2024-01002. Agency Information Collection Activities; Proposed Collection; Comment Request; Extension

AGENCY:

Federal Trade Commission.

ACTION:

Notice.

SUMMARY:

In accordance with the Paperwork Reduction Act of 1995 (PRA), the Federal Trade Commission (FTC or Commission) is seeking public comment on its proposal to extend for an additional three years the current Paperwork Reduction Act (PRA) clearance for its information collection requirements in the Privacy of Consumer Financial Information Rule (Privacy Rule or Rule). The current clearance expires on January 31, 2024.

DATES:

Comments must be filed by February 20, 2024.

ADDRESSES:

Interested parties may file a comment online or on paper, by following the instructions in the Request for Comment part of the SUPPLEMENTARY INFORMATION section below. Written comments and recommendations for the proposed information collection should be sent within 30 days of publication of this notice to www.reginfo.gov/​public/​do/​PRAMain. Find this particular information collection by selecting “Currently under 30-day Review—Open for Public Comments” or by using the search function. The reginfo.gov web link is a United States Government website produced by the Office of Management and Budget (OMB) and the General Services Administration (GSA). Under PRA requirements, OMB's Office of Information and Regulatory Affairs (OIRA) reviews Federal information collections.

FOR FURTHER INFORMATION CONTACT:

Jennifer Rimm, Attorney, Division of Privacy and Identity Protection, Bureau of Consumer Protection, Federal Trade Commission, (202) 326–2277, [e-mail].

SUPPLEMENTARY INFORMATION:

Title: Privacy of Consumer Financial Information (Gramm-Leach-Bliley Act Privacy Rule), 16 CFR part 313.

OMB Control Number: 3084–0121.

Type of Review: Extension without change of currently approved collection.

Affected Public: Private Sector: Businesses and other for-profit entities.

Abstract:

The Privacy Rule is designed to ensure that customers and consumers, subject to certain exceptions, will have access to the privacy policies of the covered financial institutions with which they conduct business—namely, motor vehicle dealers that do not routinely extend credit to consumers directly without assigning the credit to unaffiliated third parties (hereafter, “motor vehicle dealers”). As mandated by the Gramm-Leach-Bliley Act (“GLBA”), 15 U.S.C. 6801–6809, the Rule requires motor vehicle dealers to disclose to consumers: (1) initial notice of the financial institution's privacy policy when establishing a customer relationship with a consumer and/or before sharing a consumer's nonpublic personal information with certain nonaffiliated third parties; (2) notice of the consumer's right to opt out of information sharing with such parties; (3) annual notice of the institution's privacy policy to any continuing customer; ^[1] and (4) notice of changes in the institution's practices on information sharing. These requirements are subject to the PRA. The Rule does not require recordkeeping. For PRA burden calculations, the FTC shares the PRA burden with the Consumer Financial Protection Bureau (CFPB) for financial institutions over which both agencies have enforcement authority under the CFPB's regulation corresponding to the Privacy Rule, titled Privacy of Consumer Financial Information (Regulation P), 12 CFR part 1016, and attributes to itself the burden for all motor vehicle dealers. See12 U.S.C. 5519.

Estimated Annual Burden Hours: 1,454,850.

Estimated Annual Labor Costs: $35,820,366.

Request for Comment

On October 18, 2023, the FTC sought public comment on the information collection requirements associated with the Rule. 88 FR 71861. No germane comments were received. Pursuant to the OMB regulations, 5 CFR part 1320, that implement the PRA, 44 U.S.C. 3501 et seq., the FTC is providing this second opportunity for public comment while seeking OMB approval to renew the pre-existing clearance for the Rule.

Your comment—including your name and your state—will be placed on the public record of this proceeding. Because your comment will be made public, you are solely responsible for making sure that your comment does not include any sensitive personal information, such as anyone's Social Security number; date of birth; driver's license number or other state identification number, or foreign country equivalent; passport number; financial account number; or credit or debit card number. You are also solely responsible for making sure that your comment does not include any sensitive health information, such as medical records or other individually identifiable health information. In addition, your comment should not include any “trade secret or any commercial or financial information which . . . is privileged or confidential” —as provided by section 6(f) of the FTC Act, 15 U.S.C. 46(f), and FTC Rule 4.10(a)(2), 16 CFR 4.10(a)(2)—including in particular competitively sensitive information such as costs, sales statistics, inventories, formulas, patterns, devices, manufacturing processes, or customer names.

Josephine Liu,

Assistant General Counsel for Legal Counsel.

Footnotes

1.  On December 4, 2015, Congress amended the GLBA as part of the Fixing America's Surface Transportation Act (“FAST Act”). This amendment, titled Eliminate Privacy Notice Confusion (FAST Act, Pub. L. 114–94, section 75001) added new GLBA section 503(f). This subsection provides an exception under which financial institutions that meet certain conditions are not required to provide annual privacy notices to customers. Section 503(f) requires that to qualify for this exception, a financial institution must not share nonpublic personal information about customers except as described in certain statutory exceptions, under which sharing does not trigger a customer's statutory right to opt out of the sharing. In addition, section 503(f)(2) requires that the financial institution must not have changed its policies and practices with regard to disclosing nonpublic personal information from those that the institution disclosed in the most recent privacy notice the customer received. On December 9, 2021, the Privacy Rule was amended at 16 CFR 313.5(e) to incorporate this exception. The amendments were effective January 10, 2022. 86 FR 70020 (Dec. 9, 2021).