Under a new proposal issued by the Consumer Financial Protection Bureau (CFPB), financial institutions could avoid the requirement to mail an annual privacy notice to customers by instead referring them to an online notice, which is posted “in a clear and conspicuous manner” on the bank’s website.

“Consumers need clear information about how their personal information is being used by financial institutions,” CFPB Director Richard Cordray said in a statement. “This proposal would make it easier for consumers to find and access privacy policies, while also making it cheaper for industry to provide disclosures.”

The Gramm-Leach-Bliley Act (GLBA) mandates that financial institutions provide customers with details about how their nonpublic personal customer information is collected, used, and disclosed as well as whether customers can limit disclosures to third parties. Currently, the rule requires that an annual notice be provided via mail.

But, in what the CFPB said was an attempt to improve privacy notices and save financial institutions money, the agency would offer an alternative. In order to qualify for the incentive, certain requirements must be met.

Institutions would still need to provide a brief disclosure in another customer communication (such as a billing statement) that the institution’s policy is available online and in paper by request at a toll-free number. The policy itself must be posted “in a clear and conspicuous manner” on the bank’s website.

Most significantly, financial institutions would need to track the model privacy policy developed by regulators as provided in Regulation P and agree not to share a customer’s nonpublic personal information with nonaffiliated third parties in a manner that triggers GLBA opt-out rights. The notice – which cannot have changed since the last time it was provided to customers – must also not include an opt-out pursuant to the Fair Credit Reporting Act (FCRA) or serve as the institution’s only notice to satisfy FCRA requirements.

While touting the benefits to consumers of constant access to privacy policies and the ability to comparison shop among institutions with regard to privacy issues, the CFPB estimated that the switch could save banks up to $17 million each year by avoiding annual mailings.

The proposal is currently open for public comment.

To read the proposal, click here.

Why it matters: The CFPB’s proposal would apply to both banks and nonbanks within the agency’s jurisdiction under the GLBA. Those institutions willing to meet the CFPB’s requirements could save themselves a significant amount of money and hassle by avoiding the annual privacy policy mailing requirement. Stay tuned for any additional regulatory input for banks outside the CFPB’s jurisdiction.