BUREAU O F CONSUMER FINANCIAL PROTECTION

PAPERWORK REDUCTION ACT SUBMISSION

I NFORMATION COLLECTION REQUEST

SUPPORTING STATEMENT PART A

GRAMM

- LEACH

- BLILEY ACT (REGULATION P) 12 CFR 1016 ( OMB CONTROL NUMBER : 3170

- 0010 )

OMB TERMS OF CLEARANCE:

Not applicable. The Office of Management and Budget (OMB) did not provide Terms of Clearance when approved this information collection on July 25 , 2012.

ABSTRACT:

Section 502 of the Gramm

- Leach

- Bliley Act (GLBA) (Pub. L. 106

- 102) generally prohibits a financial institution from sharing nonpublic personal information about a consumer with nonaffiliated third parties unless the institution satisfies various disclosure requirements (including provision of initial privacy notices, annual notices, notices of revisions to the institution's privacy policy, and opt

- out notices) and the consumer has not elected to opt out of the information sharing. The Consumer Financial Pro tection Bureau ( CFPB ) promulgated regulation P 12 CFR 1016 to implement the GLB Act's notice requirements and restrictions on a financial institution's ability to disclose nonpublic personal information about consumers to nonaffiliated third parties.

A. JUSTIFICATION

1. Circumstances Necessitating the Data Collection

Regulation P implements the requirements of GLBA to provide consumers with financial institutions’ privacy policies and practices, as well as describing when the consumer’s

information may be shared with nonaffiliated third parties, and provides a method for consumers to prevent disclosure of their information to non

- affiliated third parties by “opting out” of that disclosure. Regulation P details the specifics of how GLBA should be imp lemented, which companies and situations this applies to, and the method of delivering the information to

consumers.

Regulation P includes model forms that can be used to comply with the disclosure requirements of the GLBA and Regulation P, although use o f the model forms is not required

. See Appendi x to Regulation P.

2. Use of the I nformation

Consumers use the privacy notice to determine whether they want personal information disclosed to third parties that are not affiliated with the institution. Further, consumers use the2 opt

- out not ice mechanism to advise the institution of their wishes reg arding disclosure of their personal information. Institutions use the opt

- out information to determine the wishes of their

consumers and to act in accordance with their customers’ instructions. The CFPB, the F ederal Trade Commission (F TC ) , and the Prudent ial Regulators all enforce against the requirements of Regulation P to ensure privacy notices are being mailed out and that consumers’ preferences are being followed with respect to opting out of information

sharing.

3. U se of I nformation T echnology

The collections are disclosures, filings from consumers, and internal institution records. Institutions are not prohibited from using any technology that facilitates consumer understanding and response, and that permits review, as appropriate, by examiners.

4. Efforts to I dentify Duplication

The collections of information are unique and cover the institution’s particular circumstances. No duplication exists with any other federal information collection or program

.

5

. Efforts to Minimize Burdens on Small Entities

The information collection requirements do not impose any significant burden beyond that required by statute. In addition, as directed by s ection 728 of t he “ Financial Services Regulatory Relief Act of 2006 ” (Pub. L. No. 109

- 351) , section 1016. 2 and Appendix A provide a model form for th e disclosures

, which may be used at the opti on of the financial institution

. Use

of the model form should minimize the burden of this collection

. Further, in 2014, the Bureau

issued a rule Published October 28, 2014 at 79 FR 64057

, to allow financial institutions to use an alternative delivery method to provide annual privacy notices through posting the annual notices on their Web sites if they meet certain conditions. Use of the alternativ e delivery method should

also minimize the burden of this collection.

6. Consequences of Less Frequent Collection and Obstacles to Burden Reduction

The information collection requirements closely follow the GLB Act, which requires institutions to provide an annual notice of their privacy policies and practices to their customers

, and to permit customers to opt

- out of the disclosure of their personal information. There is no flexibility under the GLB Act to colle ct the information less frequently.

7

. Circumstances Requiring Special Information Collection

Not applicable. The collections of information in Regulation P are consistent with the applicable guidelines contained in 5 CFR 1320. 5(d)(2).

8. Consultat ion Outside the Agency3 A notice of proposed rulemaking amending Regulation P was published in the Federal Register (79 FR 27214) on May 13, 2014. The Bureau proposed to allow financial institutions to use an alternative delivery method to provide annual privacy notices through posting the annual

notice s on their Web sites if they me t certain conditions. The NPRM provided the general public the opportunity to comment on the Bureau’s analysis of the extent to which the alternative delivery method would reduce the burden from the information collections associated with the annual notice and opt

- out notice. The Bureau received comments on its analysis which it addressed in the final rule, published in the Federal Register (79 FR 64057) on October 28, 2014.

In addition, i n accordance with 5 CFR §1320.8(d)(1), the Bureau has published a notice Federal Regist er allowing the public 60 days to comment on this proposed the extension (renewal) of this currently approved collection of information. Further and in accordance with 5 CFR §1320.5(a)(1)(iv), the Bureau will also publish a notice in the Federal Register a llowing the public 30 days to comment on the submission of this information collection request to the Office of Management and Budget.

9. Payment s or Gifts to R espondents

No payments or gifts are provided to respondents.

10. Assurance s of C onfidential ity

The recordkeeping and written disclosure requirements contain private information about

consumers who opt out of disclosure of their information to third

- parties . Such information is protected by the Right to Financial Privacy Act, 12 U.S.C. 3401 et seq . Such records may also

constitute confidential customer lists. However, there is no part of the rule that mandates information collection by the CFPB. To the extent that information covered by a requirement of Regulation P is collected by

the CFPB fo r law enforcement purposes, the confidentiality provisions of CFPB’s rules on Disclosure of Records and Information, 12 CFR Part 1070

, would apply.

11. Justification for S ensitive Questions

Regulation P requires institutions to ascertain whether consumers want to opt out of

third

- party information sharing, which can constitute a collection of sensitive information

. This requirement is necessary to ensure consumers are given an option about what is done with their personal financial information, a nd is used for consumers’ protection and privacy.4 12. Estimated Burden of Information Collection

Hours: 366,134

Exhibit 1: Burden Hour Summary

All Bureau Respondents (DI and Non

- DI) Bureau Portion

Information Collection
Requirement No. of
Respondents Annual

Frequency Annual

Responses Average
Response

Time (hrs.) Annual

Burden

Hours Annual

Responses Average
Response

Time Annual

Burden

Hours

Initial Notice §1016.4(a) 2,105 1 2,105 14.5 30,523 1,055 14.5 15,298

Annual and Revised
Notices and Opt

- Out

Notice §1016.5(d), §1016.7,

§1016.8 29,544 1 29,544 7.28 215,054 14,844 11 157,482

Consumer Opt

- Out

Notice

§1016.7 29,544 14.66 433,216 0.25 108,304 433,216 0.25 108,304

Changes to Privacy

Policies and Disclosures (Ongoing)

§1016.8 420 1 420 10 4,200 210 10 2,100

Creating Disclosure

Documents 2,100 1 2,100 3 6,300 1,050 3 3,150

Reviewing Internal GLBA Policies (Initial) 2,100 1 2,100 20 42,000 1,050 20 21,000

Reviewing Internal

GLBA Policies (Ongoing) 29,400 1 29,400 4 117,600 14,700 4 58,800

Totals: 29,544 466,125 366,134

For PRA purposes, the CFPB assumes all burden for depository institutions with more than $10 billion in assets as well as their affiliates, for which CFPB has primary enforcement authority with respect to regulation P. In addition, t he CFPB and Federal Trade Commission (FTC) share enforcement authority for those non

- depository institutions subject to the CFPB’s regulation P.

Associated Labor Costs: $ 14,046,529

The Bureau used an overall hour ly average wage of $38.36 for the burden associated with

these information collections , which multiplied by the CFPB burden hours amounts to $14,046,529 in labor costs . Specifically, the Bureau estimates on average each hour requires5 20% administration at $16.99/hour, 45% management at $37.79/hour, 20% senior management at $48.87/hour, and 15% legal at $54.58/hour. 1

13. Estimate d Total Annual Cost Burden to Respondents or Recordkeepers

There are no additional material s costs for this regulation.

14. Estim ate d C ost to the F ederal G overnment

As the CFPB does not collect any information, t here are no additional costs to the Federal

Government.

15. Program Changes or Adjustments

Exhibit 3: Summary of Burden Changes table

Total Respondents Annual Responses Burden Hours Cost Burden (O & M)

Total Annual Hours Requested 29,544 466,125 366,134 0

Current OMB Inventory 13,100 467,213 254,096 0

Difference (+/

- ) 16,444

- 1,088 112,038 0

Program Change 0 0 0

Discretionary 0 0 0

Due to New Statute 0 0 0

Violation 0 0 0

Adjustment 16,444

- 1,088 112,038 0

A nalysis by the Bureau of previously stated burden shows that the initial total burden

was a 112,038 hours greater than previous stated . Thus, the Bureau is adjusting the current burden to be (254,096 + 112,038=) 366,134 hours. The change in th e number of respondents reflects an improved methodology of calculation, and therefore the new requests should be seen as a more accurate representation of

the true effect of Regulation P.

16. Plans for Tabulation, Statistical Analysis, and Publication

There are no plans to provide any publications based on the information collection of this regulation.

1 See respectively http://www.bls.gov/ooh/office

- and

- administrative

- support/secretaries

- and

- administrative

assistants.htm

, http://www.bls.gov/ooh/business

- and

- financial/management

- analysts.htm

, http://www.bls.gov/ooh/management/top

- executi ves.htm

, http://www.bls.gov/ooh/legal/lawyers.htm

.6 17. Display of E xpiration D ate

The OMB control number and expiration date associated with this PRA submission will be displayed on the Federal government’s electronic PRA docket at www.reginfo.gov , as well as in the Federal Register Notice of the submission. Inasmuch as all forms assoc iated with this collection are model forms and therefore their use is voluntary, the display of the OMB control number would not be appropriate on them

18. Exceptions to the C ertification Requirement

The Bureau certifies that this collection of informa tion is consistent with the requirements of 5 CFR 1320.9, and the related provisions of 5 CFR 1320.8(b)(3) and is not seeking an exemption to these certification requirements.