The CFPB proposed a new rule on Tuesday that would allow financial institutions to post annual privacy notices online rather than delivering them through direct mail if they meet certain requirements.
The new rule would apply to credit unions, banks and nonbanks within the CFPB's jurisdiction under The Gramm-Leach-Bliley Act.
Currently, four credit unions have more than $10 billion in assets and are supervised by the CFPB. However, according to NAFCU Director of Regulatory Affairs Michael Coleman, the rule would apply to credit union of all sizes.
"For the purposes of credit unions, this rule applies to them as financial institutions," he said.
The CFPB estimated that approximately $17 million could be saved by the industry each year if qualified institutions choose the online disclosure method.
"Consumers need clear information about how their personal information is being used by financial institutions," said CFPB Director Richard Cordray. "This proposal would make it easier for consumers to find and access privacy policies, while also making it cheaper for industry to provide disclosures."
GLBA generally requires financial institutions to send annual privacy notices directly to customers, which describe how the consumers' nonpublic information is being shared.
"Institutions that choose to rely on this new method of delivering privacy notices would be required to use the model disclosure form developed by federal regulatory agencies in 2009," said the CFPB.
NAFCU said it supports the proposed rule.
"NAFCU has been seeking relief on this issue in Congress," Coleman said. "We are pleased that the CFPB has begun to take steps to provide credit unions relief from these outdated notices via the regulatory process."
Under the proposal, if an institution qualifies for the online disclosure method, it would be required to inform consumers each year about the availability of the disclosures.
"Under this proposal they could include an insert in regular consumer communication, such as a monthly billing statement for a credit card, letting consumers know that the annual privacy notice is available online and in paper by request at a toll-free telephone number," said the CFPB. "If an institution chose not to use the online disclosure method, it would need to continue to deliver annual privacy notices to its customers."
The CFPB is accepting comments on the proposed rule for 30 days after it is published in the Federal Register.
© 2025 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.