Gramm-Leach-Bliley Act Annual Privacy Notices

BULLETIN 22-IB-1-3/31 TO: ALL INSURERS LICENSED TO WRITE BUSINESS IN THE DISTRICT OF COLUMBIA FROM: KARIMA WOODS, COMMISSIONER DATE: MARCH 31, 2022 SUBJECT: GRAMM-LEACH-BLILEY ACT ANNUAL PRIVACY NOTICES The purpose of this Bulletin is to set forth the views of the Department regarding amendments to the federal Gramm-Leach-Bliley Act (“GLBA”) that eliminate the requirement for redundant GLBA annual privacy notices. On December 4, 2015, the Fixing America’s Surface Transportation Act (“FAST Act”) was enacted into law by Congress. The FAST Act includes amendments to the GLBA eliminating the requirement that financial institutions provide GLBA annual privacy notices to their clients, provided certain conditions are met. Specifically, the amendments eliminate duplicative and costly notification requirements only. Financial institutions will continue to be required to provide initial privacy notices and notices when certain changes are made to a financial institution’s privacy policy, as required under the GLBA. In line with the recent changes to GLBA, this Bulletin is intended to clarify that a licensee of the Department that is subject to the GLBA annual notice requirement set forth at 26A DCMR § 3602 is not required to provide an annual privacy notice provided the licensee: (i) Provides nonpublic personal information to nonaffiliated third parties only in accordance with 26A DCMR §§ 3606, 3607 and 3608; and he recent changes to GLBA, this Bulletin is intended to clarify that a licensee of the Department that is subject to the GLBA annual notice requirement set forth at 26A DCMR § 3602 is not required to provide an annual privacy notice provided the licensee: (i) Provides nonpublic personal information to nonaffiliated third parties only in accordance with 26A DCMR §§ 3606, 3607 and 3608; and (ii) Has not changed its policies and practices with regard to disclosing nonpublic personal information from the policies and practices that were disclosed in the most recent disclosure sent to consumers in accordance with 26A DCMR §§ 3601 and 3602. If a licensee fails to comply with any of the criteria described in paragraph (i) or (ii) above, the licensee shall be required to provide the annual notice required under 26A DCMR § 3602. Notwithstanding, the requirement to provide initial privacy notices as required under 26A DCMR § 3601 remains in effect. In implementing either of the FAST Act amendments to GLBA, a licensee may qualify for safe harbor compliance with the privacy notice requirements in 26A DCMR §§ 3600 et seq. by using the Federal Privacy Model Form and the accompanying instructions. See 26A DCMR § 3600.5. A copy of the Federal Privacy Model Form and instructions may be found here. Any example or sample privacy notice clauses previously accepted by the Department and qualifying as a safe harbor under 26A DCMR § 3600.5 will no longer retain safe harbor status. The Federal Privacy Model Form will serve as the only qualifying safe harbor alternative to full compliance. If you have any questions regarding this Bulletin, please contact the Department at insurance.bureau@dc.gov.