Newsroom

February 14, 2023

NAFCU, trades flag GLBA data privacy concerns to CFPB

Govt building columnsNAFCU joined with other financial services industry trade groups Monday to highlight concerns about a New Jersey Superior Court order that would force a bank to disclose personal information of its 43,000 member-depositors to an unaffiliated, unregulated third party.

Spencer Savings Bank – a mutual thrift, which, much like a credit union, is owned by its member-depositors – is being ordered to break Gramm-Leach-Bliley Act (GLBA) data privacy requirements in the court’s Seidman v. Spencer Savings Bank decision. The Superior Court granted a request from Seidman’s counsel to force the bank to provide the names and contact information of each member-depositor to Seidman’s proxy solicitor.

NAFCU previously flagged this issue for members in a post on the association’s Compliance Network, noting that according to section 502 of the GLBA, any institution required to follow the law – including credit unions and mutual thrifts – cannot release “account holders’ nonpublic personal information to parties and for purposes other than those carefully described in its privacy policy.”

In the letter sent Monday to the CFPB, the trade groups called on the bureau to track this lawsuit and similar legislation and partner with state financial regulators to uphold the GLBA.

“It is obvious that many state financial regulators lack the capacity to effectively implement, enforce, and defend the GLBA,” the groups wrote. “In these instances, the Associations strongly urge the CFPB to more fully partner with state financial regulators and take other action as appropriate to uphold the GLBA and to issue guidance providing that states may not flout Regulation P’s requirements through legislative, regulatory, executive, or judicial means.”

Relatedly, the House Financial Services Subcommittee on Financial Institutions and Monetary Policy last week discussed data privacy legislation being worked on by Chairman Patrick McHenry, R-N.C, that would amend the GLBA. The bill contains robust state pre-emption that is part of NAFCU’s principles for a federal data privacy standard.

NAFCU will continue to monitor this issue and advocate for a national data privacy standard.