Pillar 3 and CFPB Privacy Compliance

Dear Fund Member:

I have just completed two months of trips around the state to visit with Members and talk with them about the new TRID rules (the new nomenclature for the CFPB rules that go into effect August 1, 2015). There were several consistent themes: most Members were aware that changes were coming, but they weren't familiar with all of the details; the 3-day advance delivery of the Closing Disclosure is going to present some real logistical challenges to a smooth closing; lenders are also going to have to significantly change their processes and procedures.

Several members had questions about email encryption. Members are concerned about complying with what they think is a requirement of the new CFPB rules that their emails be encrypted. So, let me address this issue first. There is no requirement for encrypted emails in the new CFPB rules. The new rules require that lenders take reasonable measures to ensure the protection of private, non-public information (NPI) of their consumers by all of the settlement services providers that are used in connection with the loan. In addition, the Gramm-Leach-Bliley Act requires that a title agent have a written information security program. Although Florida does not currently have any statutes directly on point, attorneys are required to follow the Rules Regulating Florida Bar 4-1.6 Confidentiality of Information. Both attorneys and title agents also have a common law fiduciary duty to protect non-public personal information. It should be noted that there are other statutes and regulations that concern record keeping and protection. Therefore, one of the recommendations by ALTA in their Best Practices (Pillar 3) is that Members adopt “secure delivery methods when transmitting Non-public Personal Information.” This could be encrypted email. It could also be by fax. Yes, the fax machine may be making a big comeback...

We are developing a more involved video presentation about compliance with Pillar 3 that should be released within the next month. The areas to be covered will go beyond encrypted emails! We hope that you will find this video presentation useful as you address lenders’ concerns about the protection of private, non-public information in the context of your office procedures.

In the meantime, consider taking the following steps in your office that doesn't require new software programs or changes to your technology:

1. Background checks on all employees with access to NPI.

2. Password protect devices (computers, etc) that may contain files with NPI.

3. Close paper and electronic files containing NPI when staff is away from their desk.

4. Lock a computer when a staff person is away from their desk.

5. At the end of the workday, all paper documents and files should be put away and locked in a drawer or file cabinet.

6. At the end of the workday, all devices should be shut down (and be password protected).

These are just a very few of the non-technical things you can do to be more proactive in the protection of private information in your office. For a more complete discussion, look at Linda Monaco’s article in the January 2015 Fund Concept. We also have a one-hour On-Demand Fundinar, Record Retention & Disposal: Put it in Writing, which addresses non-public personal information and how to keep and dispose of the same. Watch the Fundinar.

I hope that you find the information in this email helpful. August 1st is just around the corner. The Fund is working every day to provide you with assistance and support in your journey to be ready.

I cannot sign off without thanking you for being a Member of The Fund. Thank you!

Best Regards,

Melissa Jay Murphy
Senior Vice President
and General Counsel

¹Rules Regulating Florida Bar 4-1.6 confidentiality of Information

16 C.F.R. Pt. 314 – Standards for Safeguarding Customer Information

I.R.S. Publication 583 Starting a Business and Keeping Records, 1 & 15