Annual Privacy Notices Allowed to Be Posted Online

The CFPB has finalized Regulation P allowing financial institutions to forgo mailing annual privacy notices by posting notices online, if certain requirements are met. The rule became effective October 28, 2014.  

Conditions to Meet

Financial institutions are still required to deliver an initial privacy notice to consumers when a customer relationship is established; however, institutions are permitted to post their annual privacy notice online rather than mailing it to each customer if the following conditions are met: 

• The content of the notice most recently provided to the customer has not changed
• The financial institution does not share the customer's nonpublic personal information in a way that triggers an opt-out right
• The financial institution has another channel for the opt-out disclosure required by the Fair Credit Reporting Act (disclosing information to an affiliate for marketing purposes)
• The financial institution uses the CFPB's model privacy notice

Financial institutions may take advantage of not mailing an annual notice if the following requirements are met:

• The privacy notice is continuously posted on its website on a page that has no other content and access to the page must not require any condition, such as a user ID or password
• Customers are notified annually on an account statement, coupon book or on any other notice or disclosure the institution is required to provide to the customer that:

• The privacy notice is available on the institution's website

• The web address of the page that contains the privacy notice and a telephone number for the institution that the customer can call,

• That the notice has not changed since the last privacy notice delivered to the customer

• That a written privacy notice will be mailed to the customer upon request. 

•  Notification is not provided on advertising materials

Sample Language

The following is sample language provided in the final rule that can be used to notify the customers (must be prefaced with "Privacy Notice" in boldface or otherwise emphasized):

Privacy Notice - Federal law requires us to tell you how we collect, share, and protect your personal information. Our privacy policy has not changed and you may review our policy and practices with respect to your personal information at [Web address] or we will mail you a free copy upon request if you call us at [telephone number].

If an institution receives a request from a consumer for a paper copy of their privacy notice, it must mail the notice free of charge within 10 days of receiving the request.

For further information, please contact your local Eide Bailly professional.