The Consumer Financial Protection Bureau (CFPB) on Monday announced the finalization of a rule proposed in May that would allow companies that limit consumer data-sharing to post privacy notices online instead of delivering them individually.
Financial institutions are required to send annual privacy notices to their customers as a provision of the Gramm-Leach-Bliley Act (GLBA) that describe how the institutions share consumers' nonpublic personal information with unaffiliated third parties. The institution is obligated to inform the consumers of their right to opt out and inform them how to opt out if the information is shared with an unaffiliated third party.
Financial institutions can now post privacy notices online under the new CFPB rule instead of sending paper copies if they meet certain requirements, such as not sharing data in a way that triggers the consumers' opt out rights. Both banks and non-banks within CFPB's jurisdiction under the GLBA are affected by the new rule. Institutions that choose to use the new online disclosure method will be required to use the model disclosure form that federal regulatory agencies developed in 2009.
"Consumers need clear and accessible information about how their personal information is being used in the marketplace, but some of these requirements were redundant," CFPB Director Richard Cordray said. "Posting privacy notices online will make it easier for consumers to access these important policies, while also making it cheaper for financial institutions to provide disclosures."
Qualifying institutions that choose the new online disclosure method must inform consumers annually about the availability of such disclosures. Whereas previously institutions were required to send separate communications regarding privacy disclosures to consumers, under the new rule, the institutions may include information about the availability of disclosures on regular communication such as a credit card monthly billing statement. Consumers will be informed that the annual privacy notice is available online or, if consumers request it, by paper.
Institutions that choose not to use the new online disclosure method will still need to deliver the annual privacy notice using other delivery methods.
The online disclosure method of financial institutions' privacy policies will better educate consumers, since the government's model disclosure form used allows consumers to easily understand their financial institutions' privacy policies. Also, CFPB estimates that financial institutions could save the industry about $17 million per year by using the new online disclosure method.
The finalized rule is largely the same as it was originally proposed in May, with just some minor revisions. It goes into effect immediately when it is published in the Federal Register.