credit Reporting Act (i.e., sharing creditworthiness information with affiliates); and

• Provide customers with an annual disclosure, which can be included in an account statement, coupon book, or other notice or disclosure, that includes the Web address at which the privacy notice can be found, a telephone number for the customer to request a mailed notice, and a statement that the institution’s privacy notice has not changed.

The rule, which will become effective upon publication in the Federal Register, applies to banks and nonbank financial institutions for which the CFPB has rulemaking authority under GLBA (and thus does not extend to financial entities regulated by the Securities and Exchange Commission, the Commodity Futures Trading Commission, or state-regulated insurance companies).

Authored by Michael Epshteyn