Newsroom

Credit unions that do not share members' data with nonaffiliated third parties will no longer be required to mail privacy policy notices each year if they post those notices online and meet other conditions in a CFPB final rule released Monday.

The final rule sets five conditions overall for authority to provide online-only privacy notices. Generally, these provide the institution is not also using the online disclosure to address consumer opt-out opportunities provided under the Gramm-Leach-Bliley Act and Fair Credit Reporting Act; that information in the notice has not changed since the last notice provided; and that the credit union uses the model form in the GLB Act implementing rule, Regulation P, for the online disclosure.

A credit union that is eligible and wishes to provide privacy policy notices only online must also do the following:

• post the current privacy policy notice continuously on a public (no login required) page of its website that contains only the privacy notice;
• at least annually in another disclosure, state that the notice is available on the credit union's website and will be mailed upon request made by phone (to a toll-free number), and provide the Web address of the online notice; and
• promptly mail the current privacy notice to members who request it by phone.

NAFCU supported CFPB's efforts to ease the privacy policy disclosure requirement but did note concern that the "continuous" posting requirement would be a problem if the credit union's website is temporarily down. CFPB addressed this in the preamble to its final rule, noting that financial institutions would not be in violation due to temporary website malfunctions.

The association also continues to press for action on S. 635 and H.R. 749, which would remove the statutory requirement for duplicative privacy policy notices and advance a key provision in in NAFCU's five-point plan for regulatory relief for credit unions.

CFPB's final rule takes effect upon publication in the Federal Register.