Federal Regulatory Update

Federal Regulatory Update

The Bureau of Consumer Financial Protection (“CFPB”) issued a final rule, effective October 28, 2014, amending the annual privacy notice requirement under the Gramm-Leach-Bliley Act (“Regulation P”).




Regulation P requires, among other things, that lenders provide an annual disclosure of their privacy policies to borrowers.  This amendment creates an alternative delivery method for this annual disclosure which lenders will be able to use under certain circumstances.


If lenders share certain borrower information with particular types of third parties, the lenders are also required to provide notice to borrowers and an opportunity to opt out of the sharing. Lenders may now use an alternative delivery method to provide annual privacy notices by posting the annual notices on their websites if they meet certain conditions.  These conditions are:

  • No opt-out rights are triggered by the lender’s information sharing practices and required opt-out notices have been provided, if applicable, or the annual privacy notice is not the only notice provided to satisfy those requirements;
  • The information included in the privacy notice has not changed since the borrower received the previous notice; and
  • The lender uses the model form provided in Regulation P as its annual privacy notice.


To use the alternative method, the lender must continuously post the annual privacy notice in a clear and conspicuous manner on a page of its website, without requiring a login or similar steps or agreement to any conditions to access the notice.  In addition, to assist borrowers with limited or no access to the internet, the lender must mail annual notices to borrowers who request them by telephone, within ten days of the request.


To make borrowers aware that its annual privacy notice is available through these means, the lender must insert a clear and conspicuous statement at least once per year on an account statement, coupon book, or a notice or disclosure the lender issues under any provision of law.  The statement must inform borrowers that the annual privacy notice is available on the lender’s website, the lender will mail the notice to borrowers who request it by calling a specific telephone number, and the notice has not changed.


A lender is still required to use one of the permissible delivery methods that predate this rule change (referred to as the standard delivery methods) if the lender, among other things, has changed its privacy practices or engages in information-sharing activities for which borrowers have a right to opt out.