On March 21, 2007, The Office of the Comptroller of the Currency, the Federal Reserve System, the Federal Deposit Insurance Corporation, the Office of Thrift Supervision, the National Credit Union Administration, the Federal Trade commission, the Commodity Futures Trading Commission and the Securities and Exchange Commission released a 149-page proposal, seeking to revise the current model for privacy policy disclosures. The agencies are currently seeking comments on the proposed rule, but, should the rule become finally published, institutions with privacy policy disclosures based on the “Sample Clauses” (contained in the current version of 12 C.F.R. Section 332, appendix A) would lose the benefit of a safe harbor for compliance with those disclosures if disclosures under the current model are provided more than one year following the date of publication of the final rule.

    The proposed model form is either two or three pages in length, depending on whether the financial institution chooses (or is required) to provide an opt-out form. Each of the pages in the model form should be printed on a separate page, allowing the consumer to view all of the information simultaneously. The proposed form, which appears as a table (rather than in prose format), is designed to draw consumers’ attention and encourage them to read the privacy policy.

    Explanations on the first page, containing the headings “Why,” “What” and “How,” are included because consumers are less likely to understand the purpose of the privacy policy unless they are provided with background information. Consumers are also to be provided with a brief summary of the information contained in the disclosures, along with bold headings and bulleted explanations throughout the model form.

    As in the current version of the “Sample Clauses,” the disclosure table includes a description of the possible types of information sharing in which an institution engages, the uses of the consumers’ personal information, and the opt-out choices that must be disclosed. Consumers are to be provided with “Supplemental Information,” including answers to common questions and relevant definitions. The last page of the disclosure is an opt-out form, which, as in the past, is provided only of the institution (i) shares or uses in formation in a manner that triggers the opt-out requirement or (ii) chooses to provide the opt-out beyond what is required by law. An institution will need to tailor the opt-out page to accurately reflect its actual practices.

    The proposal provides guidelines regarding the appearance of the model form including font sizes, font style, spacing, paper and ink color and overall readability.

    A 60 day comment period is contemplated. If the proposed rule is published in final form, the agencies have proposed that institutions be given a one year transition period to revise privacy policies to comply with the new guidelines before losing the benefit of the prior safe harbor provisions. If you would like assistance in revising or developing privacy policy disclosures, please let someone here at the firm know.

    • Michael Tomkies and Kathleen Manley