The Commodity Futures Trading Commission (CFTC) has published a notice in the Federal Register announcing its intent to renew an existing information collection under the Paperwork Reduction Act (PRA). This collection pertains to regulations on the privacy of consumer financial information, as required by Title V of the Gramm-Leach-Bliley Act (GLB Act). Released on December 15, 2025, in Volume 90, Number 238 of the Federal Register, the notice invites public comments until February 13, 2026. It aims to ensure that entities under CFTC jurisdiction, such as futures commission merchants and swap dealers, continue to provide privacy notices and opt-out options to consumers. This development underscores the ongoing federal effort to balance consumer data protection with regulatory efficiency, highlighting the CFTC's role as a functional regulator in financial privacy matters.
Background and Legal Foundation
The origins of this information collection trace back to the Commodity Futures Modernization Act of 2000, which amended the Commodity Exchange Act by adding Section 5g. This section designates certain CFTC-regulated entities—including futures commission merchants, commodity trading advisors, commodity pool operators, and introducing brokers—as financial institutions under the GLB Act. The GLB Act, enacted in 1999, requires financial institutions to safeguard consumer financial information and provide notices about data-sharing practices. As a result, the CFTC adopted Part 160 of its regulations in 2001, mandating these entities to issue initial and annual privacy notices, offer opt-out mechanisms for non-affiliates, and implement policies to protect customer data.
Over time, the scope expanded. In 2010, regulations extended to retail foreign exchange dealers, and in 2011, to swap dealers and major swap participants following the Dodd-Frank Act. A key amendment came in 2019, when the CFTC aligned with the Fixing America's Surface Transportation (FAST) Act by creating an exception to the annual privacy notice requirement. This exception applies if entities do not share nonpublic personal information beyond certain affiliates and have not changed their privacy policies since the last notice. These changes reflect evolving legislative priorities to reduce unnecessary burdens while maintaining protections.
Key Requirements and Burden Estimates
Under Part 160, regulated entities must provide clear privacy notices to customers and consumers, detailing how nonpublic personal information is collected, shared, and protected. They are also required to offer opt-out rights, allowing individuals to prevent sharing with non-affiliates. Additionally, firms must adopt and maintain appropriate safeguards for customer records.
The notice provides updated burden estimates for compliance. It identifies 3,399 respondents, including various CFTC registrants. Each respondent is expected to handle about 95 annual responses, totaling 322,905 responses across all. With an estimated time of 2 minutes per response, the total annual burden is 10,764 hours. The CFTC notes no associated capital or operating costs. These figures represent the agency's assessment of the practical impact on businesses, derived from prior approvals by the Office of Management and Budget (OMB) under Control No. 3038-0055.
As stated in the notice, 'An agency may not conduct or sponsor, and a person is not required to respond to, a collection of information unless it displays a currently valid OMB control number.' This emphasizes the PRA's role in preventing undue paperwork burdens on the public.
Public Comment Process and PRA Compliance
The PRA, codified at 44 U.S.C. 3501 et seq., requires federal agencies to seek OMB approval for information collections and provide a 60-day public comment period. The CFTC's notice complies by soliciting feedback on the necessity of the collection for agency functions, the accuracy of burden estimates, ways to enhance information quality, and methods to minimize respondent burdens, such as through technology.
Comments can be submitted via the CFTC website, mail, or hand delivery, identified by 'Privacy of Consumer Financial Information' and OMB Control No. 3038-0055. The notice encourages English submissions and warns that comments may be posted publicly, with options for confidential treatment under FOIA procedures in 17 CFR 145.9. This process allows stakeholders, including industry participants and consumer advocates, to influence the renewal.
Perspectives and Implications
Industry groups often view these requirements as essential for trust in financial markets but argue that burden estimates may understate compliance costs, particularly for smaller firms. For instance, trade associations have previously commented on PRA renewals, suggesting streamlined notices to reduce administrative loads. Consumer protection advocates, conversely, emphasize the value of robust disclosures in preventing data misuse, citing precedents like FTC enforcement actions under similar GLB rules.
Short-term implications include potential adjustments to the collection based on comments, which could refine burden calculations or incorporate technological efficiencies. Long-term, this renewal supports broader financial regulatory stability, aligning with ongoing debates on data privacy amid rising cyber threats. Different perspectives highlight tensions between regulatory oversight and operational flexibility, without consensus on ideal balances.
In summary, this PRA renewal process ensures continued enforcement of consumer privacy protections in derivatives markets. Potential next steps include OMB review after the comment period, possibly leading to modifications that address feedback on burden reduction or enhanced clarity. Ongoing challenges involve adapting to technological advancements in data handling, while debates persist on harmonizing privacy rules across federal agencies to avoid duplicative requirements.
