On March 21, eight federal regulators, including the five federal bank and credit union regulators, released a notice of proposed rulemaking (NPR) requesting comment on a model privacy form that financial institutions can use for their privacy notices to consumers required by the Gramm-Leach-Bliley Act (GLB Act). The privacy notices must describe an institution’s information sharing practices. For certain types of sharing, consumers have the right to opt out. The notices must be provided when a consumer first becomes a customer of a financial institution and then annually for as long as the customer relationship lasts.
The NPR was issued pursuant to the Financial Services Regulatory Relief Act of 2006, which amended the GLB Act to require the agencies to propose a model form that is succinct and comprehensible to consumers, allows consumers easily to compare privacy practices of financial institutions, and uses easily readable type font. The proposed model privacy form is the “prototype privacy notice” developed after a year-long consumer testing process. A detailed report describing the testing and resulting prototype privacy notice was released in March 2006. The NPR proposes that a financial institution that chooses to use the model form would satisfy the disclosure requirements for the notices and therefore could take advantage of a legal “safe harbor.” The NPR also proposes to remove, after a transition period, the sample clauses now included in some of the agencies’ privacy rules.
The NPR was developed jointly by the Board of Governors of the Federal Reserve System, the Commodity Futures Trading Commission, the Federal Deposit Insurance Corporation, the Federal Trade Commission, the National Credit Union Administration, the Office of the Comptroller of the Currency, the Office of Thrift Supervision, and the Securities and Exchange Commission.
The agencies seek comment on all aspects of the model form, including its content, format, and whether it provides sufficient flexibility for financial institutions to disclose their sharing practices accurately. Written comments on the proposed rule amendments may be submitted within 60 days after their publication in the
Federal Register, which is expected in late March.