Privacy Notice - Alternative Delivery Method

If the Bank utilizes the alternative delivery method for the annual privacy notice by placing the notice on the website, can the notice on the website be different than the initial notice?

For example, if the opt-out disclosure requirement under section 624 of FCRA subpart C (Affiliate Marketing Rule) is satisfied with the initial privacy notice, can this section be removed from the annual privacy notice on the website?

Another question pertaining to the Alternative Delivery Method of the Annual Privacy Notice:

For the below standard language that is required to be inserted on an account statement, coupon book, or notice, etc:
"Federal law requires us to tell you how we collect, share, and protect your personal information. Our privacy policy has not changed and you may review our policy and practices with respect to your personal information at..."

Is it acceptable if this language is placed on the BACK of an account statement, etc???

You might get away with it, but I am concerned that on the back of the statement, where no one ever looks, you could not meet the requirement that the notice be conspicuous.

Thanks John. That was our concern, but I'm sure I speak for everyone when I say that there's a space issue on our statements. Just something we'll have to work out.

Any input from my first question?

Back in this thread Kathleen posted a reply she got from an attorney at the CFPB.
I agree with the others here that the back of the statement would not meet the clear and conspicuous standard.
After much consideration, we opted to print the notice with the link and phone number on a separate piece of paper the same size and stock and with the same font and mail it with the account history we send out annually to all our borrowers. That covered those that get coupon books and those on auto-draw too. (note: other departments here are making their own decision on how to deal with this issue.)

Is your "account history we send out annually" "required or expressly and specifically permitted to issue to the customer under any other provision of law"?

yes

Loans? Deposits? I don't understand where in the regulations an annual statement is required or expressly permitted???

I'm going to ask my question here so that I won't have to create another post:

Can the website notice be on PDF format?

We currently have the notice as a regular web address but it is a little different than out paper notice. Both use the model notice format but the web notice looks a little different than the paper notice.

I would like to put the paper notice on the website.

I'm no expert, but I'm pretty sure the answer is yes. Our Bank does this, where as if the customer goes to our website, there's a link they can click which will pull up the actual privacy notice document (pdf).

I'm curious about whether the website privacy disclosure can be in pdf format as well. I'm hoping that is the case but I couldn't find it for sure in my research. Does anyone have a definitive answer?

Does anyone know the answer to the first question that was originally posted? Specifically, can "For our affiliates to market to you" row of the table under "Reasons we can share..." be removed from the annual privacy notice since it would have already been satisfied with the initial privacy notice under FCRA?

For our affiliates to market to you. This reason incorporates sharing information specified in section 624 of the FCRA. This reason may be omitted from the disclosure table when: the institution does not have affiliates (or does not disclose personal information to its affiliates); the institution's affiliates do not use personal information in a manner that requires an opt-out; or the institution provides the affiliate marketing notice separately. Institutions that include this reason must provide an opt-out of indefinite duration. An institution that is required to provide an affiliate marketing opt-out, but does not include that opt-out in the model form under this part, must comply with section 624 of the FCRA and 12 CFR part 1022, subpart C, with respect to the initial notice and opt-out and any subsequent renewal notice and opt-out. An institution not required to provide an opt-out under this subparagraph may elect to include this reason in the model form.

Thanks rlcarey. Based on this, it sounds like the answer might be no, although it doesn't speak about the annual privacy notice.

Our Bank does not provide the affiliate marketing notice separately, therefore we include this opt out information in our Privacy Notice. It seems like we should be able to remove this section from our Annual Privacy Notice, as long as it's in the initial privacy notice. Thoughts? Feedback?

Does anyone know if this is acceptable?

I've looked in the Reg and the Final Rule of the amendment, but I couldn't find anything that specifically says that you can or can't use a link that opens up a PDF for the privacy notice. I've looked at a few different Bank's online privacy notices, and some are web pages, and some open up a PDF.

Per the final rule:
"...required a web address that the customer can type into a web browser to directly access the page that contains the privacy notice..."


Per 1016.9(c)(2)(ii)(A):
"...include a specific Web address that takes the customer directly to the page where the privacy notice is posted..."