Removing Barriers Blog

Our Comment Letter Expresses Support for CFPB Changes to GLBA Privacy Notifications
Posted August 01, 2016 by CUNA Advocacy

Today, we filed our comment letter in response to the CFPB’s proposal implementation the Fixing America's Surface Transportation (FAST Act). We strongly supported and advocated for passage of this legislation and urged the CFPB for clarification in regulation. The annual privacy notice has been an unnecessary compliance cost for many years. 

Changes were first made allowing an alternative delivery method (website) rule in 2014, followed by the FAST Act, which eliminated the general annual notice requirement in December 2015. Previously, many credit unions were unable to use the 2014 exemption because of the overly complex conditions that had to be satisfied. 

Under the proposed rule, credit unions are not required to deliver a GLBA annual privacy notice if the credit union meets just two criteria. These include the following: 

  • Section 503(f)(1) requires that to qualify for this exception, a financial institution must not share nonpublic personal information about customers except as described in certain statutory exceptions. (Sharing as described in these specified statutory exceptions does not trigger the customer’s statutory right to opt out of the financial institution’s sharing.) 

  • In addition, section 503(f)(2) requires that the financial institution must not have changed its policies and practices with regard to disclosing nonpublic personal information from those the institution disclosed in the most recent privacy notice it sent.  

Credit unions that meet the criteria for this alternative delivery method would also meet the requirements for the new annual notice exception, which will largely eliminate the need to post notices online. Credit unions can choose to post this notice online, however, if they would like to do so. 

As proposed, if a credit union makes changes to its policies and practices in a way that no longer allows it to qualify for the exemption, but does not require a revised notice, the credit union will have a 60-day period for delivery of the annual notice. Some credit unions have suggested that a 60-day time period is not long enough, especially if there is an inadvertent or unplanned change to their policy. To assure credit unions are not penalized because of a rushed timeframe, we suggested to the CFPB that a 120-day period is more appropriate.