House Debates 'Eliminate Privacy Notice Confusion Act'

Comment | Print | RSS

• Login to Rate

The Act would amend the Gramm-Leach-Bliley Act (GLBA) to relieve some financial institutions of some of their data privacy notification responsibilities. The amendment would not apply to data breach notification responsibilities. It would apply only to the basic annual notices describing privacy policies that financial institutions must send to customers every year, even if their privacy policies hadn't changed since the last notice. For example, it would exempt state-licensed institutions that are already subject to state privacy protection law.

Proponents for the Act say that the annual privacy notices are an unnecessary expense for financial institutions. Representative Edward Markey, a democrat from Massachusetts, disagreed. Marky participated in the passage of the original GLBA when it was passed in 1999, and claims to be partly responsible for the privacy rules that were included in GLBA then. During the proceedings about H.R. 5817 Monday, Markey warned that "There is a looming privacy catastrophe coming in this country" and criticized banks for claiming that the current rules about annual notifications are so onerous.

"The amount of information we get, at home from these banks -- massive, as you know," said Markey, in the proceedings. "You open up your mailbox every day and there's like 25 solicitations from financial institutions all across the country. They've got loads of money to do that; loads of money... but if you ask them to just provide a scintilla of information on what privacy rights they have in terms of protecting all of their family's secrets they have inside that financial information, the banks say 'Oh no, that's too expensive. We can't do that, how can you afford that?' "

After 40 minutes of discussion on Monday, the House Chair decided that they'd postpone further proceedings about H.D. 5817. In the meantime, tell us your opinions. Do you think that this Eliminate Privacy Notice Confusion Act is a necessary, legitimate measure? Do you think it's just an example of financial institutions pouting? What impact, if any, would there be on customers if they no longer received annual reminders about their data privacy rights and their financial institution's data privacy protection policies and practices? After all, this act would not eliminate breach notifications, which are surely more important.

Personally, no matter what they decide, I'd just like the notices to be typed in a font size that's large enough to read without a microscope and be slightly translated from "legalese" to English.