CFPB proposes change to privacy disclosures

The Consumer Financial Protection Bureau is proposing a rule that would change the way banks distribute privacy disclosures.

The Consumer Financial Protection Bureau is proposing a rule that would change the way banks distribute privacy disclosures. Banks that meet certain conditions would be allowed to post disclosures online rather than mailing them to customers annually.

Primarily, the change would benefit banks which do not share private customer information with unaffiliated third parties. If banks share such information in a way that triggers opt-out rights, the banks are not eligible to offer the online notices.

The Gramm-Leach-Bliley Act generally requires financial institutions to provide a physical copy of privacy notices once a year to customers describing what private customer information they share and how. If the institution does share this information with an unaffiliated third party, it typically must notify consumers of their right to opt out of the sharing and inform them of how to do so.

Some banks “have expressed concern that this practice causes information overload for consumers and unnecessary expense” for the banks, the bureau said.

Banks which opt to use the electronic version would have to post the notices in a “clear and conspicuous manner” on the bank’s website, “without requiring a login or similar steps to access the notice.”

Banks would still have to inform customers annually of the availability of the online disclosures. Rather than sending a separate mailing, however, this requirement could be fulfilled by an insert within another piece of mail, such as an account statement.

Banks would also still have to supply a physical copy if its privacy practices change or if the customer requests a copy.

The proposed rule would apply to both banks and those nonbanks which fall under CFPB jurisdiction through Gramm-Leach-Bliley. Institutions which choose the new method would be required to use the model disclosure form developed by federal regulatory agencies in 2009.

The bureau will accept comments on the proposed rule for 30 days after its publication in the Federal Register.

 “Consumers need clear information about how their personal information is being used by financial institutions,” said CFPB Director Richard Cordray in a press release. “This proposal would make it easier for consumers to find and access privacy policies, while also making it cheaper for industry to provide disclosures.”

Fredrikson & Byron Law