The New York City Department of Consumer and Worker Protection (NYC DCWP) just released an updated proposed amendment to its rules relating to debt collection. This updated amendment changes significantly more than the first proposed amendment released by NYC DCWP last year. Interestingly, this update contains revisions that are similar to the New York Department of Financial Services (NYDFS) proposed amendments to New York’s debt collection law, 23 NYCRR 1, that NYDFS released last year. After receiving a number of comments to the proposal, including a comment from TrueAccord, NYDFS paused the rulemaking and has not yet released any revised proposal. Both of these departments, NYDFS and NYC DCWP should change their proposed amendments to give New Yorkers the same digital communication benefits all non-New Yorkers receive.

The NYC DCWP and NYDFS proposed amendments are designed in part to align with the federal Consumer Financial Protection Bureaus’s Debt Collection Rule, Regulation F, that took effect in November 2021. Even though consumers often prefer to communicate digitally, the NYDFS and NYC DCWP updated proposals are more strict than Regulation F, particularly as it relates to the proposed restrictions on digital communications. While attempting to provide additional protections for consumers when debt collectors reach out using digital channels, these NYDFS and NYC DCWP restrictions create unintended consequences that raise barriers for NY consumers to correspond with collection agencies in their channel of preference and hinder communication efforts. The effect will raise the number of lawsuits brought against NYC consumers and ultimately increase the cost of credit for all consumers across the US to offset New York losses.

As a company that predominantly leverages digital communications for virtually all aspects of our customer interactions, TrueAccord has unique experience and information from serving over 20 million consumers, which showcases the benefits of digital communication in collections. Small edits to these proposed amendments can have the same desired impact (protecting consumers from a barrage of digital debt collection messages) without limiting the ability of debt collectors to proactively reach out—in fact, both the federal debt collection rule, Regulation F, and Washington, DC’s recent debt collection law amendments restrict the frequency of outbound digital communications and include specific requirements for opt-outs on all communications with severe penalties for failing to honor a consumer’s request.

In this two part blog series, we explore the provisions in these proposed amendments that focus on restrictions on digital communications, the unintended consequences to consumers when laws require opt-in instead of opt-out rules for debt collectors, and how the proposals could be changed to accomplish the same result without placing barriers on consumers ability to communicate in their channels of preference—read part two here. This first installment focuses on the provisions of the law, consumers preference for digital communications, and the small changes that could be implemented before these amendments are final. The second installment seeks to provide information about the benefits of digital communications for consumers in all other states and jurisdictions—except New York. If you are impacted by the current NYC proposal, consider speaking at the upcoming hearing (virtually or in person). Information on how to register is below.

Proposed New York State and New York City Amendments

Three proposed amendments, two different departments, two different jurisdictions, and potential unintended consequences that can harm consumers. Let’s start by evaluating the different proposals by jurisdiction.

New York’s Approach to Digital Communications
The New York debt collection law, 23 NYCRR 1, which took effect in 2019, already restricted the ability of a debt collector to reach out proactively to consumers via email without first having direct express consent from the consumer. This means that a debt collector must first call a consumer to obtain consent before the collector could send an email message about the account. While a debt collector can send proactive emails in an effort to obtain consent, to comply with the law these emails cannot reference the reason why a consumer would want to opt-in to communicate by email with the company, (i.e. about a past due account) and cannot even reference information about the account. So, they ultimately sound like spam.

For example, if a consumer received a message from a company they do not know, without any information about why the company is reaching out and asking for consent to email, why would a consumer opt-in?

The result, not surprisingly, is that New York consumers who had already opted in to communicate via email about the account with the creditor would, after falling behind on payments and being referred to a debt collector, only receive phone calls and letters from debt collectors.

New York’s First Proposed Amendment
December 2022 NYDFS released its first proposed amendment to its debt collection rules. Comments were due February 13, 2023. The first New York proposed amendment also never became final. The amendment included the following:

• Revised definitions of communication, creditor and debt and a new definition of electronic communication
• Revised requirements for the validation notice, including that the initial communication must be made in writing to avoid having to send another written communication within 5 days of the initial communication
• Revised requirement that the validation notice cannot be made by electronic communication but may be made in the form requested by a consumer to section 601-b of the General Business Law
• Revising the disclosure requirements for debts that have passed the statute of limitations for the purpose of filing a lawsuit
• Revisions to the substantiation requirements, including a 7 year retention period and requirement to provide full chain of title
• Revisions to the requirement for a debt collector to obtain consent from a consumer before emailing, including, extending the consent requirement to text messages, requiring the consent to be given in writing and retained for 7 years, requiring electronic communications to include clear and conspicuous opt-outs, requiring collectors to honor such opt-outs, and explaining opt-outs are effective upon receipt
• New provisions covering the relationship with other laws, clarifying, for example, that local laws are not inconsistent with this law if they afford greater protections
• New section on severability making clear that if any court rules one section of the law to be invalid, it does not invalidate the other sections of the law

The proposed changes to Section 1.6(b) seek to extend the prohibition on a debt collector to reach out proactively to consumers via email without first having direct express consent from the consumer to text messages. This limits the only digital channel currently available for proactive outbound debt collection communications with consumers in New York.

New York City’s Approach to Digital Communications
New York City’s debt collection laws did not contain any restrictions on digital communications. But, after the New York law restricting proactive emails took effect in 2019, New York City consumers who had already opted in to communicate via email about the account with the creditor would, after falling behind on payments and being referred to a debt collector, only receive phone calls and letters from debt collectors.

New York City’s First Proposed Amendment
November 2022 NYC DCWP released its first proposed amendment to its debt collection rules, comments were due December 5, 2022. These first NYC proposed amendments contained changes to align their laws with those of New York, however, the proposals never became final. The amendments included the following:

• Revised the out of statute disclosure agencies must provide on communications with consumers whose accounts have passed the statute of limitations for the filing of a lawsuit to recover the debt
• Revised requirements for debt collectors to maintain records of attempted communications, complaints, disputes, cease and desist requests, calls, including what calls are recorded and not recorded, credit reporting, unverified debt notices, and communication preferences (if known) as well as unsubscribes or opt-outs from particular channels
• New definitions for attempted communication, electronic record, electronic communication, clear and conspicuous, language access services and limited content message
• New prohibition on electronic communications unless the debt collector sent the initial communication with the validation notice by mail and the consumer opted in to electronic communications with the debt collector directly and clear and conspicuous opt-outs without penalty or charge on all electronic communications
• Revised unconscionable and deceptive practices to include: adding attempted communications anywhere communications appeared, such as adding attempted communications to the excessive frequency prohibition
• New prohibition on social media platform communications unless the debt collector obtains consent and communicates privately with the consumer
• New rules on requirements prior to furnishing information to credit reporting agencies
• Revised validation notice disclosures and obligations for translating, if notices are offered in different languages

New York City’s Revised Amendment
November 2023 NYC DCWP released an updated NYC proposed amendment. Comments can be submitted through November 29, 2023. A hearing will be held that same day at 11AM. The updated version contains all of the changes suggested in the first proposal as well as:

• Additional revisions to what information is required to be maintained in debt collection logs that would require major changes to all collection software systems
• Additional new definitions for covered medical entity, financial assistance policy, itemization reference date, original creditor and originating creditor
• Clarifies that any communications required by the rules of civil procedure in a debt collection lawsuit do not count toward frequency restrictions
• New disclosures for medical debts as well as specific treatment of medical accounts, such as validation procedures and verification of covered medical entity obligations prior to collections

These amendments align the New York City law to that of New York. If these amendments become final, New York will be an opt-in jurisdiction instead of an opt-out jurisdiction, meaning debt collectors must communicate by telephone or letter to obtain consent to text or email, even when a consumer already opted into digital communications about their account. This puts New Yorkers at a disadvantage from consumers in all other states who are able to communicate electronically under the provisions of the federal Fair Debt Collection Practices Act (FDCPA) and Regulation F.

Opt-Out Jurisdictions Offer Consumers the Same Protections

The rest of the United States have approached debt collection attempts via digital communications very differently from New York. For all consumers outside of New York, debt collectors may send proactive debt collection communications via email or text messages. The laws require all digital communications contain clear and conspicuous opt-out methods (unsubscribe flows in emails and “reply STOP to opt-out” in text messages) with strict penalties for debt collectors who do not honor a consumer’s request to opt-out of digital communication channels. Digital communications also fall under the frequency limitations of the FDCPA and Regulation F.

Only one other jurisdiction to date has created additional restrictions related to digital communications that exceed the protections in the FDCPA and Regulation F. Washington, DC amended their debt collection law Protecting Consumers from Unjust Debt Collection Practices Amendment Act of 2022, and the changes that took effect in January 2023. DC remains an opt-out jurisdiction with specific requirements for opt-outs on all email and text communications with severe penalties for failing to honor a consumer’s request, but also added a specific frequency limitation on digital communications. Debt collectors are only permitted to send a consumer one digital communication per week—one email or one text message (one time in a seven day period). A debt collector may only communicate digitally more than one time per week after a consumer opts-in to additional digital communications.

As a result in these opt-out jurisdictions, consumers can still receive the digital communications they prefer without having to have phone calls attempting to get them to opt-in to digital communications, like the consumers in New York. Additionally, with these opt-out jurisdictions consumers learn about their account faster, can explore options on their own time, and receive the additional benefits that come with early communication about their debts—such as setting up a payment plan, having a credit reporting tradeline updated or deleted, providing evidence of fraud or identity theft, and disputing all or portions of the balance. New York consumers who do not answer their phones are less likely to receive these benefits that come with knowing there is a debt in collection and the options to resolve.

Ultimately, New York still has time to amend their proposals to ensure their consumers receive the same treatment as all other consumers in the US.

Consumers Prefer Digital Communication

By and large, consumers prefer to communicate with their collection agencies digitally—they already predominantly communicate with their banks, creditors, and lenders digitally, so digital collection is a smooth transition. For example, almost all TrueAccord communications with consumers (93%) happen digitally with no agent interaction because the digital communications contain links to online pages where consumers can take action on their accounts. In fact, more than 21% of consumers resolve their accounts outside of typical business hours—before 8AM and after 9PM—when it is presumed inconvenient to contact consumers under the FDCPA. In fact, consumers often post publicly about their positive experience with digital collections:

We believe restricting digital methods to reach and serve consumers will disadvantage vulnerable populations of consumers who primarily conduct most of their affairs digitally. According to the Pew Research Center, “reliance on smartphones for online access is especially common among younger adults, lower-income Americans and those with a high school education or less.” As the consumer described above, TrueAccord’s approach of sending digital communications helps consumers easily navigate to our website and perform actions at their convenience online.

We will continue to explore the impact of these proposed amendments in the second blog post of this series, including how:

• Limiting digital communication use hurts all consumers
• Multiple opt-in requirements burden consumers
• Non-digital communications can be disruptive to consumers
• Email and text messages are a step forward in consumer protection

Register to Speak at the Upcoming Hearing

Sign up to speak for up to three minutes at the hearing by emailing Rulecomments@dcwp.nyc.gov. You do not have to be present at the hearing to speak if you join the video conference using this link, https://tinyurl.com/z3svub58, meeting ID: 255 089 803 499 and passcode: 8HGNSw.

Read Part Two of Our Series: New Yorkers Should Receive the Same Digital Communications Benefits All Non-New Yorkers Receive

Discover the unintended harms New Yorkers face if digital communications are restricted by proposed amendments to New York and New York City’s debt collection laws and the digital communication benefits consumers get in all other states here»»

In today’s financial landscape, regulators at both the federal and state level are driving accountability for companies when it comes to data protection and security. We see that with the express requirement in the Gramm-Leach-Bliley Act, or GLBA, Safeguards Rule—which went into effect on June 9, 2023—that organizations have one qualified individual to oversee the information security program, and that the qualified individual provides regular reports to the highest governing body of an organization.
This underscores the importance of protecting customer information in a digital age where information has its own intrinsic value.

Let’s take a look at how the new updates to GLBA Safeguards Rule, how these security policies are important specifically for debt collection, and what best practices your business should follow to protect consumers’ data.

 The GLBA Data Protection Law

The Gramm-Leach-Bliley Act, or GLBA, is a federal regulation to control how financial institutions collect, store, and transmit consumer information. GLBA was enacted by the Federal Trade Commission (FTC) in 1999 and recently rolled out new amendments to the Standards for Safeguarding Customer Information, known as the “Safeguards Rule,” that went into effect on June 9, 2023, in effort to continue protecting consumer data in an ever-evolving digital environment. 

A few of the updates to GLBA’s Safeguards Rule include:

• Provides covered financial institutions with more guidance on how to develop and implement specific aspects of an overall information security program
• Improves the accountability of these security programs, such as requiring financial institutions to designate a qualified individual responsible for overseeing, implementing and enforcing the program

Data Protection is Critical in Debt Collection

To attract clients today a debt collector must demonstrate the implementation of a full suite of information security practices covering physical, technical, and administrative safeguards, including a comprehensive employee information security training. Failure to implement these best practices can result in a security incident or worse, a data breach. Not only are data breaches costly because of the notification provisions, including providing credit bureau monitoring, it can be difficult for a company to survive after a breach. It is not unusual for a company to file bankruptcy after a data breach.

Reputation and Customer Retention

Although complying with federal and state regulations helps companies avoid costly—even criminal—penalties, consumer trust that their financial data is being protected is critical to maintaining a positive reputation and retaining customers (even if they fall into delinquency).

Data protection policies can often be treated as a set-it-and-forget-it, or even treated as a luxury of lower priority due to limited resources, expertise, or familiarity. But for today’s consumers, data security is a top priority.

A recent study by MAGNA Media Trials and Ketch, showed across every age group74% of people rank data privacy as one of their top values—consistently rank data privacy as their top concern. And on the flip-side, the study showed nearly 9 out of 10 consumers report strong data privacy practices positively impact their relationship with a company.

Keeping Up With Compliance

Along with federal regulations, individual states are also issuing new laws focused on consumer data protection. California, Utah, Colorado, Connecticut and Virginia all passed data privacy laws over the past several years that take effect in 2023. This past March, Iowa passed a Data Privacy Law that takes effect on January 1, 2025 that is very similar to both Virginia and Colorado’s laws affording consumers a right to know and right to request deletion. Pennsylvania amended its Breach of Personal Information Notification Act, by among other things, expanding the definition of “personal information” to include medical and health information, and a username or e-mail address in combination login credentials. Several more states have draft privacy and security laws in draft.

Although GLBA and other data protection and privacy laws are the hot topic when it comes to compliance today, it isn’t the only federal privacy regulations lenders and debt collectors need to follow and monitor for changes—or face the consequences of non-compliance. Here are some recent laws and amendments impacting the industry:

• The Fair Credit Reporting Act: Credit reporting companies and users of credit reports have specific obligations to protect the public’s data privacy, with potential criminal liability for certain misconduct.
• The Dodd-Frank Wall Street Reform and Consumer Protection Act: Established a new Consumer Financial Protection Bureau with the authority to supervise and regulate entities that offer or provide consumer financial products or services.
• Health Insurance Portability and Accountability Act (HIPAA): Two part rule for privacy and security of personal health information that applies to covered entities (doctors, hospitals, pharmacies, insurers, and their vendors). PHI – is defined broadly to include any information provided to the covered entity by the patient.

Consumer Data Protection is Not a Luxury

Having good security practices in place is not only beneficial for both consumers and businesses, but also critical to stay compliant with all the new laws and amendments being introduced. Here are some of the best privacy and security practices to implement to protect customers, companies, and stay compliant:

• Practice data minimization.
• Know where personal information lives at all times by creating a data map of where the data goes and is stored throughout your systems, which includes knowing your vendor’s data security and privacy practices and controls.
• Know who has access to personal information and routinely examine if that access is necessary to complete that job function.
• Be intentional with how data is organized and stored so it can be easily segmented and treated differently if need be (think network segmentation).
• Have a public facing Privacy Notice–and make sure it accurately reflects your practices for use, collection, deletion and correction.
• Conduct an annual data security risk assessment to continually reassess areas for improvement and where you may need additional controls.
• Ensure contracts with parties whom you receive and/or give personal information to specifically address each parties’ obligations and restrictions for how personal information is used, shared, disclosed, stored, and sold (if permitted).

The TrueAccord Approach

At TrueAccord, empathy towards the consumer is a core part of our company mission: we enable businesses to collect more, faster, and from happier customers.

Ready to collect more, faster from happier customers? Learn how TrueAccord weaves compliance and data security into debt recovery by scheduling a consultation today»»

Protecting personal and financial information is critical in today’s digital age. Where data has its own intrinsic value and where data breaches and cyberattacks are a risk for every business, the Safeguards Rule under the Gramm-Leach-Bliley Act (GLBA) provides financial institutions, including those in the accounts receivable management industry, with guidance on how to safeguard customer information.

The existing Safeguards Rule provided financial institutions with much flexibility and discretion when determining what kinds of safeguards were best for their organizations and risks. With the amendments which go into effect on June 9, 2023 financial institutions now have a more prescriptive recipe for what those safeguards need to be.

What is the Gramm-Leach-Bliley Act (GLBA)?

The Gramm-Leach-Bliley Act, or GLBA, is a federal regulation to control how financial institutions collect, store, and transmit consumer information. Although GLBA was enacted by the Federal Trade Commission (FTC) in 1999, changes have been anticipated for the last few years.

In October 2021, the FTC announced new amendments coming to the Standards for Safeguarding Customer Information, known as the “Safeguards Rule,” and an issuance of a final rule, referred to simply as the “Final Rule.” Originally set to go into effect in 2022, financial institutions—a designation that has also been updated—now need to prepare for the changes or risk non-compliance and its consequences before they go into effect on June 9, 2023.

What is the Safeguards Rule?

The Safeguards Rule took effect January 10, 2021, and its requirements were first set to go into effect beginning December 9, 2022, but the FTC announced it would extend the deadline for financial institutions to develop, implement, and maintain a comprehensive information security program by June 9, 2023.

There are five overarching modifications to the existing Safeguards Rule:

• Provides covered financial institutions with more guidance on how to develop and implement specific aspects of an overall information security program
• Improves the accountability of these security programs, such as requiring financial institutions to designate a qualified individual responsible for overseeing, implementing and enforcing the program
• Exempts financial institutions that collect information on fewer than 5,000 consumers from the requirements of a written risk assessment, incident response plan, and annual reporting to the board of directors
• Expands the definition of “financial institution” within the scope of the Safeguards Rule – see the expanded definition in the next section below
• Includes several other definitions and related examples in the amended Safeguards Rule itself in an effort to make it more self-contained and to enable readers to understand its requirements without referencing the FTC’s Privacy of Consumer Financial Information Rule

Along with these updates to the Safeguards Rule, let’s examine a few other specifications of the updates.

What are other updates to the Safeguards Rule?

The expanded scope of financial institutions that are subject to the Safeguards Rule is significant. Under the new Final Rule, “financial institutions” now include entities engaged in activities that the Federal Reserve Board determines to be incidental to financial activities, such as:

It is important to note that the Final Rule does not apply to national banks, savings and loan institutions, and federal credit unions, as these institutions are not subject to the FTC’s jurisdiction.

The Final Rule requires these covered financial institutions to comply with specific new requirements, such as:

• Encrypt all customer information held or transmitted in transit over external networks and at rest
• Multi-factor authentication for any individual accessing any information system, unless the use of reasonably equivalent or more secure access controls has been approved in writing by a qualified individual at the financial institution
• Conduct periodic written risk assessments, and the results of such risk assessments should drive the information security program
• Create procedures for evaluating, assessing or testing the security of externally developed applications used to transmit, access or store customer information
• Set procedures for secure disposal of customer information no later than two years after the last date the information is used
• Implement policies, procedures, and controls designed to monitor and log the activity of authorized users and detect unauthorized access or use of, or tampering with, customer information by such users
• Provide personnel with security awareness training, and provide information security personnel with training to address relevant security risks; and that key information security personnel take steps to maintain knowledge of changing information security threats and countermeasures
• Written incident response plan designed to promptly respond and recover from any security event affecting the confidentiality, integrity, or availability of customer information
• Qualified individual to regularly, and at least annually, report in writing to an organization’s governing body (e.g., board of directors) regarding the status and material matters of the information security program
• Regularly test or otherwise monitor the effectiveness of the safeguards’ key controls, and conduct required penetration testing annually and vulnerability assessments at least every six months and whenever there are material operational or business changes

Given the expanded definition of “financial institutions,” some of these organizations may be unfamiliar with the extent of these requirements, and even those familiar with GLBA previously must be ready to comply or face the consequences.

What are the penalties for non-compliance with GLBA?

Whether it’s GLBA, Regulation F, or any of the numerous state laws, companies can face serious penalties for compliance failures—monetary, reputational, and even criminal. When it comes to GLBA, non-compliance penalties include:

Section 5 of GLBA grants the FTC the authority to audit policies to ensure they are developed and applied fairly—all the more reason to follow the Safeguards Rule’s provisions of self-audits and testing. 

Learn More About Compliance and Collections

Now that you have the breakdown of the Gramm-Leach-Bliley Act updates to the Safeguards Rule, are you familiar with the other laws and regulations governing debt collection? Check out our Collections & Compliance resources to see what other regulatory guidelines may impact your business or schedule a consultation to get started»»