Compliance Blog

Posted by Anthony Demangone

Yesterday, a number of government agencies indicated that regulators, including NCUA, have released the model privacy form.  There's no word from NCUA yet, but I bet they make their own announcement very soon.  Here's some information from the Fed.

Eight federal regulatory agencies today released a final model privacy notice form that will make it easier for consumers to understand how financial institutions collect and share information about consumers. Under the Gramm-Leach-Bliley Act (GLB Act), institutions must notify consumers of their information-sharing practices and inform consumers of their right to opt out of certain sharing practices. The model form issued today can be used by financial institutions to comply with these requirements.

... The final rule provides that a financial institution that chooses to use the model form obtains a "safe harbor" and will satisfy the disclosure requirements for notices.  The rule also removes, after a transition period, the sample clauses now included in the appendices of the agencies’ privacy rules.

Here's basically what the rule does. 

• The regulation, and the model form, becomes effective 30 days after publication in the Federal Register.  But don't panic.
• You can use the new model form, and you have a "safe harbor" once the rule is effective. What is a "safe harbor?"  If you use the model form, you pretty much are bullet-proof when it comes to this issue on exams, as long as you use the form as outlined in the regulation.
• In addition, the rule eliminates the safe harbor permitted for notices based on sample clauses contained in the current rule for privacy notices provided after December 31, 2010.   I'm guessing many of you created privacy notices using those sample clauses.  So, your notices will be OK - they will enjoy a safe harbor - through the end of next year.  On January 1, 2011, the safe harbor for those sample clauses disappears.  Clearly, regulators are hoping that everyone transitions to the model form.
• On January 1, 2012, the sample clauses will be removed from privacy regulations, including NCUA's.  Like they never existed.  I wonder if we'll be able to even speak about them?
• You don't have to use the model form, but you're on your own if you create your own language.  In other words, you won't enjoy the safe harbor protection.