Subscribe to our InfoBytes Blog weekly newsletter and other publications for news affecting the financial services industry.
On May 19, the Montana governor signed SB 384 to enact the Consumer Data Privacy Act (CDPA) and establish a framework for controlling and processing consumer personal data in the state. Montana is now the ninth state in the nation to enact comprehensive consumer privacy measures, following California, Colorado, Connecticut, Virginia, Utah, Iowa, Indiana, and Tennessee. The CDPA applies to any person that conducts business in the state or produces products or services targeted to state residents and, during a calendar year, (i) controls or processes personal data of at least 50,000 consumers (“excluding personal data controlled or processed solely for the purpose of completing a payment transaction”), or (ii) controls or processes personal data of at least 25,000 consumers and derives 25 percent of gross revenue from the sale of personal data. The CDPA provides several exemptions, including nonprofit organizations, registered securities associations, financial institutions, data governed by the Gramm-Leach-Bliley Act and certain other federal laws, and covered entities governed by the Health Insurance Portability and Accountability Act. Highlights of the CDPA include:
- Consumers’ rights. Under the CDPA, consumers will be able to access their personal data; correct inaccuracies; request deletion of their data; obtain a copy of their data in a portable format; and opt out of the sale of their data. A consumer may also designate an authorized agent to act on the consumer’s behalf to opt out of the processing of their personal data.
- Data controllers’ responsibilities. Data controllers under the CDPA will be responsible for, among other things, (i) responding to consumer requests within 45 days unless extenuating circumstances arise and providing requested information free of charge, one for each consumer during a 12-month period; (ii) establishing a process to allow consumer appeals within a reasonable time period after a controller’s refusal to take action on a consumer’s request; (iii) establishing clear and conspicuous opt-out methods on a website that require consumers to affirmatively and freely choose to opt out of any processing of their personal data (and allowing for a mechanism that lets consumers revoke consent that is at least as easy as the mechanism used to provide consent); (iv) limiting the collection of data to what is adequate, relevant, and reasonably necessary for a specified purpose; (v) securing personal data from unauthorized access; (vi) processing data in compliance with state and federal anti-discrimination laws; (vii) obtaining consumer consent in order to process sensitive data; (viii) providing clear and meaningful privacy notices; and (ix) conducting data protection assessments and ensuring deidentified data cannot be associated with a consumer. The CDPA also sets forth obligations relating to contracts between a controller and a processor, including ensuring that contracts between a controller and a processor do not waive or limit consumer data rights.
- No private right of action but enforcement by state attorney general. The CDPA explicitly prohibits a private right of action. Instead, it grants the state attorney general excusive authority to enforce the law.
- Right to cure. Upon discovering a potential violation of the CDPA, the attorney general must give the data controller notice. The data controller then has 60 days to cure the alleged violation before the attorney general can file suit. The cure provision expires April 1, 2026.
The CDPA takes effect October 1, 2024.
On February 16, the Montana governor signed HB 30, which amends certain provisions of the state’s mortgage laws. Among other things, the act outlines provisions related to financial condition requirements, model state regulatory prudential standards for nonbank mortgage servicers, risk assessments, and licensee reporting requirements. The act also permits remote work provided certain conditions are met, including that a licensee’s employees and independent contractors do not meet with the public in an unlicensed personal residence, business records are not stored at the remote locations, appropriate security measures are put in place to ensure the confidentiality of customer information, and the NMLS record reflects the designation of a properly licensed location as the mortgage loan originator’s official workstation. In addition, the act amends provisions related to the denial of a licensee’s application or renewal, and updates designated manager and branch office licensing requirements to account for the remote location allowance. The act further provides the Department of Administration (acting through the Division of Banking and Financial Institutions) with rulemaking authority for addressing the revocation or suspension of licenses for cause, investigations into alleged violations, and fees, among other things. Additional amendments address the sharing of confidential supervisory information with state and federal financial regulators. Exempt from the act’s requirements are not-for-profit servicers and housing financing agencies, while servicers solely involved in reverse mortgage servicing are exempt from certain portions of the act. Similarly, servicers with 25 or fewer loans, or servicers wholly owned and controlled by one or more state- or federally-regulated depository institutions are also exempt from certain portions of the act. A servicer that is also licensed as an escrow business may apply to waive or adjust certain financial condition requirements. The act is effective July 1.
On July 15, the FDIC issued guidance (see FIL-31-2022 and see FIL-32-2022) to provide regulatory relief to financial institutions and help facilitate recovery in areas of Oklahoma affected by a severe storm, tornadoes, and flooding that occurred between May 2 and 8 and in areas of Montana affected by a severe storm and flooding that occurred from June 10 and continuing. The FDIC writes that, in supervising impacted institutions, it will consider the unusual circumstances those institutions face. The guidance suggests that institutions work with borrowers impacted by the severe weather to extend repayment terms, restructure existing loans, or ease terms for new loans “in a manner consistent with sound banking practices.” The FDIC notes that institutions may receive favorable Community Reinvestment Act consideration for community development loans, investments, and services in support of disaster recovery. The agency will also consider relief from certain reporting and publishing requirements.
Recently, the Montana Department of Administration adopted Nationwide Multistate Licensing System & Registry standardized forms and procedures that include, among other things, information and updates on: (i) escrow business licenses; (ii) definitions for mortgage licensees; (iii) revocation, suspension, or surrender of mortgage licenses; (iv) sales finance company licenses; and (v) consumer loan license surrender. The provisions became effective February 12.
On September 30, HUD announced disaster assistance for certain areas in Vermont impacted by a severe storm and flooding from July 29 to July 30, providing foreclosure relief and other assistance to affected homeowners. This followed President Biden’s major disaster declaration for the counties of Bennington and Windham issued on September 29. The following day, HUD announced disaster assistance for certain areas in Montana affected by the Richard Spring Fire from August 8 to August 20, also providing foreclosure relief and other assistance to affected homeowners. This followed President Biden’s major disaster declaration for Rosebud County and the Northern Cheyenne Indian Reservation issued on September 30. According to the announcement, federal funding is additionally available on a cost-sharing basis for hazard mitigation in all areas of Montana.
For both disaster relief measures, HUD is providing an automatic 90-day moratorium on foreclosures of FHA-insured home mortgages for covered properties and is making FHA insurance available to victims whose homes were destroyed or severely damaged, such that “reconstruction or replacement is necessary.” Additionally, HUD’s Section 203(k) loan program will allow individuals who have lost homes to finance the purchase of a house, or refinance an existing house and the costs of repair, through a single mortgage. The program will also allow homeowners with damaged property to finance the rehabilitation of existing single-family homes. Flexibility measures for state and local governments, public housing authorities, tribes, and tribally designated house entities are also addressed.
Montana issues a temporary emergency rule to waive June assessments or fees for banks and credit unions
On April 24, the Montana Department of Administration issued a temporary emergency rule waiving the first semiannual assessments for state-chartered banks and supervisory fees for credit unions. The rule will expire on August 22, 2020.
The Montana Department of Administration has posted information about technology-based notarizations available to Montana notaries. The guidance describes the mechanics of remote and remote online notarization, the registration requirements for performing technology-based notarization, and the methods of identification for remote and remote online notarizations. A list of Montana Secretary of State approved providers of remote and remote online notarization is included.
The Montana Banking and Financial Institutions announced that it is extending the deadline for non-depository licensees to file certain reports. The MCR Q1 2020 report due date has been extended from May 15, 2020, to June 14, 2020. The deadline to submit the MCR Standard Financial Condition Report and the Financial Statement has been extended from 90 days from the end of the company’s fiscal year to 120 days from the end of company’s fiscal year.
Montana Department of Administration provides relief to banks and credit unions regarding annual meetings
On April 2, the Montana Department of Administration adopted a temporary emergency rule regarding annual meetings held by banks and credit unions during the Covid-19 pandemic. The rule permits a bank or credit union to hold its annual meeting in the form of a virtual meeting during the Covid-19 pandemic. Such virtual meeting must be live, allow electronic or telephonic participation in the meeting in real-time, and provide simultaneous audio transmission of the meeting.
The Montana Secretary of State’s website enumerates four ways to perform notary services in the state. They include traditional notarization, In-Person Electronic Notarization (IPEN or eNotarization), Remote Online Notarization (RON), and remote notarization. The webpage also describes the conditions unique to each type of notary service. This guidance follows the enactment of full RON, remote notarization on tangible records, as well as IPEN last fall.