Regulatory Update: BCFP Implements Gramm-Leach-Bliley Act Amendments in Final Rule

Financial institutions that meet certain requirements are exempt from sending annual privacy notices, easing burden and reducing risk of consumer confusion.

8/10/2018 1:00 PM

Regulatory Update: BCFP Implements Gramm-Leach-Bliley Act Amendments in Final Rule

The Bureau of Consumer Financial Protection finalized regulations reflecting requirements of the  Gramm-Leach-Bliley Act as amended in 2015.

The legislation, amended as part of the Fixing America’s Surface Transportation Act (FAST Act) in December 2015, allows financial institutions that meet certain requirements to be exempt from sending annual privacy notices to their customers, according to a news release from the BCFP.

“A financial institution can use the annual notice exception if it limits its sharing of customer information so that the customer does not have the right to opt out, and has not changed its privacy notice from the one previously delivered to its customer,” it reports.

The rule issued by the bureau also establishes deadlines for institutions resuming annual privacy notices if their practices change and they therefore cease to qualify for the exemption.

It states, “delivery of annual privacy notices is required under the rule if financial institutions make certain types of changes to their privacy policies or if the statute and Regulation P afford customers the right to opt out of financial institutions’ sharing of customers’ nonpublic personal information with nonaffiliated third parties. The statutory exception and this final rule do not affect the requirement to deliver an initial privacy notice, and all consumers will continue to receive such notices describing the privacy policies of any financial institutions with which they do business to the extent currently required.”

The GLBA generally mandates that certain financial institutions provide their customers with initial and annual notices regarding their privacy practices. The notices must describe whether and how the financial institution shares consumers’ nonpublic personal information. If the institution shares nonpublic personal information with an unaffiliated third party, it typically must notify consumers of their right to opt out of the sharing of such information, ACA International previously reported.

The amendments to the bureau’s final rule will be effective 30 days from the date of publication in the Federal Register. Read the complete rule here.

Follow ACA International on Twitter @ACAIntl and @acacollector, Facebook and request to join our LinkedIn group for news and event updates. ACA International members are welcome to submit news items for possible publication to Visit our publications page for news submission guidelines and subscriptions to ACA Daily, Collector magazine and Pulse. Advertising is available for companies wishing to promote their products or services. Be sure to visit the ACA Events Calendar on the Education and Training website to view our listing of upcoming CORE Curriculum and Hot Topic seminars featuring critical educational opportunities for your company.

Subscribe to ACA Daily NEWSROOM