Voglio sapere a riguardo di…

Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations B. Modifications to the Annual Privacy Notice To Reflect Statutory Changes Resulting From the FAST Act The Commission also proposed changing the Privacy Rule provisions governing how motor vehicle dealers should deliver annual privacy notices.
Section 313.5e The proposed change to 313.5a1
added a statement that 313.5e provides an exception to the general rule requiring the delivery of annual notices. Section 313.5e in turn sets forth the exception, which was taken from the FAST Act, and adopted by the CFPB in its amendments to Regulation P.34 It stated the annual notice need not be provided if 1 the financial institution has shared nonpublic personal information only in accordance with the provisions of 313.13, 313.14, and 313.15, none of which require an opt-out opportunity be provided to customers; and 2 the financial institutions disclosure policies and practices remain unchanged from the most recent privacy notice.
Proposed 313.5e2 set forth the timing for resuming delivery of the annual notice if a financial institution no longer met requirements for the exception.
The Commission received no comments on the substance of this paragraph and adopts it without modification.35

khammond on DSKJM1Z7X2PROD with RULES

C. Modifications to Scope and Definitions To Bring the Rule Into Accord With Regulation P
The Proposed Amendments changed the scope of the Privacy Rule and its definition of a financial institution in order to bring the Commissions rule into accord with Regulation P. As explained in the NPRM, when first promulgating the Privacy Rule, the Commission determined companies engaged in activities incidental to financial activities would not be considered financial institutions. 36
The Commission was the only agency to 34 See Final Rule, 83 FR 40945 August 17, 2018
available at https www.federalregister.gov/
documents/2018/08/17/2018-17572/amendment-tothe-annual-privacy-notice-requirement-under-thegramm-leach-bliley-act-regulation-p.
35 As discussed above, NADA argued that the word loan should be replaced with retail installment sale contract. As discussed above, the Commission wishes the remaining examples in the final rule to be identical to those found in Regulation P and declines to make these changes.
In addition, the National Independent Automobile Dealers Association noted that most dealers will not be required to provide annual notices because of their lack of ongoing relationships with their consumers, but supported the amendments in general.
36 See 16 CFR 313.3k; see also 65 FR 33654.

VerDate Sep<11>2014

16:33 Dec 08, 2021

Jkt 256001

adopt this restrictive definition in its Privacy Rule, while the other agencies included incidental activities. In addition, the Commission decided activities determined to be financial in nature after the enactment of the GLBA
would not be automatically included in its Privacy Rule; rather, the Commission would have to take additional action to include them.37 The effect of these two decisions was to limit the activities covered by the Commissions rules to those set out in 12 CFR 225.28 as it existed in 1999, and to exclude any activities later determined by the Fed to be financial activities or incidental to those activities.38
The Commission proposed modifying the definition of financial institution to harmonize the Privacy Rule with other agencies rules. The Commission proposed to amend 313.1b to include companies that engage in activities financial in nature or incidental to such financial activities in the scope of the rule. Likewise, it proposed amending the definition of financial institution in 313.3k, to include any institution the business of which is engaging in an activity that is financial in nature or incidental to such financial activities.
The effect of this proposed amendment would be to cause finders to be included in this definition, thereby bringing the Privacy Rule into harmony with the scope of entities covered by other agencies under Regulation P.
The Commission received only two comments that addressed this proposed change in the Privacy Rule.39 NADA
asked whether the proposed rule would apply to finders acting for a motor vehicle dealer.40 As discussed above, the Commissions Privacy Rule applies only to motor vehicle dealers and so would apply only to finders that are also motor vehicle dealers. If a finder is not itself a motor vehicle dealer then the rule does not apply, even if the finder is acting to connect motor vehicle dealers with potential customers. Given that this scenario is unlikely, modifying the definition of financial institution for purposes of the Privacy Rule has little practical effect. Nevertheless, the Commission is modifying the definition for purposes of consistency with Regulation P and the Safeguards Rule.
An individual consumer asked how often an entity must engage in an 37 65

FR 33654 n.23.

38 Id.
39 Several other entities commented on the expansion of the definition of a financial institution in the Safeguards Rule. These comments are addressed in the discussion of the final Safeguards Rule, published elsewhere in this issue of the Federal Register.
40 NADA comment 9, at 78.

PO 00000

Frm 00047

Fmt 4700

Sfmt 4700

70023

incidental activity to be considered a financial institution.41 As with other financial activities under the existing rule, an entity is a financial institution only if it is significantly engaged in the incidental activities.
The Commission adopts the proposed amendment without change.
Section 313.15a4
Finally, the Commission proposed to amend 313.15a4 to add the CFPB to the list of law enforcement agencies to which financial institutions are permitted to share information to the extent permitted by law. The Commission received no comments on this change and adopts it as proposed.
Section 313.18
Section 313.18 set forth the effective date for the rule and prescribed requirements for institutions compliance with the rule as to customers who were already customers at the time the rule was first promulgated. The relevant dates have long since passed. Section 313.18a2
also provided an exception, stating this part is not effective as to any institution that is significantly engaged in activities that the Federal Reserve Board determines, after November 12, 1999 . . . are activities that a financial holding company may engage in, until the Commission so determines. As discussed above, the Commission has determined herein that this rule applies to financial institutions that engage in activities financial in nature or incidental to such financial activities, including entities significantly engaged in activities the Federal Reserve Board has determined, after November 12, 1999, are activities a financial holding company may engage in. Accordingly, the final rule removes 313.18 in its entirety.
III. Paperwork Reduction Act Under the Paperwork Reduction Act of 1995 PRA,42 Federal agencies are generally required to seek Office of Management and Budget OMB
approval for information collection requirements prior to implementation.
Under the PRA, the Commission may not conduct or sponsor, and, notwithstanding any other provision of law, a person is not required to respond to an information collection, unless the information collection displays a valid control number assigned by OMB.
This amendment modifies 16 CFR
part 313. The collections of information related to the Privacy Rule and the 41 Qiyi 42 44

E:FRFM09DER1.SGM

Hu comment 5.
U.S.C. 3501 et seq.

09DER1