DSNews The homepage of the servicing industry
The Consumer Financial Protection Bureau (CFPB) on Monday announced the finalization of a rule proposed in May that would allow companies that limit consumer data-sharing to post privacy notices online instead of delivering them individually.
Financial institutions are required to send annual privacy notices to their customers as a provision of the Gramm-Leach-Bliley Act (GLBA) that describe how the institutions share consumers' nonpublic personal information with unaffiliated third parties. The institution is obligated to inform the consumers of their right to opt out and inform them how to opt out if the information is shared with an unaffiliated third party.
Financial institutions can now post privacy notices online under the new CFPB rule instead of sending paper copies if they meet certain requirements, such as not sharing data in a way that triggers the consumers' opt out rights. Both banks and non-banks within CFPB's jurisdiction under the GLBA are affected by the new rule. Institutions that choose to use the new online disclosure method will be required to use the model disclosure form that federal regulatory agencies developed in 2009.
"Consumers need clear and accessible information about how their personal information is being used in the marketplace, but some of these requirements were redundant," CFPB Director Richard Cordray said. "Posting privacy notices online will make it easier for consumers to access these important policies, while also making it cheaper for financial institutions to provide disclosures."
Qualifying institutions that choose the new online disclosure method must inform consumers annually about the availability of such disclosures. Whereas previously institutions were required to send separate communications regarding privacy disclosures to consumers, under the new rule, the institutions may include information about the availability of disclosures on regular communication such as a credit card monthly billing statement. Consumers will be informed that the annual privacy notice is available online or, if consumers request it, by paper.
Institutions that choose not to use the new online disclosure method will still need to deliver the annual privacy notice using other delivery methods.
Under the new rule, consumers will have constant online access to their institution's privacy policy, as opposed to receiving a copy of the privacy policies just once a year. The new rule will also give financial institutions incentive to limit their data sharing (thus reducing costs), since an institution that shares the data with an unaffiliated third party will trigger the consumer's opt out rights and make that institution ineligible to use the new online disclosure method.
The online disclosure method of financial institutions' privacy policies will better educate consumers, since the government's model disclosure form used allows consumers to easily understand their financial institutions' privacy policies. Also, CFPB estimates that financial institutions could save the industry about $17 million per year by using the new online disclosure method.
The finalized rule is largely the same as it was originally proposed in May, with just some minor revisions. It goes into effect immediately when it is published in the Federal Register.
