In a joint release with other federal regulators, the SEC has published final rule amendments to Regulation S-P, which implements the privacy provisions of the Gramm-Leach-Bliley Act (GLBA) with respect to brokers-dealers, investment companies, and investment advisers that are registered with the SEC. Regulation S-P requires that these registrants provide initial and annual privacy notice to their customers, informing them of the registrant’s information-sharing practices and of the customer’s right to opt out of certain sharing practices. The rulemaking, which went into effect on December 31, 2009, includes a model privacy form that registrants may rely on as a safe harbor to provide disclosures required to be made under Regulation S-P. For privacy notices provided after December 31, 2010, the rulemaking also will eliminate the guidance associated with the use of notices based on the Sample Clauses set forth in Appendix B of Regulation S-P.
Use of the model form is voluntary. Thus, while the model form provides a legal safe harbor, registrants may continue to use notices that vary from the model form, so long as the notices comply with the requirements of Regulation S-P. Similarly, while the SEC is eliminating its guidance on the use of Sample Clauses for notices provided after December 31, 2010, registrants may continue to use notices containing these clauses provided the notices comply with the requirements of Regulation S-P.
The rulemaking fulfills a mandate of the Financial Services Regulatory Relief Act of 2006, which amended GLBA to require the federal agencies responsible for the implementation of GLBA to propose a succinct and comprehensible model form that allows consumers to easily compare the privacy practices of different financial institutions, and has an easy-to-read font. Still under consideration by the SEC are proposed amendments to Regulation S-P that would, among other things, set forth more specific requirements for safeguarding information and responding to information security breaches, and broaden the scope of the information covered by Regulation S-P’s safeguarding and disposal provisions.