CFPB Final Rule Cuts Costs And Headaches From Annual Privacy Notices

On August 10, the Consumer Financial Protection Bureau (CFPB) released the long-awaited final rule amending Regulation P to conform with statutory changes made to the Gramm-Leach-Bliley Act (GLBA) and the statutory changes made by the FAST Act (Fixing America's Surface Transportation Act). The new final rule will be effective 30 days from the date it is published in the Federal Register and does not fundamentally restructure the July 2016 proposed rule.

Under the new rule, financial institutions may cease sending annual privacy notices if they do not engage in sharing that requires a consumer opt-out under the GLBA, and if they have not changed their information sharing practices since the last notice, as described in Section 1016.6(a)(2)-(5). However, the latter criteria does not include changes in affiliate sharing practices governed by the Fair Credit Reporting Act.