PRIVACY OF CONSUMER FINANCIAL INFORMATION NEW FINAL RULES. By Russell J. Bruemmer and Franca E. Harris *

Transcription

1 PRIVACY OF CONSUMER FINANCIAL INFORMATION NEW FINAL RULES By Russell J. Bruemmer and Franca E. Harris * The Federal Trade Commission ("FTC") published its rule on Privacy of Consumer Financial Information on May 24, 2000 (65 FR 33646), and the Office of the Comptroller of the Currency, the Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation, and the Office of Thrift Supervision (collectively Banking Agencies ) published a similar joint final rule on June 1, 2000 (65 FR 35162). 1 These rules, which implement the requirements of the Gramm-Leach-Bliley Act ( GLBA ), establish comprehensive privacy protections for consumers of financial services. The final rules contain examples that are intended to assist financial institutions in complying with the rules. Both the Banking Agencies and the FTC s rules state that compliance with the examples will constitute compliance with the rule. 2 In addition, the rules include an appendix of sample clauses to assist financial institutions in their drafting of privacy notices. The sample clauses illustrate the level of detail the Banking Agencies and the FTC believe is appropriate, though they caution financial institutions against relying upon them without determining the relevance or suitability of the disclosures for their operations. What do the final rules do? In short, they: 1. Require a financial institution to provide notice to customers about its privacy policies and practices; * Wilmer, Cutler and Pickering All Rights Reserved. Russell J. Bruemmer is a partner in the Washington, D.C. office, and Franca Harris is an Associate in the New York office of Wilmer, Cutler and Pickering. The authors wish to express their appreciation to Roxanne Lin, a legal assistant in the New York office of Wilmer, Cutler and Pickering for her assistance in the preparation of this article. 1 The SEC has yet to issue its final rule implementing the GLBA privacy provisions. 2 The SEC s proposed regulations did not provide safe harbors. In 313.2, the FTC states that compliance by interstate securities broker-dealers and investment advisers that are not registered with the SEC with applicable examples in the SEC rule will constitute compliance with the FTC's rule, and similarly, compliance by non-federally insured credit unions with credit union examples in the NCUA rule will constitute compliance with the FTC's rule. The NCUA published its final rule on May 18, 2000 (65 FR 31722). The SEC has not issued its final rule; its proposed rule may be found at 65 FR C:\WINDOWS\TEMP\EBLCR June Bruemmer.DOC 1

2 2. Describe the conditions under which a financial institution may disclose nonpublic personal information about consumers to nonaffiliated third parties; and 3. Provide a method for consumers to prevent a financial institution from disclosing that information to nonaffiliated third parties by "opting out" of that disclosure. What institutions are subject to the final privacy rules? The principal type of entity subject to the rules is a financial institution, which the GLBA defines broadly to include all institutions the business of which is engaging in financial activities within the scope of Section 4(k) of the Bank Holding Company Act (12 U.S.C. 1843(k)). Section 4(k) includes not only a number of traditional financial activities, but also activities that the Federal Reserve Board has found to be closely related to banking or usual in connection with the transaction of banking or other financial operations abroad, including but not limited to: personal property appraisers, real estate appraisers, career counselors for employees in financial occupations, digital signature services, courier services, real estate settlement services, manufacturers of computer software and hardware, and travel agencies operated in connection with financial services. It is important to note that a company, other than a depository institution, engaged in one of these activities is not necessarily a financial institution. The FTC explained that it would view an entity as a financial institution only if the entity is significantly engaged in a financial activity. Although the final rule does not define "significantly engaged," it does provide examples that seek to clarify what institutions will be covered by the rule. For example, the FTC views a retail business that issues its own credit card directly to consumers to be a financial institution providing an extension of credit, but not a retail business that merely establishes a lay-away or deferred payment plan. The FTC also stated in its final rule that despite the broad definition of "financial institution" in the GLBA, many entities that come within that broad definition would likely not be subject to the disclosure requirements of the rule because not all financial institutions have "consumers" or establish "customer relationships." For example, management consulting is a financial activity but it is not likely that any individual obtains management consulting services for personal, family or household purposes. Moreover, not every product or service that a financial institution provides to an individual is a financial product or service that establishes the individual's status as a "consumer" entitled to the required C:\WINDOWS\TEMP\EBLCR June Bruemmer.DOC 2

3 notice and opt out. A product or service that does not result from a financial activity is not within the scope of the final rule. The FTC clarifies this by noting that a retailer that issues its own credit card directly to consumers provides a financial service, namely credit, to consumers who use the card, but when that same retailer sells merchandise, it provides a nonfinancial product or service. Are all individuals covered? The final rules only apply to information about a "consumer," defined as any individual who obtains, or has obtained a financial product or service which is to be used primarily for personal, family, or household purposes, including the legal representative of such an individual. Thus, business customers of a financial institution are not covered by the final rules. The final rules contain examples of who is a consumer, including an individual who applies for a loan, regardless of whether the loan is extended; an individual who provides information to determine whether he or she prequalifies for a loan; an individual providing information in connection with seeking or obtaining financial advisory services, regardless of whether an ongoing advisory relationship is established; an individual who negotiates a workout of a loan the financial institution owns; and an individual who has a loan from a financial institution, even if an agent is hired to collect the loan, the servicing rights are sold, or the loan is purchased from another institution that originated it. What information is covered? The various disclosure requirements for and restrictions on sharing information with nonaffiliated third parties under the GLBA depend on whether the information is nonpublic personal information. Nonpublic personal information is defined as "personally identifiable financial information" provided by a consumer to a financial institution, resulting from any transaction with the consumer or any service performed for the consumer, or otherwise obtained by the financial institution that is not publicly available information. 3 Personally identifiable information includes application information (including medical information or other information required for financial planning purposes), account information (such as account balance, payment or overdraft history, credit or debit card purchases, securities positions, or financial products purchased or sold), any information collected through an Internet "cookie," information C:\WINDOWS\TEMP\EBLCR June Bruemmer.DOC 3

4 from a consumer report, or from an outside source to verify information a consumer provides on an application to obtain a financial product or service, and the fact that an individual is or was the institution's customer or has obtained a financial product or service from the financial institution, unless derived using publicly available information. The rules clarify by example, however, that a list of names and addresses of customers of an entity that is not a financial institution (e.g., a magazine subscription list) is not covered. Publicly available information is expressly excluded from the definition of nonpublic customer information. Any list, description, or other grouping of consumers (and publicly available information pertaining to them) that is derived using any nonpublic personal information other than publicly available information is included in the definition of "nonpublic personal information. 4 Publicly available information is not defined in the GLBA. The final definition treats information as publicly available and therefore excluded from the definition of "nonpublic personal information" if a financial institution has a reasonable basis to believe that the information is lawfully made available to the general public from one of the three categories of sources: government records, widely distributed media, and government mandated disclosures. 5 The following example is an illustration of how nonpublic personal information, personally identifiable financial information, and publicly available information will work under the final rules. Assume that Mary provides a mortgage lender with information in order to obtain a loan to finance a home purchase, and the same information to a retail store to open a credit card account. Under the final rule, all of this information would be personally identifiable financial information. Once Mary establishes the customer relationships she seeks, the fact that Mary is a mortgage loan customer and a credit card customer at the financial institutions also would be personally identifiable financial information. Certain information provided by Mary, such as her name and address, may be publicly available. If the mortgage lender has a reasonable basis to believe that this 3 Personally identifiable financial information is not defined in the GLBA. 4 Personally identifiable financial information is not defined in the GLBA. 5 Information from these sources would include, for example, publicly available real estate recordations or security interest filings, information from a telephone book, television, radio or newspaper, and securities disclosure documents. The final rules state that information obtained over the Internet will be considered publicly available information if the information is obtainable from a web site available to the general public on an unrestricted basis. Requiring a fee or password does not render a web site restricted so long as access is available to the general public. C:\WINDOWS\TEMP\EBLCR June Bruemmer.DOC 4

5 information is publicly available, and if the information was included on a list of all of the institution s mortgage loan customers, then her name and address would fall outside the definition of nonpublic personal information in those jurisdictions where mortgages are a matter of public record. However, Mary s name and address would be protected as nonpublic personal information if the retailer wanted to include those items on a list of holders of its proprietary credit card. The difference in treatment stems from the distinction drawn in the statute between lists prepared using publicly available information (as would be the case in the mortgage loan hypothetical) and lists prepared using information that is not publicly available (as would be the case in the credit card hypothetical). 6 When and how must an institution disclose its privacy policy? The final rules require a financial institution to clearly and conspicuously provide initial and annual notices that accurately reflect its privacy policies and practices. The timing on when an initial notice is required differs depending on whether the consumer actually becomes a customer of the financial institution. 7 If the consumer becomes a customer, the notice should be provided at the time of establishing the customer relationship. According to the regulations, a one-time transaction may be sufficient to establish a customer relationship, depending on the nature of the transaction. If the consumer does not become a customer, the financial institution s notice must be provided prior to disclosing nonpublic personal information about the consumer to a nonaffiliated third party. For example, an individual who purchases securities through a broker would not be the broker's customer if the broker provides the service as an accommodation but does not open an account for the individual. Rather the individual would be a consumer entitled to the notice prior to disclosure of nonpublic personal information to an unaffiliated third party. In addition to the initial notice, a financial institution must provide annual notices to each customer with whom it has a continuing relationship. No annual notices are required for consumers who are not customers FR 33646, 33659; 65 FR 35162, Customer is defined as a consumer who has a customer relationship with the financial institution. A customer relationship is a continuing relationship under which the institution provides one or more financial products or services to be used primarily for personal, family or household purposes, such as a deposit, credit, trust or investment account. C:\WINDOWS\TEMP\EBLCR June Bruemmer.DOC 5

6 The notices must be provided in writing or, if the consumer agrees, in electronic form. For example, a financial institution may post the notice on a web site and require the consumer to acknowledge receipt as a necessary step to obtain a particular financial product or service. For customers, the initial notice also must be provided in a manner that allows the customer to retain it or obtain it at a later date. A privacy notice posted by a financial institution on its web site will be deemed to satisfy the annual notice requirement, for those customers who agree to receive notices on the institution s web site. In these cases, the Agencies concluded that a financial institution may reasonably expect a customer who uses the institution s web site to access financial products or services will receive actual notice if the customer has agreed to accept notices at the institution s web site and the financial institution posts a current notice of its privacy policies and practices continuously and in a clear and conspicuous manner on the web site. The Banking Agencies and the FTC expressly recognized that disclosures given over the Internet present some issues that do not arise with paper-based disclosures. For example, there may be web pages within a financial institution s website that consumers may view in a different order each time they access the site, aided by hypertext links. Also, some web pages may require consumers to scroll down to view the entire page. To address these issues, the Banking Agencies and the FTC have included a statement in the example concerning Internet disclosures informing financial institutions that they may comply with the rule if they use text or visual cues to encourage scrolling down the page if necessary to view the entire notice and ensure that other elements on the web site (such as text, graphics, hyperlinks, or sound) do not distract attention from the notice. Institutions making their disclosures on the Internet must also place either a notice or a conspicuous link on a page frequently accessed by consumers, such as a page on which transactions are conducted. The Banking Agencies and the FTC expressly recognize that current technology permits a range of approaches a financial institution could take to comply with the final rules. For example, a financial institution could use a dialog box that pops up to provide the disclosure before a consumer provides information to the institution. Another approach would be a simple, clearly labeled graphic located near the top of the page or in close proximity to the financial institution s logo, directing the customer, through a hypertext link or hotlink, to the privacy disclosures on a separate web page. The final rules do not prohibit two or more institutions from providing a joint initial, annual, or opt out notice, as long as the notice is delivered in accordance with the rule and is accurate for all recipients of the institutions. The final rules also do not preclude an institution from establishing different C:\WINDOWS\TEMP\EBLCR June Bruemmer.DOC 6

7 privacy policies and practices for different categories of consumers, customers, or products, if each particular consumer or customer receives a notice that is accurate with respect to that individual. For institutions that do not intend to disclose nonpublic personal information or intend only to make disclosures authorized by one of several statutory exceptions, neither initial nor annual notices are required. What must be included in initial and annual privacy notices? The final rules require a financial institution to provide the following information in its required initial and annual privacy notices: The categories of nonpublic personal information about consumers that the institution collects; The categories of nonpublic personal information about consumers that the institution discloses; The categories of affiliates and nonaffiliated third parties to whom the institution discloses nonpublic personal information; The categories of nonpublic personal information about former customers that the institution discloses and the categories of affiliates and nonaffiliated third parties to whom the institution discloses this information; An explanation of the consumer's right to opt out of the disclosure of nonpublic personal information to nonaffiliated third parties, and the methods by which a consumer may exercise that right; Any disclosures regarding information sharing with affiliates under the Fair Credit Reporting Act, and the consumer's ability to opt out of affiliate information sharing 8 ; and 8 The Banking Agencies and the FTC believe that the language and legislative history of section 503 support requiring disclosures of affiliate sharing beyond what may be required by the FCRA. They believe that limiting the disclosures about affiliate sharing just to those disclosures required under the FCRA would frustrate the Congressional intent of ensuring that individuals are given the opportunity to make informed decisions by reviewing the privacy policies and practices of financial institutions. C:\WINDOWS\TEMP\EBLCR June Bruemmer.DOC 7

8 The institution's policies and practices with respect to protecting the confidentiality, security, and integrity of nonpublic personal information. C:\WINDOWS\TEMP\EBLCR June Bruemmer.DOC 8

9 What is the opt out notice? The final rules require a financial institution to provide a consumer with a reasonable opportunity to prevent the institution from disclosing the consumer s nonpublic personal information to nonaffiliated third parties i.e., to opt out. In particular, a financial institution must provide each consumer with a clear and conspicuous notice stating: 1. That the financial institution reserves the right to disclose nonpublic personal information to nonaffiliated third parties; 2. That the consumer has the right to opt out of that disclosure; and 3. A reasonable means by which the consumer may exercise that right (e.g., by checking off boxes in a prominent position on relevant forms with the opt out notice). The opt out notice must be provided in writing or, if the consumer agrees, in electronic form. The institution may provide the opt out notice as part of the notice of the institution's privacy policies and practices. In response to the comments focused on what is a reasonable opportunity to opt out, the Agencies believe in the appropriateness of a more general test that avoids setting a mandatory waiting period applicable in all cases. Rather than trying to anticipate every scenario and establishing a time frame to accommodate each, the Agencies think it is appropriate simply to state that the consumer must be given a reasonable opportunity to opt out and the final rules provide a few illustrative examples of what would be reasonable in different contexts. Are there any exceptions to these notice requirements? The final rules incorporate statutory exceptions enabling a financial institution to share information with certain nonaffiliated third parties without having to provide an initial notice of privacy policies and practices or any notice of the right to opt out. One exception allows a financial institution to disclose information to a nonaffiliated third party for use by the third party to perform services for, or functions on behalf of, the financial institution, including the marketing of the financial institution's own products or services or financial products or services offered pursuant to a joint agreement between two or more financial institutions. A consumer does not have the right to opt out if the financial institution fully discloses to the consumer that it will provide this information to the nonaffiliated third party before it is C:\WINDOWS\TEMP\EBLCR June Bruemmer.DOC 9

10 shared, and the financial institution enters into a contract with the third party to maintain the confidentiality of the information. Additional exceptions include disclosures in connection with certain processing and servicing transactions, disclosures, with the consent of or at the direction of the consumer, disclosures to protect against potential fraud or unauthorized transactions, and disclosures to respond to judicial process including warrants, summons, and subpoenas. Do the regulations place requirements on third parties (i.e., outsourcers) that receive information from financial institutions? The final rules prohibit a nonaffiliated third party that receives nonpublic personal information from a financial institution from disclosing that information, directly or through an affiliate, to any person not affiliated with the financial institution (or with the third party, if the third party is a financial institution) unless the disclosure would be lawful if made directly by the financial institution. For example, a nonaffiliated transfer agent who receives nonpublic personal information from a financial institution may not directly or indirectly disclose the information to a nonaffiliated third party of the institution unless the institution could lawfully share the information with that party. A nonaffiliated third party that receives nonpublic personal information from a financial institution in accordance with one of the exceptions permitted under the GLBA may use that information only for the purpose authorized under that exception. Can an account number be disclosed to third parties? The final rules incorporate the statutory provision that prohibits a financial institution from disclosing a customer's account number or access code for a credit card account, deposit account or transaction account to a nonaffiliated third party, other than a consumer reporting agency, for use in telemarketing, direct mail marketing or other marketing through electronic mail, with significant exceptions for legitimate routine business practices that are unlikely to pose a significant potential for abuse. The Banking Agencies and the FTC therefore added an exception that would permit disclosures of account numbers to a financial institution's agent for the purpose of marketing the financial institution's financial products or services but qualified it to require that the agent would have no authority to initiate C:\WINDOWS\TEMP\EBLCR June Bruemmer.DOC 10

11 charges to the account. Another exception excludes the sharing of account numbers where the participants are identified to the consumer at the time the consumer enters into a private label credit card program or other affinity program. Furthermore, a clarification is made in the final rule that an account number, or similar form of access number or access code, does not include a number or code in an encrypted form, as long as the financial institution does not provide the recipient with the means to decrypt the number. Does the GLBA modify the FCRA or preempt state law requirements? Neither the GLBA nor the final rules modify or supersede the provisions of the Fair Credit Reporting Act (FCRA). The provisions of the FCRA that require notice and opt out to consumers before a financial institution may share certain financial information with its affiliates, other than information about its transactions or experience with the consumer, remain in effect. The GLBA preempts state laws to the extent that they are inconsistent with the GLBA. However, a state statute, regulation or order is not inconsistent with the GLBA if the FTC finds that it provides greater protection to consumers than the GLBA. When will these privacy requirements be effective? The final rules set November 13, 2000 as the effective date, but they do not require mandatory compliance until July 1, By July 1, 2001, a financial institution must have provided an initial notice to consumers who are the financial institution s customers on July 1, Financial institutions that contract with third party service providers, however, have until July 1, 2002 to bring existing contracts entered into on or before July 1, 2000 into compliance with the rules. C:\WINDOWS\TEMP\EBLCR June Bruemmer.DOC 11