Privacy and Personal Information

Position

• ICBA supports privacy measures that hold all entities that handle personal information to the same standards community banks and other financial institutions are held to through the Gramm-Leach-Bliley Act (“GLBA”) and other financial regulatory oversight.
• ICBA supports GLBA entity-level exemption from proposed state and national privacy laws.
• ICBA supports a national privacy standard as opposed to a patchwork of state privacy acts and standards.
• ICBA has significant concerns about the privacy implications to consumers stemming from recently promulgated and proposed regulations, including sections 1071 and 1033 of the Dodd-Frank Act.

Background

Community banks collect sensitive nonpublic personally identifiable information (“PII”) about customers to meet their banking needs. Safeguarding customer information is central to community banks maintaining public trust and retaining customers.

Third Party and Non-Bank Privacy Standards. Due to a lack of standards for safeguarding nonpublic PII, customers have limited control over their personal and financial information held by entities outside of the financial services industry. ICBA supports privacy measures that hold all entities that handle PII to GLBA-like privacy protections.

GLBA Exemption. ICBA supports an entity-level exemption for community banks from proposed laws due to the strict privacy requirements in GLBA and stringent enforcement by federal regulators. The patchwork of state privacy laws creates an unnecessarily burdensome and duplicative regulatory environment that does not serve to better protect customer privacy. It is important to maintain one national standard as opposed to many complex and potentially competing state-level standards.

Recent Regulations. ICBA is concerned that the privacy implications in sections 1071 and 1033 of the Dodd Frank Act will compromise consumers’ privacy. Section 1071 requires lenders to collect and report data on small business loan applications. This risks the privacy and reidentification of borrowers, especially those in rural areas. Section 1033 results in more entities accessing and transferring banking data, thereby increasing the possibility that data privacy will be compromised.