Privacy Notice Revamp may not be Necessary for CUs

WASHINGTON-Representatives from CUNA, CUNA Mutual, NAFCU, and NASCUS met last week with various regulators to express their viewpoints on a joint advance notice of proposed rulemaking to simplify privacy notices under the Gramm-Leach-Bliley Act. The credit union organizations met ahead of time and hammered out three common points they would make to the regulators, which included NCUA, the Securities and Exchange Commission, the Federal Reserve Board, the Federal Trade Commission, and the Office of the Comptroller of the Currency. Generally, the credit union groups said that credit unions’ privacy notices may not need simplifying since just 1% to 2% are actually required to send opt out notices to their members, according to CUNA Assistant General Counsel Jeff Bloch and NAFCU Director of Regulatory Affairs Gwen Baker. “We feel like credit union notices are already very short,” Baker said. For other institutions that have more complex setups and arrangements, she admitted, the notices could be difficult for consumers to comprehend. Bloch explained, “The meeting went very well. They are trying to make a sincere effort to work on ways to make privacy notices easier for consumers.” He added that the groups “are interested in seeing a sample of a privacy notice.” However, unless it can be demonstrated that changes would help consumers, credit unions are reluctant to modify their privacy notices. Both CUNA and NAFCU emphasized that they are still waiting to hear comments from their membership on the issue, but so far, there does not seem to be a strong objection to sample language as guidance. Both Baker and Bloch said the point was made that annual notices are unnecessary for credit unions. What the attorneys said credit unions would like to see is a legislative change permitting for a privacy notice when the member signs up. Then, each year, the credit union could include with a member statement or in a newsletter that the privacy notice exists and has not been changed. The member should also be notified where they can get another copy of the privacy notice. If the credit union’s privacy policy has changed, then a new notice should be distributed, the credit union associations said. According to GLBA, Baker explained, the regulations have to be consistent and comparable among the regulators. NCUA is required to consult and coordinate its regulatory efforts in this area with the other affected agencies. The regulators called a series of meetings with various industries within the financial services sector in addition to the normal notice and comment period in response to pressure from a particular group for an in-person meeting, Bloch said. [email protected]