CONSUMER FINANCIAL PROTECTION BUREAU
REQUEST FOR EMERGENCY PROCESSING AND APPROVAL
PRIVACY OF CONSUMER FINANCIAL INFORMATION
(REGULATION P) 12 CFR 1016
EMERGENCY JUSTIFICATION
The Bureau of Consumer Financial Protection (CFPB) respectfully requests emergency processing and approval of the collection of information discussed below because the use of normal clearance procedures is reasonably likely to prevent and disrupt an existing collection of information.
Subtitle A of Title V of the Gramm-Leach-Bliley Act (GLB Act),1 captioned “Disclosure of Nonpublic Personal Information,” limits the instances in which a financial institution may disclose nonpublic personal information about a consumer to nonaffiliated third parties and requires financial institutions to provide certain privacy notices to their consumers and customers.2 Historically, rulemaking authority for the privacy provisions of the GLB Act has been shared by eight federal agencies: the Board of Governors of the Federal Reserve System (Board), the Federal Deposit Insurance Corporation (FDIC), the Federal Trade Commission (FTC), the National Credit Union Administration (NCUA), the Office of the Comptroller of the Currency (OCC), the Office of Thrift Supervision (OTS), the Securities Exchange Commission (SEC), and the Commodity Futures Trading Commission (CFTC). Each of the agencies issued rules (which were consistent and comparable) to implement the GLB Act’s privacy provisions.3
The Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act)4 amended a number of consumer financial protection laws, including the GLB Act. Among other changes, the Dodd-Frank Act transferred rulemaking authority for most of Subtitle A of Title V of the GLB Act from the Board, FDIC, FTC, NCUA, OCC, and OTS to the CFPB, effective July 21, 2011. In addition to the transfer of rulemaking authority under the Dodd-Frank Act, the CFPB received certain enforcement authorities with respect to the GLB Act.
Pursuant to the Dodd-Frank Act and the GLB Act, as amended, the CFPB is in the process of publishing for public comment an interim final rule establishing a new Regulation P (Privacy of Consumer Financial Information) in 12 CFR Part 1016, implementing those privacy provisions of the GLB Act for which the CFPB has rulemaking authority. This interim final rule substantially replicates the rules previously issued by the transferor agencies, and will not impose any new substantive obligations on regulated entities or any new information collection requirements.
As the CFPB now has enforcement authority over certain populations that have been under the jurisdiction of other agencies, the CFPB is requesting approval of a new OMB control number for its collection activities under Regulation P. To prevent disruptions of approved information collections, the CFPB is requesting emergency processing and approval of the following information collection request. Upon receipt of emergency approval from the Office of Management and Budget, the CFPB will begin a standard approval process for this collection and will seek public input at that time.
CONSUMER FINANCIAL PROTECTION BUREAU
INFORMATION COLLECTION REQUEST – SUPPORTING STATEMENT
PRIVACY OF CONSUMER FINANCIAL INFORMATION
(REGULATION P) 12 CFR 1016
(OMB CONTROL NUMBER: 3170-XXXX)
A. JUSTIFICATION
1. Circumstances Necessitating the Data Collection
Section 502 of the Gramm-Leach-Bliley Act (GLB Act) (Pub. L. 106-102) generally prohibits a financial institution from sharing nonpublic personal information about a consumer with nonaffiliated third parties unless the institution satisfies various disclosure requirements (including provision of initial privacy notices, annual notices, notices of revisions to the institution’s privacy policy, and opt-out notices) and the consumer has not elected to opt out of the information sharing. The CFPB is promulgating regulations to implement the GLB Act’s notice requirements and restrictions on a financial institution’s ability to disclose nonpublic personal information about consumers to nonaffiliated third parties.
2. Use of the Information
Consumers use the privacy notice to determine whether they want personal information disclosed to third parties that are not affiliated with the institution. Further, consumers use the opt-out notice mechanism to advise the institution of their wishes regarding disclosure of their personal information. Institutions use the opt-out information to determine the wishes of their consumers and to act in accordance with their customers’ instructions.
3. Use of Information Technology
The collections are disclosures, filings from consumers, and internal institution records. Institutions are not prohibited from using any technology that facilitates consumer understanding and response, and that permits review, as appropriate, by examiners.
4. Efforts to Identify Duplication
The collections of information are unique and cover the institution’s particular circumstances. No duplication exists.
5. Efforts to Minimize Burdens on Small Entities
The information collection requirements do not impose any significant burden beyond that required by statute. In addition, as directed by section 728 of the “Financial Services Regulatory Relief Act of 2006” (Pub. L. No. 109-351), section 1016.2 and Appendix A provide a model form for the disclosures, which may be used at the option of the financial institution. Use of the model form should minimize the burden of this collection.
6. Consequences of Less Frequent Collection and Obstacles to Burden Reduction
The information collection requirements closely follow the GLB Act, which requires institutions to provide an annual notice of their privacy policies and practices to their customers, and to permit customers to opt-out of the disclosure of their personal information. There is no flexibility under the GLB Act to collect the information less frequently.
7. Circumstances Requiring Special Information Collection
Not applicable. The collections of information in Regulation P are consistent with the applicable guidelines contained in 5 CFR 1320.5(d)(2).
8. Consultation Outside the Agency
This Supporting Statement is based on the Office of the Comptroller of the Currency’s (OCC’s) most recent Supporting Statement for OMB Control Number 1557-0216 (Privacy of Consumer Financial Information (12 CFR 40)). The CFPB has consulted with the Board, the FDIC, the OCC, the NCUA, and the FTC with respect to burden allocations. As this is a request for emergency processing and approval of the transfer of certain burdens from existing information collections to the CFPB, the CFPB has not sought public comment on this information collection request. Upon receipt of OMB’s emergency approval, the CFPB will begin the standard approval process and will seek public input at that time.
9. Payments or Gifts to Respondents
Not applicable.
10. Assurances of Confidentiality
Not applicable.
11. Justification for Sensitive Questions
There are no questions of a sensitive nature.
12. Estimated Burden of Information Collection
Hours: 516,000
CFPB’s estimate of the burden for ongoing recordkeeping and disclosure requirements under Regulation P is based on the assumption that the total ongoing burden for this regulation, across all agencies, remains the same as it was before the regulation was restated by the CFPB. Prior to the passage of the Dodd-Frank Act, the ongoing recordkeeping and disclosure burdens for Regulation P allocated to the prudential regulators and the FTC were approximately 6,272,000 hours.5 In light of the changes made by the Dodd-Frank Act, roughly 516,000 hours of that burden is being reallocated to the CFPB. Specifically, CPPB is being allocated burden for 180 depository institutions (comprising depository institutions with total assets of more than $10 billion and their depository affiliates) which is the approximate number of such depository entities that the CFPB now has primary enforcement authority for with respect to Regulation P.6 The CFPB is also being allocated half of the Federal Trade Commission (FTC) burden amount after subtracting the burden which the FTC has attributed to itself for motor vehicle dealers.7
Associated Labor Costs: $ 12,043,000
The CFPB calculated labor costs by applying appropriate hourly cost figures to the burden hours described above. The hourly rates used are those associated with the burden hours assumed from the other regulatory agencies, which differ by agency.
The CFPB estimates that the ongoing recordkeeping and disclosure costs allocated to the CFPB under Regulation P are $12,043,000. This estimate was calculated by summing the CFPB’s share of costs from the supporting statements of the other agencies, following each agency’s own cost analysis. For a detailed breakdown of the cost analysis, please reference the other agencies’ supporting statements for Regulation P.
13. Estimated Total Annual Cost Burden to Respondents or Recordkeepers
None.
14. Estimated Cost to the Federal Government
As the CFPB does not collect any information, the cost to the CFPB is negligible.
15. Program Changes or Adjustments
None.
16. Plans for Tabulation, Statistical Analysis, and Publication
Not applicable.
17. Display of Expiration Date
Not applicable.
18. Exceptions to the Certification Requirement
None.
B. COLLECTIONS OF INFORMATION EMPLOYING STATISTICAL METHODS
Not applicable.
1 Codified at 15 U.S.C. 6801-6809.
2 15 U.S.C. 6802-6803(a).
3 12 CFR 216 (Board); 12 CFR 332 (FDIC); 16 CFR 313 (FTC); 12 CFR 716 (NCUA); 12 CFR 40 (OCC); 12 CFR 573 (OTS); 17 CFR 248 (SEC); 17 CFR 160 (CFTC).
4 Pub. L. 111–203, 124 Stat. 1376 (2010).
5 For purposes of the current request for emergency review and approval, the CFPB has relied on the estimates previously developed by the Board, OCC, OTS, FDIC, NCUA, and FTC concerning the number of entities subject to Regulation P and the hours of paperwork burden under the statute (for a detailed breakdown of the burden estimates of the prudential regulators and the FTC, please reference the other agencies’ supporting statements for Regulation P which can be found at www.reginfo.gov). The CFPB’s enforcement authority is not necessarily limited to the entities covered by these agencies’ estimates. In some instances, information regarding actual burden hours or dollar costs, or breakdowns of these hours or costs was not available from the other agencies. In these cases, CFPB has estimated the relevant figures based on data provided by the OCC and in some cases by the Board. The CFPB will conduct a more detailed review of burden allocations and provide more detailed estimates in its follow-up application to OMB for a standard approval of this information collection.
6 These include 27 from the Board, 70 from the OCC, 24 from the OTS, 3 from the NCUA, and 56 from the FDIC.
7 The Dodd-Frank Act exempts certain motor vehicle dealers from CFPB’s enforcement authority. However, due to the difficulty of making a reliable estimate of those dealers, the FTC has attributed to itself the PRA burden for all motor vehicle dealers. This attribution does not change actual enforcement authority.
| File Type | application/msword |
| File Modified | 2011-10-24 |
| File Created | 2011-10-24 |