MEMORANDUM. Background

Transcription

1 MEMORANDUM TO: FROM: Governmental Pension Plans Ice Miller (Mary Beth Braitman and Tom Walsh) DATE: September 23, 2001 RE: Analysis of the Duties Imposed by Title V of the Gramm-Leach-Bliley Act on Public Employee Retirement Plans Background Most employees of State, municipal, and local governmental entities are eligible for participation in a public employee retirement plan ( Plan ). Although the incarnations of these Plans in the various States are far from identical, the Plans possess enough common elements that collective observations on the duties imposed by Title V of the Gramm-Leach-Bliley Act (the Act ) on the Plans is appropriate. Each Plan is sponsored by one or more government employer(s), which may include a State, a municipality, or another political subdivision of a State. Each Plan is administered by a department or an independent group of elected or appointed individuals. This group may be known by many terms, e.g., Department, a Commission, a Board, or Trustees by another term (hereinafter, a Board ), but in each case the Board is responsible for administering the Plan for the benefit of the employee participants in the Plan. A Board may select and oversee one or more private sector firms to serve as investment managers for the Plan. A Board (or its staff) also may make specific investment decisions such as buying and selling publicly traded securities, or may otherwise directly manage all or a portion of the Plan s portfolio of investments. We are covering in this memorandum only Plans qualified under Sections 401(a), 403(b) or 457 of the Internal Revenue Code. In addition, because each Plan is government sponsored, each Plan is not subject to the Employee Retirement Income Security Act of 1974 ( ERISA ). Thus, ERISA s requirements (including all of its fiduciary rules) are inapplicable to such Plans. However, generally each Board is subject to State and common law fiduciary duties with respect to the administration of the assets in such Plans. We are also not covering individual retirement plan accounts in this memorandum, since different rules apply to them. We also realize any Plan may be impacted several ways, e.g., its vendors providing opt out opportunities and notices to the Plan as investor, employer, sponsor. The focus of this memorandum is on the Plan s duties and responsibilities under the Act to Plan members. The Gramm-Leach-Bliley Act On November 12, 1999, President Clinton signed into law the Gramm-Leach-Bliley Act. Pub. L. No , 113 Stat (1999). The stated purpose of the Act is "[t]o enhance

2 competition in the financial services industry by providing a prudential framework for the affiliation of banks, securities firms, insurance companies, and other financial service providers." Id. In addition to the provisions modernizing the financial services industry, Title V of the Act significantly overhauled the legal rules on information sharing by financial institutions with nonaffiliated third parties. 15 U.S.C et. seq. Congress delegated enforcement of the information sharing provisions of the Act to the Federal and State agencies which possessed enforcement authority over specific sectors of the financial services industry at the time of the Act. Id. at The Office of the Controller of the Currency, a Board of Governors of the Federal Reserve System, and a Board of Directors of the Federal Deposit Insurance Corporation were assigned the authority to enforce the information sharing provisions against banks. Authority over savings associations was delegated to the Director of the Office of Thrift Supervision. The Securities and Exchange Commission was delegated the authority to enforce the provisions with respect to any securities broker or dealer, any investment company, and any registered investment advisor. Authority over any person or entity engaged in providing insurance was delegated to the insurance authority in the State in which the person or entity is domiciled. Finally, the Federal Trade Commission was delegated residual authority over any entity not subject to the jurisdiction of one of the previously noted authorities. These same agencies, commissions, and authorities were instructed by Congress to develop regulations implementing the information sharing provisions of the Act within their respective jurisdictions. Id. at Financial institutions must have been in compliance with these regulations by July 1, See, e.g., 12 C.F.R (a), 16 C.F.R (a), 17 C.F.R (a). First and Second General Rule The Act sets forth two general rules that are implemented through the regulations. First, before disclosing a consumer's nonpublic personal information to a non-affiliated third party, a financial institution must give notice to the consumer and give the consumer an opportunity to opt out of the disclosure (hereinafter, the "first general rule"). 15 U.S.C. 6802(a). Second, a consumer who becomes a "customer" of the financial institution must receive a written notice of the financial institution's consumer data privacy practices at the time the customer relationship is established and annually thereafter as long as the customer relationship exists (hereinafter, the "second general rule"). Id. at 6803(a). Exceptions to General Rules The Act also provides for several important exceptions to the general rules. For example, a financial institution may disclose nonpublic personal information to a non-affiliated third party that performs services for or functions on behalf of the financial institution, including the marketing of the financial institution's own products or services, after providing notice to a consumer. Id. at 6802(b)(2). No opportunity to opt out is required. Likewise, after merely providing notice, a financial institution may disclose nonpublic personal information to a nonaffiliated third party when the disclosure is related to the joint marketing of financial products or services, and if certain other conditions are met. Id. 2

3 There are other exceptions that permit disclosure of nonpublic personal information, without requiring notice or opportunity to opt out. For example, disclosure may be made as necessary to affect, administer, or enforce a transaction requested or authorized by the consumer. Disclosure also may be made, without notice or opportunity to opt out, to protect the confidentiality of the financial institution's records pertaining to the consumer, to protect against or prevent fraud, to resolve a customer dispute, or if disclosure is required by the Fair Credit Reporting Act. Id. at 6802(e). Definitions Several of the terms used in the general rules are defined in the Act and the implementing regulations, and understanding these definitions is important to understanding the scope of the general rules. A "financial institution" is defined as an institution "the business of which is engaging in financial activities." Id. at 6809(3). "Financial activities" under the Act include lending money, investing for others, safeguarding money or securities, insuring or indemnifying against loss, providing or brokering financial products, providing financial advisory services, and underwriting or dealing in securities. 12 U.S.C. 1843(k)(4). This is only a partial list of such activities. "Nonpublic personal information" generally consists of any information about a consumer that is provided by a consumer to financial institutions to obtain a financial product or service, which results from a transaction with the consumer or any service performed for the consumer, or which is otherwise obtained by the financial institution. Id. at 6809(4). Nonpublic personal information excludes publicly available information, which is defined the implementing regulations as information that a financial institution has a reasonable basis to believe is lawfully available from: (i) federal, state, or local government records; (ii) widely distributed media; or (iii) disclosures to the general public required by law. 12 C.F.R (p)(1); 16 C.F.R (p)(1); 17 C.F.R (t)(1). A "consumer" is an individual who seeks to obtain, obtains, or has obtained a financial product or service from a financial institution, where the financial product or service is to be used primarily for personal, family, or household purposes. 15 U.S.C. 6809(9). A "customer" is a consumer with whom a financial institution has a continuing relationship under which the financial institution provides one or more financial products or services. 12 C.F.R (h); 16 C.F.R (h); 17 C.F.R (j). Finally, an "affiliate" is any entity that controls, is controlled by, or is under common control with another entity. 15 U.S.C. 6809(6). Thus, a non-affiliated third party is an entity that does not control, is not controlled by, and is not under common control with another entity. Analysis A Board is generally engaged in several activities that constitute financial activities under the Act, including, for example, investing for others, providing or brokering financial products, and safeguarding money and securities. Thus, a Board can be considered a financial institution within the definition of that term in the Act and the regulations. However, despite a 3

4 Board s status as a financial institution, it does not appear that most Boards will be subject to either of the Act s general rules. Under the functional regulatory scheme set forth in the Act, analysis of a Board s activities with respect to its services as administrator of a Plan is most appropriately done in light of the rules promulgated by the Federal Trade Commission ( FTC ). 16 C.F.R To the extent a Board s activities include buying and selling publicly traded securities on behalf of a Plan, analysis of the Board s activities also is appropriate in light of the rules promulgated by the Securities and Exchange Commission ( SEC ). 17 C.F.R Under the FTC s regulations, an individual who is a participant in an employee benefit plan is not a consumer of a financial institution sponsoring the employee benefit plan, or of a financial institution acting as a fiduciary of the employee benefit plan, solely by virtue of the individual s participation in the employee benefit plan C.F.R (e)(2)(viii). The SEC s regulations contain a similar rule. 17 C.F.R (g)(2)(viii). Conclusions If an individual does not achieve consumer status under the Act, a financial institution has no duty with respect to that individual s nonpublic personal information under either of the Act s general rules. Specifically, under the first general rule, before disclosing a consumer's nonpublic personal information to a non-affiliated third party, a financial institution must give notice to the consumer and give the consumer an opportunity to opt out of the disclosure. If the employee benefit plan participant is not a consumer under the Act, the financial institution has no duty to give notice or an opportunity to opt out. The second general rule defines the duty owed to customers of a financial institution. Under the Act, every customer must first be a consumer. Thus, if the employee benefit plan participant is not a consumer under the Act, the plan participant can never be a customer to whom a duty is owed under the second general rule. Notwithstanding the fact that the Act does not restrict a Board s activities with respect to the nonpublic personal information about participants in the Plans, the fiduciary duties imposed on a Board under State law may equate or surpass the restrictions imposed under the Act s first general rule. We also realize many Boards are subject to state privacy acts, confidential records statutes, and various public record laws. This memorandum does not attempt to discuss or analyze those state laws in any regard. It is unlikely, however, that the duties imposed on a Board under State law would require a Board to undertake a program wherein a Board must proactively inform plan participants of its consumer data privacy practices, such as that which is required by the Act s second general rule. 1 An exception arises in the limited cases where the employee benefit plan constitutes an Individual Retirement Account ( IRA ). Under both the FTC regulations and the SEC regulations, the custodian of securities or assets in an IRA is a financial institution, and the individual entrusting those securities or assets to the custodian is a consumer. See, e.g., Comments to Privacy of Consumer Financial Information Final Rule, 65 Fed. Reg. 33,652 (2000). 4

5 As a final note, as mentioned above, under the Act s functional regulatory scheme regulation of entities engaged in providing insurance was delegated to State insurance authorities. The model consumer financial privacy regulations promulgated by the National Association of Insurance Commissioners ( NAIC ) 2 exclude employee benefit plan participants from the definition of consumer, but place certain conditions on the financial institutions that are not required under the Federal regulations. Specifically, a financial institution must comply with the Act s first general rule, even though the plan participants technically are not consumers under the NAIC s model regulations. In addition, a financial institution must deliver the notice regarding the financial institution s privacy practices required by the Act s second general rule, although the notice may be delivered only to the plan sponsor or group insurance policyholder and not to each of the individual plan participants. The NAIC s model regulations apply only to those persons and entities licensed by a State insurance authority. If, in a particular State, a Board must be licensed by the State s insurance authority, the duties imposed on the Board may be different than those imposed under Federal law. As a last point, we would urge Plans to carefully review any notices it receives from its vendors and complete any opt out procedures necessary to protect any member data vendors may have. 2 Although no State is required to adopt the NAIC model regulations, it is anticipated that the NAIC model regulations will be the vehicle used by the majority of States to implement the Act with respect to those persons and entities engaged in the business of insurance in the State 5