More Than Two Years Later, Federal Agencies Issue GLBA Final Model Privacy Form
On Tuesday, the Office of the Comptroller of the Currency (OCC), the Federal Reserve System (Board), the Federal Deposit Insurance Corporation (FDIC), the Office of Thrift Supervision (OTS), the National Credit Union Administration (NCUA), the Federal Trade Commission (FTC), the Commodity Futures Trading Commission (CFTC), and the Securities and Exchange Commission (SEC) (the "Joint Agencies") issued the Final Model Privacy Form under the Gramm-Leach-Bliley Act (GLBA). Financial institutions may rely on the model privacy form as a safe harbor to provide disclosures under the GLBA privacy rule (12 CFR part 40 (OCC); 12 CFR part 216 (Board); 12 CFR part 332 (FDIC); 12 CFR part 573 (OTS); 12 CFR part 716 (NCUA); 16 CFR part 313 (FTC); 17 CFR part 160 (CFTC); and 17 CFR part 248 (SEC)). Among other things, the Final Model Privacy Form is designed to be more consumer-friendly. The Final Rule can be found here. The opt-out model form can be found here. The no opt-out model form is here. For more on the history, read on.
GLBA Section 503 requires financial institutions to provide their customers (at the inception of the relationship and on an annual basis) with a notice that describes the categories of nonpublic personal information they collect, the affiliates and nonaffiliated third parties with which they share such information, how they protect such information, and a description of the customer’s right to prevent certain disclosures to nonaffiliated third parties.
Section 728 of the Financial Services Regulatory Relief Act of 2006, signed by President Bush on October 13, 2006, amended GLBA Section 503 to require the Joint Agencies to propose a model form by April 11, 2007. The Joint Agencies issued an interagency proposal for the model form on March 21, 2007, and sought comments. The Final Rule issued on Tuesday is a result of that lengthy process.
The Final Rule will take effect 30 days after publication in the Federal Register.