Title V of the Gramm-Leach-Bliley Act of 1999 (P.L. 106-102, H.Rept. 106-434) requires financial institutions to provide their customers with notice of their privacy policies, including those relating to sharing of customer information with affiliated entities. It prohibits sharing personally identifiable customer information with non-affiliated third parties and prohibits financial institutions from providing account numbers to non-affiliated third parties for marketing purposes

Murphy, M. Maureen

UNT Digital Library

1 This report addresses financial privacy issues.  For more general information on privacy issuessee:  CRS Report RL30671, Personal Privacy Protection: The Legislative Response, by HaroldC. Relyea.  Also see CRS Issue Brief IB98002, Medical Records Confidentiality.Congressional Research Service ˜ The Library of CongressCRS Report for CongressReceived through the CRS WebOrder Code RS20185Updated January 31, 2003Privacy Protection for Customer Financial InformationM. Maureen MurphyLegislative AttorneyAmerican Law DivisionSummaryTitle V of the Gramm-Leach-Bliley Act of 1999 (P.L. 106-102, H.Rept. 106-434)requires financial institutions to provide their customers with notice of their privacypolicies. It prohibits financial institutions from sharing nonpublic personally identifiablecustomer information with non-affiliated third parties without giving consumers anopportunity to opt out and prohibits financial institutions from providing accountnumbers to non-affiliated third parties for marketing purposes.  It requires financialinstitutions to safeguard the security and confidentiality of customer information.Finally, it delegates rulemaking and enforcement authority to the federal banking andsecurity regulators, the Federal Trade Commission, and state insurance regulators.  Thelegislation includes prohibitions on “pretext calling,” obtaining financial institutioncustomer information by false pretenses.  Legislation is expected to be offered in the108th Congress, as was the case in the 107th Congress, to amend these provisions.  Thisreport will be updated on the basis of floor action involving  privacy protection forfinancial institution customer information.Background.  With modern technology’s ability to gather and retain data, financialservices businesses have increasingly found ways to take advantage of their largereservoirs of customer information. Not only can they serve their customers better bytailoring services and communications to their  preferences, but they can profit fromsharing that information with others willing to pay for customer lists or targeted marketingcompilations.1  While some consumers are pleased with the wider access to informationabout available services that information sharing among financial services providersoffers, others have raised privacy concerns.  Individuals are particularly interested incontrols on secondary usage.  The United States has no general law of financial privacy.The Constitution, itself, has been held to provide no protection against governmentalCRS-22  Local ordinances in San Mateo County and Daly City, California requiring customeraffirmative permission for a financial institution to share personal data are the subject of a lawsuitbrought by Wells Fargo Co. and Bank of America Corp. in September 2002.3 Pub. L. 106-102, tit. v, 113 Stat. 1338, 1436. 15 U.S.C. §§ 6801 - 6809.  For general informationon Gramm-Leach-Bliley, see CRS Report RL30375, Major Financial Services Legislation, theGramm-Leach-Bliley Act (P.L. 106-102): an Overview, by F. Jean Wells and William D. Jackson.access to financial information turned over to third parties.  United States v. Miller, 425U.S. 435 (1976).  This means that although the Fourth Amendment to the United StatesConstitution requires a search warrant for a law enforcement agent to obtain such recordsas a person’s own copies of canceled checks, credit card charges and receipts, loanapplications, and stock transfer records, it does not protect the same records when theyare held by financial institutions. State constitutions and laws  may provide greaterprotection.2Various federal statutes provide a measure of privacy protection for financial records.The Right to Financial Privacy Act, 12 U.S.C. §§ 3401 -3422,  sets procedures for federalgovernment access to customer financial records held by financial institutions.  The FairCredit Reporting Act (FCRA), 15 U.S.C. §§ 1681 to 1681t,  establishes standards forcollection and permissible purposes for dissemination of data by consumer reportingagencies.  It also gives consumers access to their files and the right to correct informationtherein. The Electronic Funds Transfer Act, 15 U.S.C. §§ 1693a to 1693r, describes therights and liabilities of consumers using electronic fund transfer systems.  Among themis the right to have the financial institution provide them with information as to thecircumstances under which information concerning their accounts will be disclosed tothird parties.  With the passage of the Fair Credit Reporting Act Amendments of 1996,P.L. 104-208, Div. A, Tit. II, Subtitle d, Ch. 1, § 2419, 110 Stat. 3009-452, adding 15U.S.C.§ 1681t(b)(2), companies may share with other entities certain customerinformation respecting their transactions and experience with a customer without anynotification requirements.  Other customer information, such as credit report orapplication information, may be shared with other companies in the corporate family ifthe customers are given “clear and conspicuous” notice about the sharing and anopportunity to direct that the information not be shared.Gramm-Leach-Bliley’s Privacy Provisions.  Title V of the Gramm-LeachBliley Act3  contains the privacy provisions enacted in conjunction with financialmodernization legislation.  In addition to strengthening the prohibitions on identity fraudand mandating a federal study on information sharing among financial institutions andtheir affiliates, the legislation requires that federal regulators issue rules that call forfinancial institutions to establish standards to insure the security and confidentiality ofcustomer records.  It prohibits financial institutions from disclosing nonpublic personalinformation to unaffiliated third parties without providing customers the opportunity todecline to have such information disclosed.  Also included are prohibitions on disclosingcustomer account numbers to unaffiliated third parties for use in telemarketing, directmail marketing, or other marketing through electronic mail. Under this legislationfinancial institutions are required to disclose, initially when a customer relationship isestablished and annually, thereafter, their privacy policies, including their policies withrespect to sharing information with affiliates and non-affiliated third parties.CRS-34 Federal Register online at [http://www.access.gpo.gov/su_docs/aces/aces140.html].5  [http://www.naic.org/1news/releases]6 See CRS Report RS20026, Banking’s Proposed ‘Know Your Customer’ Rules.Rules implementing these privacy provisions have been promulgated by the federalbanking and securities regulators.  Implementing regulations were published by thebanking regulators in the Federal Register on June 1, 2000, by the Federal TradeCommission on May 24, and by the SEC on June 29.  65 Fed. Reg. 35162, 33646, and40334.4   They became effective on November 13, 2000; and information may be sharedthereafter provided the necessary steps have been taken by the financial institutions.  SeeFTC regulations at http://www.ftc.gov/privacy/glbact/index.html. Consumers may opt outat any time. Identity theft and pretext calling guidelines  were issued to banks on April 6,2001.[http://www.federalreserve.gov/boarddocs/SRLetters/2001/sr0111.htm]. Insuranceindustry compliance has been handled on a state-by-state basis by the appropriate stateauthority.  The National Association of Insurance Commissioners (NAIC) approved amodel law respecting disclosure of consumer financial and health information intendedto guide state legislative efforts in the area.5   These privacy provisions preempt state law except to the extent that the state lawprovides greater protection to consumers.  The Federal Trade Commission, in conjunctionwith the other federal financial institution regulators, is to make the determination as towhether or not a state law is preempted.  The Conference Committee rejectedamendments that would have required customers to opt in, i.e., consent, before financialinstitutions could share customer financial information with either affiliates or thirdparties.  Privacy issues were discussed at each stage of the legislative process in the Houseconsideration of financial modernization legislation.  The House Banking Committeemarkup of the legislation (H.R. 10, 106th Cong.)  included the rejection of an amendment,offered by Representative Inslee, that would have permitted bank customers to precludesharing their information with third parties.  What was accepted instead and included inthe bill as reported by the House Banking Committee (H.Rept. 106-74)were provisionsthat would:   require institutions to disclose their privacy policies, mandate a federalprivacy study, and prohibit the sharing health information derived from insuranceactivities. As reported by the House Commerce Committee, H.R. 10's prohibition againstsharing individually identified health information derived from insurance activities wouldhave been extended to include genetic information; customers would have been given theopportunity to opt out of  information sharing by their financial institutions; andconsumers would have been able to examine, upon request, nonpublic personalinformation before their financial institution shares or sells such information forconsideration to nonaffiliated  persons or entities.Public and Industry Reaction.  One of the indications of the public’s interestin preserving the confidentiality of personal information conveyed to financial serviceproviders was the negative reaction to what became an aborted attempt by the federalbanking regulators to promulgate “Know Your Customer” rules.6  These rules would haveimposed precisely detailed requirements on banks and other financial institutions toestablish profiles of expected financial activity and monitor their customers transactionsagainst these profiles.  Even before the Know Your Customer Rules and enactment ofGramm-Leach-Bliley, depository institutions and their regulators have increasinglyCRS-47 See “Financial Privacy in America: A Review of Consumer Financial Issues,” (June 1998). [http://www.aba.com].8 “Fair Credit Reporting Act,” OCC AL 99-3 (March 29, 1999).9 California enacted legislation that requires credit card issuers to provide consumers anopportunity to opt out of information sharing for marketing purposes, includes informationsharing with affiliates for marketing purposes, and requires provision of a toll-free telephonenumber for exercising this right to opt out.  2000 Cal. Stat., ch. 977; 2000 Cal. Adv.Leg. Serv.977 (Deering).10 “FTC Head Favors Federal Action on Privacy, Says Argument for Preemption Now Stronger,”6 Electronic Commerce & Law Report 7 (January 3, 2001).11 [http://www.nysba.org/Content/ContentGroups/News1/Release_attachments/nysbavftc.pdf]The American Bar Association had also requested an exemption for attorneys on the grounds thatthey are subject to stricter confidential requirements under their Code of ProfessionalResponsibility and because having to send out Gramm-Leach-Bliley privacy notices couldconfuse their clients as to that confidentiality.[http://www.abanet.org/poladv/letters/exec/privacy071001.html]. promoted industry self-regulation as a means of instilling consumer confidence andforestalling comprehensive privacy regulation by state and federal governments.  TheAmerican Bankers Association, for example, promulgates eight privacy principles for thebanking industry,7 and one of the federal banking regulators, the Office of Comptrollerof the Currency, issued an advisory letter regarding information sharing.8   The regulatoryscheme set in place by Gramm-Leach-Bliley became operative on July 1, 2001.  In acertain sense,  the debate as to whether information sharing by financial institutions withthird parties–outside of their corporate families–should require actual consent rather thanan opportunity to opt out continues.  Both the FCRA and Gramm-Leach-Bliley containprovisions permitting limited and particularized state preemption of federal standardswhen state laws provide more protection for consumers. The year 2000 saw  activity insome state legislatures considering ways to enhance the protections of Gramm-Leach-Bliley, including requiring actual consent–or opt in–before information sharing  Only onestate, California, enacted more protective legislation.9   Industry sources view having tocomply with multiple and inconsistent state regimes as posing excessive regulatory costs,litigation prospects, and liability potential.  The validity of their claims may be reflectedin a position taken by Robert Pitofsky, former Chairman of the Federal TradeCommission, in December 2000, when he went on record as potentially favoringlegislation geared towards a nationwide financial privacy standard.  In the same speech,however, he indicated that he would also consider enactment of legislation that theindustry has resisted:  requiring financial services providers to obtain customer consentbefore sharing data, i.e., an opt-in requirement  rather than the current opt-out standard.10A potential issue is the extent of coverage of Gramm-Leach-Bliley.  It covers“financial institutions” within the meaning of the Bank Holding Company Act.  Manycommercial entities that sell or perform services for consumers are not included; somelawyers and accountants may be included because  they perform services designated as“financial in nature” either by the BHCA, itself, or by the regulators under authority ofthat legislation as amended by Gramm-Leach-Bliley. On April 8, 2002, the FTCdetermined that lawyers were covered and that it had no authority to grant them anexemption; subsequently the New York State Bar Association filed suit.11CRS-512 See Department of Commerce website:  [http://www.ita.doc.gov/].The European Union Data Directive.  Another incentive for a nationwidestandard has been the requirements imposed upon companies doing business in Europeunder the European Commission on Data Protection (EU Data Directive), an official actof the European Parliament and Council, dated October 24, 1995 (95/46/EC). Thisimposes strict privacy guidelines respecting the sharing of customer information andbarring transfers, even within the same corporate family, outside of Europe, unless thetransfer is to a country having privacy laws affording similar protection as does Europe.The Department of Commerce has negotiated an agreement with the European Union thatoffers a framework under which US companies may be certified by the Department ofCommerce and obtain a safe harbor, thereby continuing data transfers.12  To date, thebanking industry has not availed itself of this safe harbor, nor has the EU acceptedGramm-Leach-Bliley as one of the safe harbors meeting the Data Directive’srequirements.  U.S. entities with a presence in Europe, including some of the large bankholding companies, have chosen to draft guidelines and codes of conduct to meet theEuropean standard and to satisfy that standard through separate negotiations. U.S.companies also have the option of adopting a standard contract approved in June 2001 bythe European Commission, despite U.S. objections, for foreign companies to use tocomply with the EU Data Directive.Legislation.  In the 107th Congress, Title III of P.L. 107-56, the USA PATRIOTAct, includes various amendments to the anti-money laundering laws and requires closerscrutiny of accounts held in the name of foreign banks and stricter procedures foridentifying new customers.  Various proposals to amend Gramm-Leach-Bliley wereconsidered, some of which would broaden protection for consumer financial informationby requiring an affirmative opt-in for disclosures of specified sensitive information.There were also measures to preempt state law and, thereby, prevent states fromestablishing more protections than are offered under federal law.The108th Congress may have an early opportunity to consider the issue of federalpreemption.  Gramm-Leach-Bliley’s privacy title preempts inconsistent state law exceptto the extent that state law provides greater privacy protection to consumers.  The FairCredit Reporting Act provisions on affiliate sharing have a similar preemption provision,which is, however, not open-ended but which expires on January 1, 2004.  After that date,states may enact laws that provide  consumers more protection with respect to informationsharing among affiliates.  15 U.S.C. § 1681t(d)(2). The financial services industry favorsan extension of federal preemption as a means of continuing the efficiencies in operationsand services that come with broader access to consumer information and avoiding thedifficulties of complying with inconsistent state laws.  On the other hand, consumeradvocates generally favor broader protections than offered under federal law, e.g.,requiring affirmative customer consent for sharing information with affiliates.Complicating the matter is the short time frame, the crowded legislative agenda, and thedistinct possibility that raising this issue will raise broader privacy and Fair CreditReporting Act issues.Specifically, the FCRA provisions on affiliate sharing of information preempt statelaw until January 1, 2004.  Subsection (b)(2) of section 624, 15 U.S.C. § 1681t(b)(2),provides a general exception to the FCRA’s general rule on preemption.  Under that rule,FCRA does not preempt state law, unless  the state law is inconsistent, and then it isCRS-613 15 U.S.C. § 1681t(a).14 15 U.S.C. § 1681t(b)(2).15 15 U.S.C. § 1681t(d)(2).16 15 U.S.C. §§ 6824(b), Pub. L. 106-102, § 524(b), 113 Stat. 1448.preempted only to the extent of the inconsistency.13  An exception to this rule applies tosharing of information among affiliates.14  States may override this exception afterJanuary 1, 2004, by  enacting laws providing greater protection to consumers with respectto information sharing among affiliates.15  Gramm-Leach-Bliley, on the other hand,preempts state laws to the extent that they are inconsistent but provides that “a Statestatute, regulation, order, or interpretation is not inconsistent ... if the protection suchstatute, regulation, order, or interpretation affords any person is greater than the protectionunder this subtitle as determined by the Federal Trade Commission....”16   States mayprovide greater protection to consumers than Gramm-Leach-Bliley at any time.  TheFCRA moratorium ends on January 1, 2004.

Privacy Protection for Customer Financial Information

1 This report addresses financial privacy issues.  For more general information on privacy issuessee:  CRS Report RL30671, Personal Privacy Protection: The Legislative Response.Congressional Research Service ˜ The Library of CongressCRS Report for CongressReceived through the CRS WebOrder Code RS20185Updated May 2, 2003Privacy Protection for Customer Financial InformationM. Maureen MurphyLegislative AttorneyAmerican Law DivisionSummaryTitle V of the Gramm-Leach-Bliley Act of 1999 (GLBA)  (P.L. 106-102, H.Rept.106-434) requires financial institutions to provide their customers with notice of theirprivacy policies. It prohibits financial institutions from sharing nonpublic personallyidentifiable customer information with non-affiliated third parties without givingconsumers an opportunity to opt out and prohibits financial institutions from providingaccount numbers to non-affiliated third parties for marketing purposes.  It requiresfinancial institutions to safeguard the security and confidentiality of customerinformation.  Finally, it delegates rulemaking and enforcement authority to the federalbanking and security regulators, the Federal Trade Commission, and state insuranceregulators.  In the 108th Congress, H.R. 1766 would give preemptive effect to theGramm-Leach-Bliley privacy provisions and would make permanent certain Fair CreditReporting Act (FCRA) preemptions of state law relative to information sharing amongaffiliates. S. 660 would make the FCRA preemptions permanent but would not affectGramm-Leach-Bliley. H.R. 781 would provide a means to exempt lawyers from GLBArequirements. This report will be updated to reflect action on major legislation.  Forfurther information see CRS Report RS21427, Financial Privacy Laws AffectingSharing of Customer Information Among Affiliated Institutions, and CRS ReportRL31758, Financial Privacy: The Economics of Opt-In vs Opt-Out.Background.  With modern technology’s ability to gather and retain data, financialservices businesses have increasingly found ways to take advantage of their largereservoirs of customer information. Not only can they serve their customers better bytailoring services and communications to their  preferences, but they can profit fromsharing that information with others willing to pay for customer lists or targeted marketingcompilations.1  While some consumers are pleased with the wider access to informationabout available services that information sharing among financial services providersCRS-22  Local ordinances in San Mateo County and Daly City, California requiring customeraffirmative permission for a financial institution to share personal data are the subject of a lawsuitbrought by Wells Fargo Co. and Bank of America Corp. in September 2002.3 P.L. 106-102, tit. v, 113 Stat. 1338, 1436. 15 U.S.C. §§ 6801 - 6809.  For general informationon Gramm-Leach-Bliley, see CRS Report RL30375, Major Financial Services Legislation, theGramm-Leach-Bliley Act (P.L. 106-102): an Overview, by F. Jean Wells and William D. Jackson.offers, others have raised privacy concerns.  Individuals are particularly interested incontrols on secondary usage.  The United States has no general law of financial privacy.The Constitution, itself, has been held to provide no protection against governmentalaccess to financial information turned over to third parties.  United States v. Miller, 425U.S. 435 (1976).  This means that although the Fourth Amendment to the United StatesConstitution requires a search warrant for a law enforcement agent to obtain such recordsas a person’s own copies of canceled checks, credit card charges and receipts, loanapplications, and stock transfer records, it does not protect the same records when theyare held by financial institutions. State constitutions and laws  may provide greaterprotection.2Various federal statutes provide a measure of privacy protection for financial records.The Right to Financial Privacy Act, 12 U.S.C. §§ 3401 -3422,  sets procedures for federalgovernment access to customer financial records held by financial institutions.  The FairCredit Reporting Act (FCRA), 15 U.S.C. §§ 1681 to 1681t,  establishes standards forcollection and permissible purposes for dissemination of data by consumer reportingagencies.  It also gives consumers access to their files and the right to correct informationtherein. The Electronic Funds Transfer Act, 15 U.S.C. §§ 1693a to 1693r, describes therights and liabilities of consumers using electronic fund transfer systems.  Among themis the right to have the financial institution provide them with information as to thecircumstances under which information concerning their accounts will be disclosed tothird parties.  With the passage of the Fair Credit Reporting Act Amendments of 1996,P.L. 104-208, Div. A, Tit. II, Subtitle d, Ch. 1, § 2419, 110 Stat. 3009-452, adding 15U.S.C.§ 1681t(b)(2), companies may share with other entities certain customerinformation respecting their transactions and experience with a customer without anynotification requirements.  Other customer information, such as credit report orapplication information, may be shared with other companies in the corporate family ifthe customers are given “clear and conspicuous” notice about the sharing and anopportunity to direct that the information not be shared.Gramm-Leach-Bliley’s Privacy Provisions.  Title V of the Gramm-LeachBliley Act (GLBA)3  contains the privacy provisions enacted in conjunction with financialmodernization legislation.  In addition to strengthening the prohibitions on identity fraudand mandating a federal study on information sharing among financial institutions andtheir affiliates, the legislation requires that federal regulators issue rules that call forfinancial institutions to establish standards to insure the security and confidentiality ofcustomer records.  It prohibits financial institutions from disclosing nonpublic personalinformation to unaffiliated third parties without providing customers the opportunity todecline to have such information disclosed.  Also included are prohibitions on disclosingcustomer account numbers to unaffiliated third parties for use in telemarketing, directmail marketing, or other marketing through electronic mail. Under this legislationfinancial institutions are required to disclose, initially when a customer relationship isCRS-34 Federal Register online at [http://www.access.gpo.gov/su_docs/aces/aces140.html].5  [http://www.naic.org/1news/releases]6 See CRS Report RS20026, Banking’s Proposed ‘Know Your Customer’ Rules.established and annually, thereafter, their privacy policies, including their policies withrespect to sharing information with affiliates and non-affiliated third parties.Rules implementing these privacy provisions have been promulgated by the federalbanking and securities regulators.  Implementing regulations were published by thebanking regulators in the Federal Register on June 1, 2000, by the Federal TradeCommission on May 24, and by the SEC on June 29.  65 Fed. Reg. 35162, 33646, and40334.4   They became effective on November 13, 2000; and information may be sharedthereafter provided the necessary steps have been taken by the financial institutions.  SeeFTC regulations at [http://www.ftc.gov/privacy/glbact/index.html]. Consumers may optout at any time. Identity theft and pretext calling guidelines  were issued to banks on April6, 2001.  [http://www.federalreserve.gov/boarddocs/SRLetters/2001/sr0111.htm].Insurance industry compliance has been handled on a state-by-state basis by theappropriate state authority.  The National Association of Insurance Commissioners(NAIC) approved a model law respecting disclosure of consumer financial and healthinformation intended to guide state legislative efforts in the area.5   These privacy provisions preempt state law except to the extent that the state lawprovides greater protection to consumers.  The Federal Trade Commission, in conjunctionwith the other federal financial institution regulators, is to make the determination as towhether or not a state law is preempted.  The Conference Committee rejectedamendments that would have required customers to opt in, i.e., consent, before financialinstitutions could share customer financial information with either affiliates or thirdparties.  Privacy issues were discussed at each stage of the legislative process in the Houseconsideration of financial modernization legislation.  The House Banking Committeemarkup of the legislation (H.R. 10, 106th Cong.)  included the rejection of an amendment,offered by Representative Inslee, that would have permitted bank customers to precludesharing their information with third parties.  What was accepted instead and included inthe bill as reported by the House Banking Committee (H.Rept. 106-74)were provisionsthat would:   require institutions to disclose their privacy policies, mandate a federalprivacy study, and prohibit the sharing health information derived from insuranceactivities. As reported by the House Commerce Committee, H.R. 10's prohibition againstsharing individually identified health information derived from insurance activities wouldhave been extended to include genetic information; customers would have been given theopportunity to opt out of  information sharing by their financial institutions; andconsumers would have been able to examine, upon request, nonpublic personalinformation before their financial institution shares or sells such information forconsideration to nonaffiliated  persons or entities.Public and Industry Reaction.  One of the indications of the public’s interestin preserving the confidentiality of personal information conveyed to financial serviceproviders was the negative reaction to what became an aborted attempt by the federalbanking regulators to promulgate “Know Your Customer” rules.6  These rules would haveimposed precisely detailed requirements on banks and other financial institutions toCRS-47 See “Financial Privacy in America: A Review of Consumer Financial Issues,” (June 1998). [http://www.aba.com].8 “Fair Credit Reporting Act,” OCC AL 99-3 (March 29, 1999).9 California enacted legislation that requires credit card issuers to provide consumers anopportunity to opt out of information sharing for marketing purposes, includes informationsharing with affiliates for marketing purposes, and requires provision of a toll-free telephonenumber for exercising this right to opt out.  2000 Cal. Stat., ch. 977; 2000 Cal. Adv.Leg. Serv.977 (Deering).10 “FTC Head Favors Federal Action on Privacy, Says Argument for Preemption Now Stronger,”6 Electronic Commerce & Law Report 7 (January 3, 2001).11 [http://www.nysba.org/Content/ContentGroups/News1/Release_attachments/nysbavftc.pdf]The American Bar Association had also requested an exemption for attorneys on the grounds thatthey are subject to stricter confidential requirements under their Code of Professional(continued...)establish profiles of expected financial activity and monitor their customers transactionsagainst these profiles.  Even before the Know Your Customer Rules and enactment ofGramm-Leach-Bliley, depository institutions and their regulators have increasinglypromoted industry self-regulation as a means of instilling consumer confidence andforestalling comprehensive privacy regulation by state and federal governments.  TheAmerican Bankers Association, for example, promulgates eight privacy principles for thebanking industry,7 and one of the federal banking regulators, the Office of Comptrollerof the Currency, issued an advisory letter regarding information sharing.8   The regulatoryscheme set in place by Gramm-Leach-Bliley became operative on July 1, 2001.  In acertain sense,  the debate as to whether information sharing by financial institutions withthird parties–outside of their corporate families–should require actual consent rather thanan opportunity to opt out continues.  Both the FCRA and Gramm-Leach-Bliley containprovisions permitting limited and particularized state preemption of federal standardswhen state laws provide more protection for consumers. The year 2000 saw  activity insome state legislatures considering ways to enhance the protections of Gramm-Leach-Bliley, including requiring actual consent–or opt in–before information sharing  Only onestate, California, enacted more protective legislation.9   Industry sources view having tocomply with multiple and inconsistent state regimes as posing excessive regulatory costs,litigation prospects, and liability potential.  The validity of their claims may be reflectedin a position taken by Robert Pitofsky, former Chairman of the Federal TradeCommission, in December 2000, when he went on record as potentially favoringlegislation geared towards a nationwide financial privacy standard.  In the same speech,however, he indicated that he would also consider enactment of legislation that theindustry has resisted:  requiring financial services providers to obtain customer consentbefore sharing data, i.e., an opt-in requirement  rather than the current opt-out standard.10A potential issue is the extent of coverage of Gramm-Leach-Bliley.  It covers“financial institutions” within the meaning of the Bank Holding Company Act.  Manycommercial entities that sell or perform services for consumers are not included; somelawyers and accountants may be included because  they perform services designated as“financial in nature” either by the BHCA, itself, or by the regulators under authority ofthat legislation as amended by Gramm-Leach-Bliley. On April 8, 2002, the FTCdetermined that lawyers were covered and that it had no authority to grant them anexemption; subsequently the New York State Bar Association filed suit.11  H.R. 781,CRS-511 (...continued)Responsibility and because having to send out Gramm-Leach-Bliley privacy notices couldconfuse their clients as to that confidentiality.[http://www.abanet.org/poladv/letters/exec/privacy071001.html]. 12 For information on the other aspects of the Fair Credit Reporting Act covered by thepreemptions provision set to expire on January 1, 2004, see CRS Report RS20449, Fair CreditReporting Act: Preemption of State Law.13 15 U.S.C. § 1681t(a).introduced by Rep. Biggert in the 108th Congress, would exempt attorneys subject toprofessional rules of conduct requiring confidentiality from having to comply with theGLBA provisions.The European Union Data Directive.  Another incentive for a nationwidestandard has been the requirements imposed upon companies doing business in Europeunder the European Commission on Data Protection (EU Data Directive), an official actof the European Parliament and Council, dated October 24, 1995 (95/46/EC). Thisimposes strict privacy guidelines respecting the sharing of customer information andbarring transfers, even within the same corporate family, outside of Europe, unless thetransfer is to a country having privacy laws affording similar protection as does Europe.Legislation.  In the 107th Congress, Title III of P.L. 107-56, the USA PATRIOTAct, includes various amendments to the anti-money laundering laws and requires closerscrutiny of accounts held in the name of foreign banks and stricter procedures foridentifying new customers.  Various proposals to amend Gramm-Leach-Bliley wereconsidered, some of which would broaden protection for consumer financial informationby requiring an affirmative opt-in for disclosures of specified sensitive information.There were also measures to preempt state law and, thereby, prevent states fromestablishing more protections than are offered under federal law.The108th Congress may have an early opportunity to consider the issue of federalpreemption. The Fair Credit Reporting Act provisions on affiliate sharing preempt statelaw until January 1, 2004.12  After that date, any state may enact a law that providesconsumers more protection with respect to information sharing among affiliates, providedthe law explicitly states that it is intended to supplement the Fair Credit Reporting Actprovision.  15 U.S.C. § 1681t(d)(2). The financial services industry favors an extensionof federal preemption as a means of continuing the efficiencies in operations and servicesthat come with broader access to consumer information and avoiding the difficulties ofcomplying with inconsistent state laws.  On the other hand, consumer advocates generallyfavor broader protections than offered under federal law, e.g., requiring affirmativecustomer consent for sharing information with affiliates.  Complicating the matter is theshort time frame, the crowded legislative agenda, and the distinct possibility that raisingthis issue will raise broader privacy and Fair Credit Reporting Act issues.Specifically, the FCRA provisions on affiliate sharing of information preempt statelaw until January 1, 2004.  Subsection (b)(2) of section 624, 15 U.S.C. § 1681t(b)(2),provides a general exception to the FCRA’s general rule on preemption.  Under that rule,FCRA does not preempt state law, unless  the state law is inconsistent, and then it ispreempted only to the extent of the inconsistency.13  An exception to this rule applies toCRS-614 15 U.S.C. § 1681t(b)(2).15 15 U.S.C. § 1681t(d)(2).16 15 U.S.C. §§ 6824(b), Pub. L. 106-102, § 524(b), 113 Stat. 1448.sharing of information among affiliates.14  States may override this exception afterJanuary 1, 2004, by  enacting laws providing greater protection to consumers with respectto information sharing among affiliates.15  Gramm-Leach-Bliley, on the other hand,preempts state laws to the extent that they are inconsistent but provides that “a Statestatute, regulation, order, or interpretation is not inconsistent ... if the protection suchstatute, regulation, order, or interpretation affords any person is greater than the protectionunder this subtitle as determined by the Federal Trade Commission....”16   States mayprovide greater protection to consumers than Gramm-Leach-Bliley at any time.  TheFCRA moratorium ends on January 1, 2004.S. 660 (Sen Johnson) would make the FCRA preemptions permanent, therebypreempting state laws or regulations restricting information sharing among corporateaffiliates. H.R. 1766 (Reps. Tiberi and Lucas), in addition to making the FCRA preemptionspermanent, would give preemptive effect to GLBA’s provisions respecting disclosure ofnonpublic personal information by financial institutions, effectively establishing anational standard for disclosure of customer information by financial institutions.   Itwould prevent states and local governments from imposing additional requirements, suchas an opt-in for information sharing with non-affiliated third parties, more detailed ormore frequent notice requirements, or increased protection for sensitive data.

1 This report addresses financial privacy issues.  For more general information on privacy issuessee:  CRS Report RL30671, Personal Privacy Protection: The Legislative Response.Congressional Research Service ˜ The Library of CongressCRS Report for CongressReceived through the CRS WebOrder Code RS20185Updated June 13, 2003Privacy Protection for Customer Financial InformationM. Maureen MurphyLegislative AttorneyAmerican Law DivisionSummaryTitle V of the Gramm-Leach-Bliley Act of 1999 (GLBA)  (P.L. 106-102, H.Rept.106-434) prohibits financial institutions from sharing nonpublic personally identifiablecustomer information with non-affiliated third parties without giving consumers anopportunity to opt out and requires them to provide customers with notice of theirprivacy policies. It requires financial institutions to safeguard the security andconfidentiality of customer information.  Finally, it delegates rulemaking andenforcement authority to the federal banking and security regulators, the Federal TradeCommission, and state insurance regulators.  In the 108th Congress, H.R. 1766 wouldgive preemptive effect to the Gramm-Leach-Bliley privacy provisions and would makepermanent certain Fair Credit Reporting Act (FCRA) preemptions of state law relativeto information sharing among affiliates. S. 660 would make the FCRA preemptionspermanent but would not affect Gramm-Leach-Bliley.  H.R. 781 would provide a meansto exempt lawyers from GLBA requirements. This report will be updated to reflectaction on major legislation.  For further information see CRS Reports RS21427,Financial Privacy Laws Affecting Sharing of Customer Information Among AffiliatedInstitutions, RL31758, Financial Privacy: The Economics of Opt-In vs Opt-Out; andRL318476, TheRole of Information in Lending: The Cost of Privacy Restrictions.Background.  With modern technology’s ability to gather and retain data, financialservices businesses have increasingly found ways to take advantage of their largereservoirs of customer information. Not only can they serve their customers better bytailoring services and communications to their  preferences, but they can profit fromsharing that information with others willing to pay for customer lists or targeted marketingcompilations.1  While some consumers are pleased with the wider access to informationabout available services that information sharing among financial services providersoffers, others have raised privacy concerns.  Individuals are particularly interested inCRS-22  Local ordinances in San Mateo County and Daly City, California requiring customeraffirmative permission for a financial institution to share personal data are the subject of a lawsuitbrought by Wells Fargo Co. and Bank of America Corp. in September 2002.3 P.L. 106-102, tit. v, 113 Stat. 1338, 1436. 15 U.S.C. §§ 6801 - 6809.  For general informationon Gramm-Leach-Bliley, see CRS Report RL30375, Major Financial Services Legislation, theGramm-Leach-Bliley Act (P.L. 106-102): an Overview, by F. Jean Wells and William D. Jackson.controls on secondary usage.  The United States has no general law of financial privacy.The Constitution, itself, has been held to provide no protection against governmentalaccess to financial information turned over to third parties.  United States v. Miller, 425U.S. 435 (1976).  This means that although the Fourth Amendment to the United StatesConstitution requires a search warrant for a law enforcement agent to obtain such recordsas a person’s own copies of canceled checks, credit card charges and receipts, loanapplications, and stock transfer records, it does not protect the same records when theyare held by financial institutions. State constitutions and laws  may provide greaterprotection.2Various federal statutes provide a measure of privacy protection for financial records.The Right to Financial Privacy Act, 12 U.S.C. §§ 3401 -3422,  sets procedures for federalgovernment access to customer financial records held by financial institutions.  The FairCredit Reporting Act (FCRA), 15 U.S.C. §§ 1681 to 1681t,  establishes standards forcollection and permissible purposes for dissemination of data by consumer reportingagencies.  It also gives consumers access to their files and the right to correct informationtherein. The Electronic Funds Transfer Act, 15 U.S.C. §§ 1693a to 1693r, describes therights and liabilities of consumers using electronic fund transfer systems.  Among themis the right to have the financial institution provide them with information as to thecircumstances under which information concerning their accounts will be disclosed tothird parties.  With the passage of the Fair Credit Reporting Act Amendments of 1996,P.L. 104-208, Div. A, Tit. II, Subtitle d, Ch. 1, § 2419, 110 Stat. 3009-452, adding 15U.S.C.§ 1681t(b)(2), companies may share with other entities certain customerinformation respecting their transactions and experience with a customer without anynotification requirements.  Other customer information, such as credit report orapplication information, may be shared with other companies in the corporate family ifthe customers are given “clear and conspicuous” notice about the sharing and anopportunity to direct that the information not be shared.Gramm-Leach-Bliley’s Privacy Provisions.  Title V of the Gramm-LeachBliley Act (GLBA)3  contains the privacy provisions enacted in conjunction with financialmodernization legislation.  In addition to strengthening the prohibitions on identity fraudand mandating a federal study on information sharing among financial institutions andtheir affiliates, the legislation requires that federal regulators issue rules that call forfinancial institutions to establish standards to insure the security and confidentiality ofcustomer records.  It prohibits financial institutions from disclosing nonpublic personalinformation to unaffiliated third parties without providing customers the opportunity todecline to have such information disclosed.  Also included are prohibitions on disclosingcustomer account numbers to unaffiliated third parties for use in telemarketing, directmail marketing, or other marketing through electronic mail. Under this legislationfinancial institutions are required to disclose, initially when a customer relationship isCRS-34 Federal Register online at [http://www.access.gpo.gov/su_docs/aces/aces140.html].5  [http://www.naic.org/1news/releases]6 See CRS Report RS20026, Banking’s Proposed ‘Know Your Customer’ Rules.established and annually, thereafter, their privacy policies, including their policies withrespect to sharing information with affiliates and non-affiliated third parties.Rules implementing these privacy provisions have been promulgated by the federalbanking and securities regulators.  Implementing regulations were published by thebanking regulators in the Federal Register on June 1, 2000, by the Federal TradeCommission on May 24, and by the SEC on June 29.  65 Fed. Reg. 35162, 33646, and40334.4   They became effective on November 13, 2000; and information may be sharedthereafter provided the necessary steps have been taken by the financial institutions.  SeeFTC regulations at [http://www.ftc.gov/privacy/glbact/index.html]. Consumers may optout at any time. Identity theft and pretext calling guidelines  were issued to banks on April6, 2001.  [http://www.federalreserve.gov/boarddocs/SRLetters/2001/sr0111.htm].Insurance industry compliance has been handled on a state-by-state basis by theappropriate state authority.  The National Association of Insurance Commissioners(NAIC) approved a model law respecting disclosure of consumer financial and healthinformation intended to guide state legislative efforts in the area.5   These privacy provisions preempt state law except to the extent that the state lawprovides greater protection to consumers.  The Federal Trade Commission, in conjunctionwith the other federal financial institution regulators, is to make the determination as towhether or not a state law is preempted.  The Conference Committee rejectedamendments that would have required customers to opt in, i.e., consent, before financialinstitutions could share customer financial information with either affiliates or thirdparties.  Privacy issues were discussed at each stage of the legislative process in the Houseconsideration of financial modernization legislation.  The House Banking Committeemarkup of the legislation (H.R. 10, 106th Cong.)  included the rejection of an amendment,offered by Representative Inslee, that would have permitted bank customers to precludesharing their information with third parties.  What was accepted instead and included inthe bill as reported by the House Banking Committee (H.Rept. 106-74)were provisionsthat would:   require institutions to disclose their privacy policies, mandate a federalprivacy study, and prohibit the sharing health information derived from insuranceactivities. As reported by the House Commerce Committee, H.R. 10's prohibition againstsharing individually identified health information derived from insurance activities wouldhave been extended to include genetic information; customers would have been given theopportunity to opt out of  information sharing by their financial institutions; andconsumers would have been able to examine, upon request, nonpublic personalinformation before their financial institution shares or sells such information forconsideration to nonaffiliated  persons or entities.Public and Industry Reaction.  One of the indications of the public’s interestin preserving the confidentiality of personal information conveyed to financial serviceproviders was the negative reaction to what became an aborted attempt by the federalbanking regulators to promulgate “Know Your Customer” rules.6  These rules would haveimposed precisely detailed requirements on banks and other financial institutions toCRS-47 See “Financial Privacy in America: A Review of Consumer Financial Issues,” (June 1998). [http://www.aba.com].8 “Fair Credit Reporting Act,” OCC AL 99-3 (March 29, 1999).9 California enacted legislation that requires credit card issuers to provide consumers anopportunity to opt out of information sharing for marketing purposes, includes informationsharing with affiliates for marketing purposes, and requires provision of a toll-free telephonenumber for exercising this right to opt out.  2000 Cal. Stat., ch. 977; 2000 Cal. Adv.Leg. Serv.977 (Deering).10 “FTC Head Favors Federal Action on Privacy, Says Argument for Preemption Now Stronger,”6 Electronic Commerce & Law Report 7 (January 3, 2001).11 [http://www.nysba.org/Content/ContentGroups/News1/Release_attachments/nysbavftc.pdf]The American Bar Association had also requested an exemption for attorneys on the grounds thatthey are subject to stricter confidential requirements under their Code of Professional(continued...)establish profiles of expected financial activity and monitor their customers transactionsagainst these profiles.  Even before the Know Your Customer Rules and enactment ofGramm-Leach-Bliley, depository institutions and their regulators have increasinglypromoted industry self-regulation as a means of instilling consumer confidence andforestalling comprehensive privacy regulation by state and federal governments.  TheAmerican Bankers Association, for example, promulgates eight privacy principles for thebanking industry,7 and one of the federal banking regulators, the Office of Comptrollerof the Currency, issued an advisory letter regarding information sharing.8   The regulatoryscheme set in place by Gramm-Leach-Bliley became operative on July 1, 2001.  In acertain sense,  the debate as to whether information sharing by financial institutions withthird parties–outside of their corporate families–should require actual consent rather thanan opportunity to opt out continues.  Both the FCRA and Gramm-Leach-Bliley containprovisions permitting limited and particularized state preemption of federal standardswhen state laws provide more protection for consumers. The year 2000 saw  activity insome state legislatures considering ways to enhance the protections of Gramm-Leach-Bliley, including requiring actual consent–or opt in–before information sharing  Only onestate, California, enacted more protective legislation.9   Industry sources view having tocomply with multiple and inconsistent state regimes as posing excessive regulatory costs,litigation prospects, and liability potential.  The validity of their claims may be reflectedin a position taken by Robert Pitofsky, former Chairman of the Federal TradeCommission, in December 2000, when he went on record as potentially favoringlegislation geared towards a nationwide financial privacy standard.  In the same speech,however, he indicated that he would also consider enactment of legislation that theindustry has resisted:  requiring financial services providers to obtain customer consentbefore sharing data, i.e., an opt-in requirement  rather than the current opt-out standard.10A potential issue is the extent of coverage of Gramm-Leach-Bliley.  It covers“financial institutions” within the meaning of the Bank Holding Company Act.  Manycommercial entities that sell or perform services for consumers are not included; somelawyers and accountants may be included because  they perform services designated as“financial in nature” either by the BHCA, itself, or by the regulators under authority ofthat legislation as amended by Gramm-Leach-Bliley. On April 8, 2002, the FTCdetermined that lawyers were covered and that it had no authority to grant them anexemption; subsequently the New York State Bar Association filed suit.11  H.R. 781,CRS-511 (...continued)Responsibility and because having to send out Gramm-Leach-Bliley privacy notices couldconfuse their clients as to that confidentiality.[http://www.abanet.org/poladv/letters/exec/privacy071001.html]. 12 For information on the other aspects of the Fair Credit Reporting Act covered by thepreemptions provision set to expire on January 1, 2004, see CRS Report RS20449, Fair CreditReporting Act: Preemption of State Law.13 15 U.S.C. § 1681t(a).introduced by Rep. Biggert in the 108th Congress, would exempt attorneys subject toprofessional rules of conduct requiring confidentiality from having to comply with theGLBA provisions.The European Union Data Directive.  Another incentive for a nationwidestandard has been the requirements imposed upon companies doing business in Europeunder the European Commission on Data Protection (EU Data Directive), an official actof the European Parliament and Council, dated October 24, 1995 (95/46/EC). Thisimposes strict privacy guidelines respecting the sharing of customer information andbarring transfers, even within the same corporate family, outside of Europe, unless thetransfer is to a country having privacy laws affording similar protection as does Europe.Legislation.  In the 107th Congress, Title III of P.L. 107-56, the USA PATRIOTAct, includes various amendments to the anti-money laundering laws and requires closerscrutiny of accounts held in the name of foreign banks and stricter procedures foridentifying new customers.  Various proposals to amend Gramm-Leach-Bliley wereconsidered, some of which would broaden protection for consumer financial informationby requiring an affirmative opt-in for disclosures of specified sensitive information.There were also measures to preempt state law and, thereby, prevent states fromestablishing more protections than are offered under federal law.The108th Congress may have an early opportunity to consider the issue of federalpreemption. The Fair Credit Reporting Act provisions on affiliate sharing preempt statelaw until January 1, 2004.12  After that date, any state may enact a law that providesconsumers more protection with respect to information sharing among affiliates, providedthe law explicitly states that it is intended to supplement the Fair Credit Reporting Actprovision.  15 U.S.C. § 1681t(d)(2). The financial services industry favors an extensionof federal preemption as a means of continuing the efficiencies in operations and servicesthat come with broader access to consumer information and avoiding the difficulties ofcomplying with inconsistent state laws.  On the other hand, consumer advocates generallyfavor broader protections than offered under federal law, e.g., requiring affirmativecustomer consent for sharing information with affiliates.  Complicating the matter is theshort time frame, the crowded legislative agenda, and the distinct possibility that raisingthis issue will raise broader privacy and Fair Credit Reporting Act issues.Specifically, the FCRA provisions on affiliate sharing of information preempt statelaw until January 1, 2004.  Subsection (b)(2) of section 624, 15 U.S.C. § 1681t(b)(2),provides a general exception to the FCRA’s general rule on preemption.  Under that rule,FCRA does not preempt state law, unless  the state law is inconsistent, and then it ispreempted only to the extent of the inconsistency.13  An exception to this rule applies toCRS-614 15 U.S.C. § 1681t(b)(2).15 15 U.S.C. § 1681t(d)(2).16 15 U.S.C. §§ 6824(b), Pub. L. 106-102, § 524(b), 113 Stat. 1448.17  Available at http://financialservices.house.gov/hearings.asp?formmode=All.sharing of information among affiliates.14  States may override this exception afterJanuary 1, 2004, by  enacting laws providing greater protection to consumers with respectto information sharing among affiliates.15  Gramm-Leach-Bliley, on the other hand,preempts state laws to the extent that they are inconsistent but provides that “a Statestatute, regulation, order, or interpretation is not inconsistent ... if the protection suchstatute, regulation, order, or interpretation affords any person is greater than the protectionunder this subtitle as determined by the Federal Trade Commission....”16   States mayprovide greater protection to consumers than Gramm-Leach-Bliley at any time.  TheFCRA moratorium ends on January 1, 2004.S. 660 (Sen Johnson) would make the FCRA preemptions permanent, therebypreempting state laws or regulations restricting information sharing among corporateaffiliates. H.R. 1766 (Reps. Tiberi and Lucas), in addition to making the FCRA preemptionspermanent, would give preemptive effect to GLBA’s provisions respecting disclosure ofnonpublic personal information by financial institutions, effectively establishing anational standard for disclosure of customer information by financial institutions.   Itwould prevent states and local governments from imposing additional requirements, suchas an opt-in for information sharing with non-affiliated third parties, more detailed ormore frequent notice requirements, or increased protection for sensitive data.Hearings on various issues relating to the Fair Credit Reporting Act were held by theHouse Committee on Financial Services on May 28, June 4, and June 12, 2003.17

1 This report addresses financial privacy issues.  For more general information on privacy issuessee:  CRS Report RL30671, Personal Privacy Protection: The Legislative Response, by HaroldC. Relyea.Congressional Research Service ˜ The Library of CongressCRS Report for CongressReceived through the CRS WebOrder Code RS20185Updated April 16, 2003Privacy Protection for Customer Financial InformationM. Maureen MurphyLegislative AttorneyAmerican Law DivisionSummaryTitle V of the Gramm-Leach-Bliley Act of 1999 (GLBA)  (P.L. 106-102, H.Rept.106-434) requires financial institutions to provide their customers with notice of theirprivacy policies. It prohibits financial institutions from sharing nonpublic personallyidentifiable customer information with non-affiliated third parties without givingconsumers an opportunity to opt out and prohibits financial institutions from providingaccount numbers to non-affiliated third parties for marketing purposes.  It requiresfinancial institutions to safeguard the security and confidentiality of customerinformation.  Finally, it delegates rulemaking and enforcement authority to the federalbanking and security regulators, the Federal Trade Commission, and state insuranceregulators.  In the 108th Congress, H.R. 1766 would give preemptive effect to theGramm-Leach-Bliley privacy provisions and would make permanent certain Fair CreditReporting Act preemptions of state law relative to information sharing among affiliates.S. 660 would make the Fair Credit Reporting Act preemptions permanent but would notaffect Gramm-Leach-Bliley. This report will be updated to reflect action on majorlegislation.  For further information see CRS Report RS21427, Financial Privacy LawsAffecting Sharing of Customer Information Among Affiliated Institutions, and CRSReport RL31758, Financial Privacy: The Economics of Opt-In vs Opt-Out.Background.  With modern technology’s ability to gather and retain data, financialservices businesses have increasingly found ways to take advantage of their largereservoirs of customer information. Not only can they serve their customers better bytailoring services and communications to their  preferences, but they can profit fromsharing that information with others willing to pay for customer lists or targeted marketingcompilations.1  While some consumers are pleased with the wider access to informationabout available services that information sharing among financial services providersCRS-22  Local ordinances in San Mateo County and Daly City, California requiring customeraffirmative permission for a financial institution to share personal data are the subject of a lawsuitbrought by Wells Fargo Co. and Bank of America Corp. in September 2002.3 P.L. 106-102, tit. v, 113 Stat. 1338, 1436. 15 U.S.C. §§ 6801 - 6809.  For general informationon Gramm-Leach-Bliley, see CRS Report RL30375, Major Financial Services Legislation, theGramm-Leach-Bliley Act (P.L. 106-102): an Overview, by F. Jean Wells and William D. Jackson.offers, others have raised privacy concerns.  Individuals are particularly interested incontrols on secondary usage.  The United States has no general law of financial privacy.The Constitution, itself, has been held to provide no protection against governmentalaccess to financial information turned over to third parties.  United States v. Miller, 425U.S. 435 (1976).  This means that although the Fourth Amendment to the United StatesConstitution requires a search warrant for a law enforcement agent to obtain such recordsas a person’s own copies of canceled checks, credit card charges and receipts, loanapplications, and stock transfer records, it does not protect the same records when theyare held by financial institutions. State constitutions and laws  may provide greaterprotection.2Various federal statutes provide a measure of privacy protection for financial records.The Right to Financial Privacy Act, 12 U.S.C. §§ 3401 -3422,  sets procedures for federalgovernment access to customer financial records held by financial institutions.  The FairCredit Reporting Act (FCRA), 15 U.S.C. §§ 1681 to 1681t,  establishes standards forcollection and permissible purposes for dissemination of data by consumer reportingagencies.  It also gives consumers access to their files and the right to correct informationtherein. The Electronic Funds Transfer Act, 15 U.S.C. §§ 1693a to 1693r, describes therights and liabilities of consumers using electronic fund transfer systems.  Among themis the right to have the financial institution provide them with information as to thecircumstances under which information concerning their accounts will be disclosed tothird parties.  With the passage of the Fair Credit Reporting Act Amendments of 1996,P.L. 104-208, Div. A, Tit. II, Subtitle d, Ch. 1, § 2419, 110 Stat. 3009-452, adding 15U.S.C.§ 1681t(b)(2), companies may share with other entities certain customerinformation respecting their transactions and experience with a customer without anynotification requirements.  Other customer information, such as credit report orapplication information, may be shared with other companies in the corporate family ifthe customers are given “clear and conspicuous” notice about the sharing and anopportunity to direct that the information not be shared.Gramm-Leach-Bliley’s Privacy Provisions.  Title V of the Gramm-LeachBliley Act (GLBA)3  contains the privacy provisions enacted in conjunction with financialmodernization legislation.  In addition to strengthening the prohibitions on identity fraudand mandating a federal study on information sharing among financial institutions andtheir affiliates, the legislation requires that federal regulators issue rules that call forfinancial institutions to establish standards to insure the security and confidentiality ofcustomer records.  It prohibits financial institutions from disclosing nonpublic personalinformation to unaffiliated third parties without providing customers the opportunity todecline to have such information disclosed.  Also included are prohibitions on disclosingcustomer account numbers to unaffiliated third parties for use in telemarketing, directmail marketing, or other marketing through electronic mail. Under this legislationfinancial institutions are required to disclose, initially when a customer relationship isCRS-34 Federal Register online at [http://www.access.gpo.gov/su_docs/aces/aces140.html].5  [http://www.naic.org/1news/releases]established and annually, thereafter, their privacy policies, including their policies withrespect to sharing information with affiliates and non-affiliated third parties.Rules implementing these privacy provisions have been promulgated by the federalbanking and securities regulators.  Implementing regulations were published by thebanking regulators in the Federal Register on June 1, 2000, by the Federal TradeCommission on May 24, and by the SEC on June 29.  65 Fed. Reg. 35162, 33646, and40334.4   They became effective on November 13, 2000; and information may be sharedthereafter provided the necessary steps have been taken by the financial institutions.  SeeFTC regulations at [http://www.ftc.gov/privacy/glbact/index.html]. Consumers may optout at any time. Identity theft and pretext calling guidelines  were issued to banks on April6, 2001.  [http://www.federalreserve.gov/boarddocs/SRLetters/2001/sr0111.htm].Insurance industry compliance has been handled on a state-by-state basis by theappropriate state authority.  The National Association of Insurance Commissioners(NAIC) approved a model law respecting disclosure of consumer financial and healthinformation intended to guide state legislative efforts in the area.5   These privacy provisions preempt state law except to the extent that the state lawprovides greater protection to consumers.  The Federal Trade Commission, in conjunctionwith the other federal financial institution regulators, is to make the determination as towhether or not a state law is preempted.  The Conference Committee rejectedamendments that would have required customers to opt in, i.e., consent, before financialinstitutions could share customer financial information with either affiliates or thirdparties.  Privacy issues were discussed at each stage of the legislative process in the Houseconsideration of financial modernization legislation.  The House Banking Committeemarkup of the legislation (H.R. 10, 106th Cong.)  included the rejection of an amendment,offered by Representative Inslee, that would have permitted bank customers to precludesharing their information with third parties.  What was accepted instead and included inthe bill as reported by the House Banking Committee (H.Rept. 106-74)were provisionsthat would:   require institutions to disclose their privacy policies, mandate a federalprivacy study, and prohibit the sharing health information derived from insuranceactivities. As reported by the House Commerce Committee, H.R. 10's prohibition againstsharing individually identified health information derived from insurance activities wouldhave been extended to include genetic information; customers would have been given theopportunity to opt out of  information sharing by their financial institutions; andconsumers would have been able to examine, upon request, nonpublic personalinformation before their financial institution shares or sells such information forconsideration to nonaffiliated  persons or entities.Public and Industry Reaction.  One of the indications of the public’s interestin preserving the confidentiality of personal information conveyed to financial serviceproviders was the negative reaction to what became an aborted attempt by the federalCRS-46 See CRS Report RS20026, Banking’s Proposed ‘Know Your Customer’ Rules.7 See “Financial Privacy in America: A Review of Consumer Financial Issues,” (June 1998). [http://www.aba.com].8 “Fair Credit Reporting Act,” OCC AL 99-3 (March 29, 1999).9 California enacted legislation that requires credit card issuers to provide consumers anopportunity to opt out of information sharing for marketing purposes, includes informationsharing with affiliates for marketing purposes, and requires provision of a toll-free telephonenumber for exercising this right to opt out.  2000 Cal. Stat., ch. 977; 2000 Cal. Adv.Leg. Serv.977 (Deering).10 “FTC Head Favors Federal Action on Privacy, Says Argument for Preemption Now Stronger,”6 Electronic Commerce & Law Report 7 (January 3, 2001).banking regulators to promulgate “Know Your Customer” rules.6  These rules would haveimposed precisely detailed requirements on banks and other financial institutions toestablish profiles of expected financial activity and monitor their customers transactionsagainst these profiles.  Even before the Know Your Customer Rules and enactment ofGramm-Leach-Bliley, depository institutions and their regulators have increasinglypromoted industry self-regulation as a means of instilling consumer confidence andforestalling comprehensive privacy regulation by state and federal governments.  TheAmerican Bankers Association, for example, promulgates eight privacy principles for thebanking industry,7 and one of the federal banking regulators, the Office of Comptrollerof the Currency, issued an advisory letter regarding information sharing.8   The regulatoryscheme set in place by Gramm-Leach-Bliley became operative on July 1, 2001.  In acertain sense,  the debate as to whether information sharing by financial institutions withthird parties–outside of their corporate families–should require actual consent rather thanan opportunity to opt out continues.  Both the FCRA and Gramm-Leach-Bliley containprovisions permitting limited and particularized state preemption of federal standardswhen state laws provide more protection for consumers. The year 2000 saw  activity insome state legislatures considering ways to enhance the protections of Gramm-Leach-Bliley, including requiring actual consent–or opt in–before information sharing  Only onestate, California, enacted more protective legislation.9   Industry sources view having tocomply with multiple and inconsistent state regimes as posing excessive regulatory costs,litigation prospects, and liability potential.  The validity of their claims may be reflectedin a position taken by Robert Pitofsky, former Chairman of the Federal TradeCommission, in December 2000, when he went on record as potentially favoringlegislation geared towards a nationwide financial privacy standard.  In the same speech,however, he indicated that he would also consider enactment of legislation that theindustry has resisted:  requiring financial services providers to obtain customer consentbefore sharing data, i.e., an opt-in requirement  rather than the current opt-out standard.10A potential issue is the extent of coverage of Gramm-Leach-Bliley.  It covers“financial institutions” within the meaning of the Bank Holding Company Act.  Manycommercial entities that sell or perform services for consumers are not included; somelawyers and accountants may be included because  they perform services designated as“financial in nature” either by the BHCA, itself, or by the regulators under authority ofthat legislation as amended by Gramm-Leach-Bliley. On April 8, 2002, the FTCdetermined that lawyers were covered and that it had no authority to grant them anCRS-511 [http://www.nysba.org/Content/ContentGroups/News1/Release_attachments/nysbavftc.pdf]The American Bar Association had also requested an exemption for attorneys on the grounds thatthey are subject to stricter confidential requirements under their Code of ProfessionalResponsibility and because having to send out Gramm-Leach-Bliley privacy notices couldconfuse their clients as to that confidentiality.[http://www.abanet.org/poladv/letters/exec/privacy071001.html]. 12 For information on the other aspects of the Fair Credit Reporting Act covered by thepreemptions provision set to expire on January 1, 29004, see CRS Report RS20449, Fair CreditReporting Act: Preemption of State Law.exemption; subsequently the New York State Bar Association filed suit.11  H.R. 781,introduced by Rep. Biggert in the 108th Congress, would exempt attorneys subject toprofessional rules of conduct requiring confidentiality from having to comply with theGLBA provisions.The European Union Data Directive.  Another incentive for a nationwidestandard has been the requirements imposed upon companies doing business in Europeunder the European Commission on Data Protection (EU Data Directive), an official actof the European Parliament and Council, dated October 24, 1995 (95/46/EC). Thisimposes strict privacy guidelines respecting the sharing of customer information andbarring transfers, even within the same corporate family, outside of Europe, unless thetransfer is to a country having privacy laws affording similar protection as does Europe.Legislation.  In the 107th Congress, Title III of P.L. 107-56, the USA PATRIOTAct, includes various amendments to the anti-money laundering laws and requires closerscrutiny of accounts held in the name of foreign banks and stricter procedures foridentifying new customers.  Various proposals to amend Gramm-Leach-Bliley wereconsidered, some of which would broaden protection for consumer financial informationby requiring an affirmative opt-in for disclosures of specified sensitive information.There were also measures to preempt state law and, thereby, prevent states fromestablishing more protections than are offered under federal law.The108th Congress may have an early opportunity to consider the issue of federalpreemption. The Fair Credit Reporting Act provisions on affiliate sharing preempt statelaw until January 1, 2004.12  After that date, any state may enact a law that providesconsumers more protection with respect to information sharing among affiliates, providedthe law explicitly states that it is intended to supplement the Fair Credit Reporting Actprovision.  15 U.S.C. § 1681t(d)(2). The financial services industry favors an extensionof federal preemption as a means of continuing the efficiencies in operations and servicesthat come with broader access to consumer information and avoiding the difficulties ofcomplying with inconsistent state laws.  On the other hand, consumer advocates generallyfavor broader protections than offered under federal law, e.g., requiring affirmativecustomer consent for sharing information with affiliates.  Complicating the matter is theshort time frame, the crowded legislative agenda, and the distinct possibility that raisingthis issue will raise broader privacy and Fair Credit Reporting Act issues.Specifically, the FCRA provisions on affiliate sharing of information preempt statelaw until January 1, 2004.  Subsection (b)(2) of section 624, 15 U.S.C. § 1681t(b)(2),provides a general exception to the FCRA’s general rule on preemption.  Under that rule,FCRA does not preempt state law, unless  the state law is inconsistent, and then it isCRS-613 15 U.S.C. § 1681t(a).14 15 U.S.C. § 1681t(b)(2).15 15 U.S.C. § 1681t(d)(2).16 15 U.S.C. §§ 6824(b), Pub. L. 106-102, § 524(b), 113 Stat. 1448.preempted only to the extent of the inconsistency.13  An exception to this rule applies tosharing of information among affiliates.14  States may override this exception afterJanuary 1, 2004, by  enacting laws providing greater protection to consumers with respectto information sharing among affiliates.15  Gramm-Leach-Bliley, on the other hand,preempts state laws to the extent that they are inconsistent but provides that “a Statestatute, regulation, order, or interpretation is not inconsistent ... if the protection suchstatute, regulation, order, or interpretation affords any person is greater than the protectionunder this subtitle as determined by the Federal Trade Commission....”16   States mayprovide greater protection to consumers than Gramm-Leach-Bliley at any time.  TheFCRA moratorium ends on January 1, 2004.S. 660 (Sen Johnson) would make the FCRA preemptions permanent, therebypreempting state laws or regulations restricting information sharing among corporateaffiliates. H.R. 1766 (Reps. Tiberi and Lucas), in addition to making the FCRA preemptionspermanent, would give preemptive effect to GLBA’s provisions respecting disclosure ofnonpublic personal information by financial institutions, effectively establishing anational standard for disclosure of customer information by financial institutions.   Itwould prevent states and local governments from imposing additional requirements, suchas an opt-in for information sharing with non-affiliated third parties, more detailed ormore frequent notice requirements, or increased protection for sensitive data.

1 This report addresses financial privacy issues.  For more general information on privacy issuessee:  CRS Report RL30671, Personal Privacy Protection: The Legislative Response.Congressional Research Service ˜ The Library of CongressCRS Report for CongressReceived through the CRS WebOrder Code RS20185Updated June 30, 2003Privacy Protection for Customer Financial InformationM. Maureen MurphyLegislative AttorneyAmerican Law DivisionSummaryTitle V of the Gramm-Leach-Bliley Act of 1999 (GLBA)  (P.L. 106-102, H.Rept.106-434) prohibits financial institutions from sharing nonpublic personally identifiablecustomer information with non-affiliated third parties without giving consumers anopportunity to opt out and requires them to provide customers with notice of theirprivacy policies. It requires financial institutions to safeguard the security andconfidentiality of customer information.  Finally, it delegates rulemaking andenforcement authority to the federal banking and security regulators, the Federal TradeCommission, and state insurance regulators.  In the 108th Congress, H.R. 1766 wouldmake permanent certain Fair Credit Reporting Act (FCRA) preemptions of state lawrelative to information sharing among affiliates; H.R. 1766 would also give preemptiveeffect to the Gramm-Leach-Bliley privacy provisions. H.R. 2622 and S. 660 would makethe FCRA preemptions permanent but would not affect Gramm-Leach-Bliley.  H.R. 781would provide a means to exempt lawyers from GLBA requirements. This report willbe updated to reflect action on major legislation.  For further information see CRSReport RS21427, Financial Privacy Laws Affecting Sharing of Customer InformationAmong Affiliated Institutions, CRS Report RL31758, Financial Privacy: The Economicsof Opt-In vs Opt-Out; and  CRS Report RL31847, The Role of Information in Lending:The Cost of Privacy Restrictions.Background.  With modern technology’s ability to gather and retain data, financialservices businesses have increasingly found ways to take advantage of their largereservoirs of customer information. Not only can they serve their customers better bytailoring services and communications to their  preferences, but they can profit fromsharing that information with others willing to pay for customer lists or targeted marketingcompilations.1  While some consumers are pleased with the wider access to informationabout available services that information sharing among financial services providersCRS-22  Local ordinances in San Mateo County and Daly City, California requiring customeraffirmative permission for a financial institution to share personal data are the subject of a lawsuitbrought by Wells Fargo Co. and Bank of America Corp. in September 2002.3 P.L. 106-102, tit. v, 113 Stat. 1338, 1436. 15 U.S.C. §§ 6801 - 6809.  For general informationon Gramm-Leach-Bliley, see CRS Report RL30375, Major Financial Services Legislation, theGramm-Leach-Bliley Act (P.L. 106-102): an Overview, by F. Jean Wells and William D. Jackson.offers, others have raised privacy concerns.  Individuals are particularly interested incontrols on secondary usage.  The United States has no general law of financial privacy.The Constitution, itself, has been held to provide no protection against governmentalaccess to financial information turned over to third parties.  United States v. Miller, 425U.S. 435 (1976).  This means that although the Fourth Amendment to the United StatesConstitution requires a search warrant for a law enforcement agent to obtain such recordsas a person’s own copies of canceled checks, credit card charges and receipts, loanapplications, and stock transfer records, it does not protect the same records when theyare held by financial institutions. State constitutions and laws  may provide greaterprotection.2Various federal statutes provide a measure of privacy protection for financial records.The Right to Financial Privacy Act, 12 U.S.C. §§ 3401 -3422,  sets procedures for federalgovernment access to customer financial records held by financial institutions.  The FairCredit Reporting Act (FCRA), 15 U.S.C. §§ 1681 to 1681t,  establishes standards forcollection and permissible purposes for dissemination of data by consumer reportingagencies.  It also gives consumers access to their files and the right to correct informationtherein. The Electronic Funds Transfer Act, 15 U.S.C. §§ 1693a to 1693r, describes therights and liabilities of consumers using electronic fund transfer systems.  Among themis the right to have the financial institution provide them with information as to thecircumstances under which information concerning their accounts will be disclosed tothird parties.  With the passage of the Fair Credit Reporting Act Amendments of 1996,P.L. 104-208, Div. A, Tit. II, Subtitle d, Ch. 1, § 2419, 110 Stat. 3009-452, adding 15U.S.C.§ 1681t(b)(2), companies may share with other entities certain customerinformation respecting their transactions and experience with a customer without anynotification requirements.  Other customer information, such as credit report orapplication information, may be shared with other companies in the corporate family ifthe customers are given “clear and conspicuous” notice about the sharing and anopportunity to direct that the information not be shared.Gramm-Leach-Bliley’s Privacy Provisions.  Title V of the Gramm-LeachBliley Act (GLBA)3  contains the privacy provisions enacted in conjunction with financialmodernization legislation.  In addition to strengthening the prohibitions on identity fraudand mandating a federal study on information sharing among financial institutions andtheir affiliates, the legislation requires that federal regulators issue rules that call forfinancial institutions to establish standards to insure the security and confidentiality ofcustomer records.  It prohibits financial institutions from disclosing nonpublic personalinformation to unaffiliated third parties without providing customers the opportunity todecline to have such information disclosed.  Also included are prohibitions on disclosingcustomer account numbers to unaffiliated third parties for use in telemarketing, directmail marketing, or other marketing through electronic mail. Under this legislationfinancial institutions are required to disclose, initially when a customer relationship isCRS-34 Federal Register online at [http://www.gpoaccess.gov/fr/index.html].5  [http://www.naic.org/]6 See CRS Report RS20026, Banking’s Proposed ‘Know Your Customer’ Rules.established and annually, thereafter, their privacy policies, including their policies withrespect to sharing information with affiliates and non-affiliated third parties.Rules implementing these privacy provisions have been promulgated by the federalbanking and securities regulators.  Implementing regulations were published by thebanking regulators in the Federal Register on June 1, 2000, by the Federal TradeCommission on May 24, and by the SEC on June 29.  65 Fed. Reg. 35162, 33646, and40334.4   They became effective on November 13, 2000; and information may be sharedthereafter provided the necessary steps have been taken by the financial institutions.  SeeFTC regulations at [http://www.ftc.gov/privacy/glbact/index.html]. Consumers may optout at any time. Identity theft and pretext calling guidelines  were issued to banks on April6, 2001.  [http://www.federalreserve.gov/boarddocs/SRLetters/2001/sr0111.htm].Insurance industry compliance has been handled on a state-by-state basis by theappropriate state authority.  The National Association of Insurance Commissioners(NAIC) approved a model law respecting disclosure of consumer financial and healthinformation intended to guide state legislative efforts in the area.5   These privacy provisions preempt state law except to the extent that the state lawprovides greater protection to consumers.  The Federal Trade Commission, in conjunctionwith the other federal financial institution regulators, is to make the determination as towhether or not a state law is preempted.  The Conference Committee rejectedamendments that would have required customers to opt in, i.e., consent, before financialinstitutions could share customer financial information with either affiliates or thirdparties.  Privacy issues were discussed at each stage of the legislative process in the Houseconsideration of financial modernization legislation.  The House Banking Committeemarkup of the legislation (H.R. 10, 106th Cong.)  included the rejection of an amendment,offered by Representative Inslee, that would have permitted bank customers to precludesharing their information with third parties.  What was accepted instead and included inthe bill as reported by the House Banking Committee (H.Rept. 106-74)were provisionsthat would:   require institutions to disclose their privacy policies, mandate a federalprivacy study, and prohibit the sharing health information derived from insuranceactivities. As reported by the House Commerce Committee, H.R. 10's prohibition againstsharing individually identified health information derived from insurance activities wouldhave been extended to include genetic information; customers would have been given theopportunity to opt out of  information sharing by their financial institutions; andconsumers would have been able to examine, upon request, nonpublic personalinformation before their financial institution shares or sells such information forconsideration to nonaffiliated  persons or entities.Public and Industry Reaction.  One of the indications of the public’s interestin preserving the confidentiality of personal information conveyed to financial serviceproviders was the negative reaction to what became an aborted attempt by the federalbanking regulators to promulgate “Know Your Customer” rules.6  These rules would haveimposed precisely detailed requirements on banks and other financial institutions toCRS-47 See “Financial Privacy in America: A Review of Consumer Financial Issues,” (June 1998). [http://www.aba.com].8 “Fair Credit Reporting Act,” OCC AL 99-3 (March 29, 1999).9 California enacted legislation that requires credit card issuers to provide consumers anopportunity to opt out of information sharing for marketing purposes, includes informationsharing with affiliates for marketing purposes, and requires provision of a toll-free telephonenumber for exercising this right to opt out.  2000 Cal. Stat., ch. 977; 2000 Cal. Adv.Leg. Serv.977 (Deering).10 “FTC Head Favors Federal Action on Privacy, Says Argument for Preemption Now Stronger,”6 Electronic Commerce & Law Report 7 (January 3, 2001).11 [http://www.nysba.org/Content/ContentGroups/News1/Release_attachments/nysbavftc.pdf]The American Bar Association had also requested an exemption for attorneys on the grounds that(continued...)establish profiles of expected financial activity and monitor their customers transactionsagainst these profiles.  Even before the Know Your Customer Rules and enactment ofGramm-Leach-Bliley, depository institutions and their regulators have increasinglypromoted industry self-regulation as a means of instilling consumer confidence andforestalling comprehensive privacy regulation by state and federal governments.  TheAmerican Bankers Association, for example, promulgates eight privacy principles for thebanking industry,7 and one of the federal banking regulators, the Office of Comptrollerof the Currency, issued an advisory letter regarding information sharing.8   The regulatoryscheme set in place by Gramm-Leach-Bliley became operative on July 1, 2001.  In acertain sense,  the debate as to whether information sharing by financial institutions withthird parties–outside of their corporate families–should require actual consent rather thanan opportunity to opt out continues.  Both the FCRA and Gramm-Leach-Bliley containprovisions permitting limited and particularized state preemption of federal standardswhen state laws provide more protection for consumers. The year 2000 saw  activity insome state legislatures considering ways to enhance the protections of Gramm-Leach-Bliley, including requiring actual consent–or opt in–before information sharing  Only onestate, California, enacted more protective legislation.9   Industry sources view having tocomply with multiple and inconsistent state regimes as posing excessive regulatory costs,litigation prospects, and liability potential.  The validity of their claims may be reflectedin a position taken by Robert Pitofsky, former Chairman of the Federal TradeCommission, in December 2000, when he went on record as potentially favoringlegislation geared towards a nationwide financial privacy standard.  In the same speech,however, he indicated that he would also consider enactment of legislation that theindustry has resisted:  requiring financial services providers to obtain customer consentbefore sharing data, i.e., an opt-in requirement  rather than the current opt-out standard.10A potential issue is the extent of coverage of Gramm-Leach-Bliley.  It covers“financial institutions” within the meaning of the Bank Holding Company Act.  Manycommercial entities that sell or perform services for consumers are not included; somelawyers and accountants may be included because  they perform services designated as“financial in nature” either by the BHCA, itself, or by the regulators under authority ofthat legislation as amended by Gramm-Leach-Bliley. On April 8, 2002, the FTCdetermined that lawyers were covered and that it had no authority to grant them anexemption; subsequently the New York State Bar Association filed suit.11  H.R. 781,CRS-511 (...continued)they are subject to stricter confidential requirements under their Code of ProfessionalResponsibility and because having to send out Gramm-Leach-Bliley privacy notices couldconfuse their clients as to that confidentiality.[http://www.abanet.org/poladv/letters/exec/privacy071001.html]. 12 For information on the other aspects of the Fair Credit Reporting Act covered by thepreemptions provision set to expire on January 1, 2004, see CRS Report RS21449, Fair CreditReporting Act: Preemption of State Law.introduced by Rep. Biggert in the 108th Congress, would exempt attorneys subject toprofessional rules of conduct requiring confidentiality from having to comply with theGLBA provisions.The European Union Data Directive.  Another incentive for a nationwidestandard has been the requirements imposed upon companies doing business in Europeunder the European Commission on Data Protection (EU Data Directive), an official actof the European Parliament and Council, dated October 24, 1995 (95/46/EC). Thisimposes strict privacy guidelines respecting the sharing of customer information andbarring transfers, even within the same corporate family, outside of Europe, unless thetransfer is to a country having privacy laws affording similar protection as does Europe.Legislation.  In the 107th Congress, Title III of P.L. 107-56, the USA PATRIOTAct, includes various amendments to the anti-money laundering laws and requires closerscrutiny of accounts held in the name of foreign banks and stricter procedures foridentifying new customers.  Various proposals to amend Gramm-Leach-Bliley wereconsidered, some of which would broaden protection for consumer financial informationby requiring an affirmative opt-in for disclosures of specified sensitive information.There were also measures to preempt state law and, thereby, prevent states fromestablishing more protections than are offered under federal law.The108th Congress may have an early opportunity to consider the issue of federalpreemption. The Fair Credit Reporting Act provisions on affiliate sharing preempt statelaw until January 1, 2004.12  After that date, any state may enact a law that providesconsumers more protection with respect to information sharing among affiliates, providedthe law explicitly states that it is intended to supplement the Fair Credit Reporting Actprovision.  15 U.S.C. § 1681t(d)(2). The financial services industry favors an extensionof federal preemption as a means of continuing the efficiencies in operations and servicesthat come with broader access to consumer information and avoiding the difficulties ofcomplying with inconsistent state laws.  On the other hand, consumer advocates generallyfavor broader protections than offered under federal law, e.g., requiring affirmativecustomer consent for sharing information with affiliates.  Complicating the matter is theshort time frame, the crowded legislative agenda, and the distinct possibility that raisingthis issue will raise broader privacy and Fair Credit Reporting Act issues.Specifically, the FCRA provisions on affiliate sharing of information preempt statelaw until January 1, 2004.  Subsection (b)(2) of section 624, 15 U.S.C. § 1681t(b)(2),provides a general exception to the FCRA’s general rule on preemption.  Under that rule,FCRA does not preempt state law, unless  the state law is inconsistent, and then it isCRS-613 15 U.S.C. § 1681t(a).14 15 U.S.C. § 1681t(b)(2).15 15 U.S.C. § 1681t(d)(2).16 15 U.S.C. §§ 6824(b), Pub. L. 106-102, § 524(b), 113 Stat. 1448.17  Available at http://financialservices.house.gov/hearings.asp?formmode=All.preempted only to the extent of the inconsistency.13  An exception to this rule applies tosharing of information among affiliates.14  States may override this exception afterJanuary 1, 2004, by  enacting laws providing greater protection to consumers with respectto information sharing among affiliates.15  Gramm-Leach-Bliley, on the other hand,preempts state laws to the extent that they are inconsistent but provides that “a Statestatute, regulation, order, or interpretation is not inconsistent ... if the protection suchstatute, regulation, order, or interpretation affords any person is greater than the protectionunder this subtitle as determined by the Federal Trade Commission....”16   States mayprovide greater protection to consumers than Gramm-Leach-Bliley at any time.  TheFCRA moratorium ends on January 1, 2004.S. 660 (Sen Johnson) would make the FCRA preemptions permanent, therebypreempting state laws or regulations restricting information sharing among corporateaffiliates. H.R. 1766 (Reps. Tiberi and Lucas), in addition to making the FCRA preemptionspermanent, would give preemptive effect to GLBA’s provisions respecting disclosure ofnonpublic personal information by financial institutions, effectively establishing anational standard for disclosure of customer information by financial institutions.   Itwould prevent states and local governments from imposing additional requirements, suchas an opt-in for information sharing with non-affiliated third parties, more detailed ormore frequent notice requirements, or increased protection for sensitive data.H.R. 2622 (Rep. Bachus), in addition to making the FCRA preemptions permanent,would enhance consumer rights under the FCRA by authorizing one free credit reportannually and an annual analysis of a consumer’s credit score.Hearings on various issues relating to the Fair Credit Reporting Act were held by theHouse Committee on Financial Services on May 28, June 4, and June 12, 2003.17

1 This report addresses financial privacy issues.  For more general information on privacy issuessee:  CRS Report RL30671, Personal Privacy Protection: The Legislative Response, by HaroldC. Relyea.  Also see CRS Issue Brief IB98002, Medical Records Confidentiality.Congressional Research Service ˜ The Library of CongressCRS Report for CongressReceived through the CRS WebOrder Code RS20185Updated February 28, 2003Privacy Protection for Customer Financial InformationM. Maureen MurphyLegislative AttorneyAmerican Law DivisionSummaryTitle V of the Gramm-Leach-Bliley Act of 1999 (P.L. 106-102, H.Rept. 106-434)requires financial institutions to provide their customers with notice of their privacypolicies. It prohibits financial institutions from sharing nonpublic personally identifiablecustomer information with non-affiliated third parties without giving consumers anopportunity to opt out and prohibits financial institutions from providing accountnumbers to non-affiliated third parties for marketing purposes.  It requires financialinstitutions to safeguard the security and confidentiality of customer information.Finally, it delegates rulemaking and enforcement authority to the federal banking andsecurity regulators, the Federal Trade Commission, and state insurance regulators.  Thelegislation includes prohibitions on “pretext calling,” obtaining financial institutioncustomer information by false pretenses.  Legislation is expected to be offered in the108th Congress, as was the case in the 107th Congress, to amend these provisions.  Thisreport will be updated on the basis of floor action involving  privacy protection forfinancial institution customer information.  For further information see CRS ReportsRS21427, Financial Privacy Laws Affecting Sharing of Customer Information AmongAffiliated Institutions, and RL31758, Financial Privacy: An Economic Perspective.Background.  With modern technology’s ability to gather and retain data, financialservices businesses have increasingly found ways to take advantage of their largereservoirs of customer information. Not only can they serve their customers better bytailoring services and communications to their  preferences, but they can profit fromsharing that information with others willing to pay for customer lists or targeted marketingcompilations.1  While some consumers are pleased with the wider access to informationabout available services that information sharing among financial services providersoffers, others have raised privacy concerns.  Individuals are particularly interested inCRS-22  Local ordinances in San Mateo County and Daly City, California requiring customeraffirmative permission for a financial institution to share personal data are the subject of a lawsuitbrought by Wells Fargo Co. and Bank of America Corp. in September 2002.3 P.L. 106-102, tit. v, 113 Stat. 1338, 1436. 15 U.S.C. §§ 6801 - 6809.  For general informationon Gramm-Leach-Bliley, see CRS Report RL30375, Major Financial Services Legislation, theGramm-Leach-Bliley Act (P.L. 106-102): an Overview, by F. Jean Wells and William D. Jackson.controls on secondary usage.  The United States has no general law of financial privacy.The Constitution, itself, has been held to provide no protection against governmentalaccess to financial information turned over to third parties.  United States v. Miller, 425U.S. 435 (1976).  This means that although the Fourth Amendment to the United StatesConstitution requires a search warrant for a law enforcement agent to obtain such recordsas a person’s own copies of canceled checks, credit card charges and receipts, loanapplications, and stock transfer records, it does not protect the same records when theyare held by financial institutions. State constitutions and laws  may provide greaterprotection.2Various federal statutes provide a measure of privacy protection for financial records.The Right to Financial Privacy Act, 12 U.S.C. §§ 3401 -3422,  sets procedures for federalgovernment access to customer financial records held by financial institutions.  The FairCredit Reporting Act (FCRA), 15 U.S.C. §§ 1681 to 1681t,  establishes standards forcollection and permissible purposes for dissemination of data by consumer reportingagencies.  It also gives consumers access to their files and the right to correct informationtherein. The Electronic Funds Transfer Act, 15 U.S.C. §§ 1693a to 1693r, describes therights and liabilities of consumers using electronic fund transfer systems.  Among themis the right to have the financial institution provide them with information as to thecircumstances under which information concerning their accounts will be disclosed tothird parties.  With the passage of the Fair Credit Reporting Act Amendments of 1996,P.L. 104-208, Div. A, Tit. II, Subtitle d, Ch. 1, § 2419, 110 Stat. 3009-452, adding 15U.S.C.§ 1681t(b)(2), companies may share with other entities certain customerinformation respecting their transactions and experience with a customer without anynotification requirements.  Other customer information, such as credit report orapplication information, may be shared with other companies in the corporate family ifthe customers are given “clear and conspicuous” notice about the sharing and anopportunity to direct that the information not be shared.Gramm-Leach-Bliley’s Privacy Provisions.  Title V of the Gramm-LeachBliley Act (GLBA)3  contains the privacy provisions enacted in conjunction with financialmodernization legislation.  In addition to strengthening the prohibitions on identity fraudand mandating a federal study on information sharing among financial institutions andtheir affiliates, the legislation requires that federal regulators issue rules that call forfinancial institutions to establish standards to insure the security and confidentiality ofcustomer records.  It prohibits financial institutions from disclosing nonpublic personalinformation to unaffiliated third parties without providing customers the opportunity todecline to have such information disclosed.  Also included are prohibitions on disclosingcustomer account numbers to unaffiliated third parties for use in telemarketing, directmail marketing, or other marketing through electronic mail. Under this legislationfinancial institutions are required to disclose, initially when a customer relationship isCRS-34 Federal Register online at [http://www.access.gpo.gov/su_docs/aces/aces140.html].5  [http://www.naic.org/1news/releases]established and annually, thereafter, their privacy policies, including their policies withrespect to sharing information with affiliates and non-affiliated third parties.Rules implementing these privacy provisions have been promulgated by the federalbanking and securities regulators.  Implementing regulations were published by thebanking regulators in the Federal Register on June 1, 2000, by the Federal TradeCommission on May 24, and by the SEC on June 29.  65 Fed. Reg. 35162, 33646, and40334.4   They became effective on November 13, 2000; and information may be sharedthereafter provided the necessary steps have been taken by the financial institutions.  SeeFTC regulations at [http://www.ftc.gov/privacy/glbact/index.html]. Consumers may optout at any time. Identity theft and pretext calling guidelines  were issued to banks on April6, 2001.[http://www.federalreserve.gov/boarddocs/SRLetters/2001/sr0111.htm].Insurance industry compliance has been handled on a state-by-state basis by theappropriate state authority.  The National Association of Insurance Commissioners(NAIC) approved a model law respecting disclosure of consumer financial and healthinformation intended to guide state legislative efforts in the area.5   These privacy provisions preempt state law except to the extent that the state lawprovides greater protection to consumers.  The Federal Trade Commission, in conjunctionwith the other federal financial institution regulators, is to make the determination as towhether or not a state law is preempted.  The Conference Committee rejectedamendments that would have required customers to opt in, i.e., consent, before financialinstitutions could share customer financial information with either affiliates or thirdparties.  Privacy issues were discussed at each stage of the legislative process in the Houseconsideration of financial modernization legislation.  The House Banking Committeemarkup of the legislation (H.R. 10, 106th Cong.)  included the rejection of an amendment,offered by Representative Inslee, that would have permitted bank customers to precludesharing their information with third parties.  What was accepted instead and included inthe bill as reported by the House Banking Committee (H.Rept. 106-74)were provisionsthat would:   require institutions to disclose their privacy policies, mandate a federalprivacy study, and prohibit the sharing health information derived from insuranceactivities. As reported by the House Commerce Committee, H.R. 10's prohibition againstsharing individually identified health information derived from insurance activities wouldhave been extended to include genetic information; customers would have been given theopportunity to opt out of  information sharing by their financial institutions; andconsumers would have been able to examine, upon request, nonpublic personalinformation before their financial institution shares or sells such information forconsideration to nonaffiliated  persons or entities.Public and Industry Reaction.  One of the indications of the public’s interestin preserving the confidentiality of personal information conveyed to financial serviceproviders was the negative reaction to what became an aborted attempt by the federalCRS-46 See CRS Report RS20026, Banking’s Proposed ‘Know Your Customer’ Rules.7 See “Financial Privacy in America: A Review of Consumer Financial Issues,” (June 1998). [http://www.aba.com].8 “Fair Credit Reporting Act,” OCC AL 99-3 (March 29, 1999).9 California enacted legislation that requires credit card issuers to provide consumers anopportunity to opt out of information sharing for marketing purposes, includes informationsharing with affiliates for marketing purposes, and requires provision of a toll-free telephonenumber for exercising this right to opt out.  2000 Cal. Stat., ch. 977; 2000 Cal. Adv.Leg. Serv.977 (Deering).10 “FTC Head Favors Federal Action on Privacy, Says Argument for Preemption Now Stronger,”6 Electronic Commerce & Law Report 7 (January 3, 2001).banking regulators to promulgate “Know Your Customer” rules.6  These rules would haveimposed precisely detailed requirements on banks and other financial institutions toestablish profiles of expected financial activity and monitor their customers transactionsagainst these profiles.  Even before the Know Your Customer Rules and enactment ofGramm-Leach-Bliley, depository institutions and their regulators have increasinglypromoted industry self-regulation as a means of instilling consumer confidence andforestalling comprehensive privacy regulation by state and federal governments.  TheAmerican Bankers Association, for example, promulgates eight privacy principles for thebanking industry,7 and one of the federal banking regulators, the Office of Comptrollerof the Currency, issued an advisory letter regarding information sharing.8   The regulatoryscheme set in place by Gramm-Leach-Bliley became operative on July 1, 2001.  In acertain sense,  the debate as to whether information sharing by financial institutions withthird parties–outside of their corporate families–should require actual consent rather thanan opportunity to opt out continues.  Both the FCRA and Gramm-Leach-Bliley containprovisions permitting limited and particularized state preemption of federal standardswhen state laws provide more protection for consumers. The year 2000 saw  activity insome state legislatures considering ways to enhance the protections of Gramm-Leach-Bliley, including requiring actual consent–or opt in–before information sharing  Only onestate, California, enacted more protective legislation.9   Industry sources view having tocomply with multiple and inconsistent state regimes as posing excessive regulatory costs,litigation prospects, and liability potential.  The validity of their claims may be reflectedin a position taken by Robert Pitofsky, former Chairman of the Federal TradeCommission, in December 2000, when he went on record as potentially favoringlegislation geared towards a nationwide financial privacy standard.  In the same speech,however, he indicated that he would also consider enactment of legislation that theindustry has resisted:  requiring financial services providers to obtain customer consentbefore sharing data, i.e., an opt-in requirement  rather than the current opt-out standard.10A potential issue is the extent of coverage of Gramm-Leach-Bliley.  It covers“financial institutions” within the meaning of the Bank Holding Company Act.  Manycommercial entities that sell or perform services for consumers are not included; somelawyers and accountants may be included because  they perform services designated as“financial in nature” either by the BHCA, itself, or by the regulators under authority ofthat legislation as amended by Gramm-Leach-Bliley. On April 8, 2002, the FTCdetermined that lawyers were covered and that it had no authority to grant them anCRS-511 [http://www.nysba.org/Content/ContentGroups/News1/Release_attachments/nysbavftc.pdf]The American Bar Association had also requested an exemption for attorneys on the grounds thatthey are subject to stricter confidential requirements under their Code of ProfessionalResponsibility and because having to send out Gramm-Leach-Bliley privacy notices couldconfuse their clients as to that confidentiality.[http://www.abanet.org/poladv/letters/exec/privacy071001.html]. 12 See Department of Commerce website:  [http://www.ita.doc.gov/].exemption; subsequently the New York State Bar Association filed suit.11  H.R. 781,introduced by Rep. Biggert in the 108th Congress, would exempt attorneys subject toprofessional rules of conduct requiring confidentiality from having to comply with theGLBA provisions.The European Union Data Directive.  Another incentive for a nationwidestandard has been the requirements imposed upon companies doing business in Europeunder the European Commission on Data Protection (EU Data Directive), an official actof the European Parliament and Council, dated October 24, 1995 (95/46/EC). Thisimposes strict privacy guidelines respecting the sharing of customer information andbarring transfers, even within the same corporate family, outside of Europe, unless thetransfer is to a country having privacy laws affording similar protection as does Europe.The Department of Commerce has negotiated an agreement with the European Union thatoffers a framework under which US companies may be certified by the Department ofCommerce and obtain a safe harbor, thereby continuing data transfers.12  To date, thebanking industry has not availed itself of this safe harbor, nor has the EU acceptedGramm-Leach-Bliley as one of the safe harbors meeting the Data Directive’srequirements.  U.S. entities with a presence in Europe, including some of the large bankholding companies, have chosen to draft guidelines and codes of conduct to meet theEuropean standard and to satisfy that standard through separate negotiations. U.S.companies also have the option of adopting a standard contract approved in June 2001 bythe European Commission, despite U.S. objections, for foreign companies to use tocomply with the EU Data Directive.Legislation.  In the 107th Congress, Title III of P.L. 107-56, the USA PATRIOTAct, includes various amendments to the anti-money laundering laws and requires closerscrutiny of accounts held in the name of foreign banks and stricter procedures foridentifying new customers.  Various proposals to amend Gramm-Leach-Bliley wereconsidered, some of which would broaden protection for consumer financial informationby requiring an affirmative opt-in for disclosures of specified sensitive information.There were also measures to preempt state law and, thereby, prevent states fromestablishing more protections than are offered under federal law.The108th Congress may have an early opportunity to consider the issue of federalpreemption.  Gramm-Leach-Bliley’s privacy title preempts inconsistent state law exceptto the extent that state law provides greater privacy protection to consumers.  The FairCredit Reporting Act provisions on affiliate sharing have a similar preemption provision,which is, however, not open-ended but which expires on January 1, 2004.  After that date,states may enact laws that provide  consumers more protection with respect to informationsharing among affiliates.  15 U.S.C. § 1681t(d)(2). The financial services industry favorsan extension of federal preemption as a means of continuing the efficiencies in operationsand services that come with broader access to consumer information and avoiding theCRS-613 15 U.S.C. § 1681t(a).14 15 U.S.C. § 1681t(b)(2).15 15 U.S.C. § 1681t(d)(2).16 15 U.S.C. §§ 6824(b), Pub. L. 106-102, § 524(b), 113 Stat. 1448.difficulties of complying with inconsistent state laws.  On the other hand, consumeradvocates generally favor broader protections than offered under federal law, e.g.,requiring affirmative customer consent for sharing information with affiliates.Complicating the matter is the short time frame, the crowded legislative agenda, and thedistinct possibility that raising this issue will raise broader privacy and Fair CreditReporting Act issues.Specifically, the FCRA provisions on affiliate sharing of information preempt statelaw until January 1, 2004.  Subsection (b)(2) of section 624, 15 U.S.C. § 1681t(b)(2),provides a general exception to the FCRA’s general rule on preemption.  Under that rule,FCRA does not preempt state law, unless  the state law is inconsistent, and then it ispreempted only to the extent of the inconsistency.13  An exception to this rule applies tosharing of information among affiliates.14  States may override this exception afterJanuary 1, 2004, by  enacting laws providing greater protection to consumers with respectto information sharing among affiliates.15  Gramm-Leach-Bliley, on the other hand,preempts state laws to the extent that they are inconsistent but provides that “a Statestatute, regulation, order, or interpretation is not inconsistent ... if the protection suchstatute, regulation, order, or interpretation affords any person is greater than the protectionunder this subtitle as determined by the Federal Trade Commission....”16   States mayprovide greater protection to consumers than Gramm-Leach-Bliley at any time.  TheFCRA moratorium ends on January 1, 2004.

https://digital.library.unt.edu/ark:/67531/metacrs3925/m1/1/high_res_d/RS20185_2003Jun13.pdf

Privacy Protection for Customer Financial Information

Abstract

Similar works

Full text

Available Versions

UNT Digital Library

UNT Digital Library

UNT Digital Library

UNT Digital Library

UNT Digital Library

UNT Digital Library

UNT Digital Library

UNT Digital Library

UNT Digital Library

UNT Digital Library