Today the Consumer Financial Protection Bureau (CFPB) issued a final rule to allow financial institutions (including certain nonbanks within the CFPB’s jurisdiction) that limit their consumer data-sharing and meet other requirements to post their annual privacy notices online rather than delivering them individually. The final rule amends Regulation P (12 CFR part 1016) and will become effective upon publication in the Federal Register. The final rule amends §1016.9(c) of Regulation P by adding subsection (c)(2) to provide an alternative method for delivering annual privacy notices. As summarized in the preamble to the final rule (pages 65-66), a financial institution may use the alternative delivery method if: • It does not disclose the customer’s nonpublic personal information to nonaffiliated third parties in a way that triggers the consumer’s opt-out rights under the Gramm-Leach-Bliley Act (GLBA).
