Phone: 630-495-2282 Fax: 630-495-2260 Map/Directions

Gramm-Leach Privacy Act notices finally get revamped

November 10, 2010

By Patty Covington

On Nov. 17, 2009, the Federal Trade Commission along with other federal regulators adopted final Model Privacy Notice forms for compliance with the Gramm-Leach Bliley Act and its implementing regulation, the FTC’s Financial Privacy Rule. The Model Privacy Notice replaces the Sample Clauses, which appear in Appendix B to the Privacy Rule and, as such, now provide the safe harbor for compliance.

The Model Privacy Notice is the product of a six-year quest to make GLBA privacy notices more understandable and readable. In addition, the FTC and Agencies aimed for a form that allows consumers to more easily compare the privacy practices of one financial institution with those of another—something akin to nutrition labels. What resulted is a standardized template that must be completed in strict compliance with the accompanying instructions.

There are three Model Privacy Notice forms. The first does not provide an opt-out. The second provides an opt-out by telephone and Internet, and the third provides an opt-out with a mail-in form.

Each Model Privacy Notice form consists of two pages and may be printed either on two separate sheets of paper or on both sides of a single sheet. The notice may extend to a third page if there is a long list of affiliates or additional information that must be disclosed and which exceeds the space available on Page 2.

There are five parts to the first page: (i) The title, (ii) an introductory section called the "key frame," which provides context, (iii) a disclosure table that describes the types of sharing used by dealers, which types of sharing the dealer actually does, and whether the consumer can limit or opt-out of any of the dealer’s sharing, (iv) a box titled "To limit our sharing" (if the dealer offers an opt-out), and (v) the dealer’s customer service contact information. The dealer will also identify on the first page, the last date the notice was revised. If an opt-out is offered, the opt-out form is included on the first page.

Page 2 consists of: (i) A heading, (ii) certain frequently asked questions (‘‘Who are we?’’ and ‘‘What do we do?’’), (iii) key definitions, and (iv) a section entitled "Other Important Information,’’ where required state disclosures or an optional acknowledgment of receipt form can be provided.

The Model Privacy Notice must be printed in an easily readable type font and, except where specifically provided, it must be in at least 10 point type. Dealers may include their logo on any of the pages so long as it does not interfere with the readability of the notice or the space constraints of each page.

Dealers are not required to use the Model Privacy Notice; it’s purely voluntary. If they elect not to use the Model Privacy Notice, they must ensure their notices comply with all of the requirements of GLBA and the Privacy Rule. The benefit of the Model Privacy Notice is that, if completed as required by the instructions and delivered properly, it provides a safe harbor for compliance. Completing the notice precisely as required is vital. If the Model Privacy Notice is not completedprecisely as set forth in the instructions, the dealer loses the safe harbor.

The FTC and Agencies grant a transition period to phase out the Sample Clauses. Until December 31, 2010, notices using the new Model Privacy Notice or Sample Clauses will enjoy safe harbor protection. In addition, any compliant privacy notice delivered or posted online during this transition period will have a one-year safe harbor from the date of delivery or posting. After January 1, 2011, privacy notices, whether delivered or posted online, must adopt the new Model Privacy Notice to be entitled to the safe harbor.

Dealers must give their privacy notices to customers at the time they establish their relationship with them. There also is an annual notice requirement for dealers who maintain a continuing relationship with customers. Generally, if a dealership assigns its installment contract to finance companies, it does not maintain a customer relationship with its customers.

The Model Privacy Notice should make drafting and giving privacy notices much easier for dealers, but attention to detail is critical.

The author is a partner with Hudson Cook, LLP, a Hanover, Md. law firm that represents national and state banks, savings associations, credit unions, mortgage bankers, and licensed lenders in the development and maintenance of consumer mortgage, automobile finance, and other credit programs. Ms. Covington can be reached at (410) 865-5409 or