|
|
The Privacy Notice Saga Continues
As with most laws and regulations, the privacy requirements laid down in Gramm-Leach-Bliley are no exception. No-one is thrilled with how the privacy process is going. One of the nettlesome points is the notice itself.
While notices, like disclosures, seem to be a reasonable approach, this notice is a doozy. The model language is - well - written by regulators. It reads about as well as a list of ingredients on imported food.
The agencies have set out to do something about this - all eight of them. In addition to the five agencies that comprise the FFIEC, the participants include the Commodity Futures Trading Commission, Federal Trade Commission, and the SEC.
The form of action is an Advance Notice of Proposed Rulemaking to improve privacy notices. The ANPR content is based on the seminar on privacy notices held by the agencies in December 2001. The agencies are particularly asking for comments supported by what institutions have learned in the two years since that seminar.
The most significant question on the table is whether the agencies should develop a short model notice or selection of notices. The ANPR emphasizes that the goal for the notice is short and simple. One question is whether the selection of models published with the ANPR should be offered as options.
Even when it comes to a short model notice, the possibilities seem endless. The agencies have discussed a brief summary notice, a more detailed notice containing highlights and more detailed information adapted to the business practices, and ways to present the opt out notice and explain the opt out process.
As part of the review process, the agencies also looked at how information should be presented or worded to best communicate to consumers. At this point, there are clearly many ideas and no clear sense of final direction. Comments from the industries that have to provide the notice will be invaluable for the rulemaking process. If you can think of nothing else to say, it would be useful to share the comments that you have had from customers about your notices.
To stimulate useful comments, the ANPR includes a series of questions for commenters. These include:
- What should be the goals of a privacy notice?
- What elements should be included in a privacy notice?
- How should notices be worded for clarity?
- How should notices be formatted to best present information?
- What should be mandatory and what should be voluntary with respect to short and long formats, standardized formats, content and the like?
- Should a combination of short and long notices be used? If so, what are the costs and benefits of different approaches?
The sample notices included with the ANPR make interesting reading. Several follow a mandated form in which each disclosing institution would provide a "yes" or a "no" answer, allowing consumers to do a quick comparison of practices. The forms presented also include several options for opt-out forms.
What is not discussed in this ANPR is the probable confusion that occurs with FCRA opt-out procedures and information sharing. It is worth thinking about and addressing in your comments.
Copyright © 2004 Compliance Action. Originally appeared in Compliance Action, Vol. 8, No. 15, 1/04
Privacy Policy Disclaimer Recommend This Site ! Contact Us
BankersOnline is a free service made possible by the generous support of our advertisers and sponsors. Advertisers and sponsors are not responsible for site content. Please help us keep BankersOnline FREE to all banking professionals. Support our advertisers and sponsors by clicking through to learn more about their products and services.
|
|
Print Friendly!
Email This Article!
Discuss NOW!