WELLS FARGO
VIA www.regulations.gov
Office of the Comptroller of the Currency
Docket No. 04-13
Board of the Governors of the Federal Reserve System
Docket No. R-1199
Federal Deposit Insurance Corporation
RIN 3064-AC77
Office of Thrift Supervision
No. 2004-26; RIN 1550-AB87
July 23, 2004
Subject: Proper Disposal of Consumer Report Information under FACTA
Ladies and Gentlemen:
Wells Fargo & Company ("Well Fargo") appreciates the opportunity to
comment on the notice of proposed rulemaking (the "Proposal") issued
by the above-named agencies (the "Agencies") with respect to the
proper disposal of consumer information under the Fair and Accurate
Credit Transactions Act of 2003. Wells Fargo is one of the country's
leading integrated financial services organizations. Wells Fargo
includes a national bank with branches in 23 states, a consumer
finance company, insurance agencies and brokerages, and securities
broker-dealers and investment advisors. Wells Fargo generally supports
the approach taken by the Agencies in the Proposal. These comments
will focus on areas where we believe clarification or modification
would be appropriate.
First and foremost, we strongly support the approach of
incorporating the requirement for proper disposal of "consumer
information" (as defined in the Proposal) into the Interagency
Guidelines Establishing Standards for Safeguarding Customer
Information (the "Guidelines"). This will preserve the ability of
different financial institutions to take different measures to achieve
the basic goals of the Guidelines, including proper disposal of
consumer information, depending on the structure and circumstances of
the particular institution, and to integrate proper disposal into
their overall information security programs.
Because proper disposal of consumer information is an integral part
of information security, we believe that many institutions already
include records disposal procedures in their information security
programs. Thus we believe the Agencies should make it clear that, if
the scope of the institution's information security program already
includes proper disposal of consumer information (even if it does not
use the same terms found in the Proposal, such as "consumer
information"), the institution is not required to make changes to its
information security policy or program specifically in response to the
Proposal.
Likewise, we believe that the confidentiality and/or information
security provisions in many existing contracts between financial
institutions and their service providers are broad enough to cover
proper disposal of consumer information by the service provider. The
Agencies should make it clear that such contracts do not need to be
amended specifically in response to the Proposal, even if they do not
contain the same terminology. There are also instances where there is
no expectation that the service provider will dispose of consumer
information relating to an institution, for example, where the service
provider does not make copies or extracts of the information and is
expected to return all such information to the institution which
provided it. The Agencies should make it clear that contracts with
service providers in such cases are not required to contain "proper
disposal" provisions.
Finally, to the extent that institutions are required to modify
existing contracts with service providers to include "proper disposal"
provisions, we believe that one year is too short a time to complete
such modifications. Large institutions may have hundreds of such
contracts, and may maintain and administer those contracts in a
decentralized structure. Accordingly, it may take significant time to
identify, locate and review such contracts, and then to negotiate and
execute modifications with the service provider. In addition, in many
instances it will be more efficient for the institution to deal with
"proper disposal" modifications in connection with other contract
changes or renewals rather than as a stand-alone amendment. Thus, we
believe that a two-year period for amending existing contracts (as was
the case with modifications to existing contracts under the original
Guidelines) would be appropriate.
Wells Fargo is grateful for the opportunity to comment on the
Proposal. If you have any questions regarding our comments, please
contact the undersigned at (415) 396-0940 or mccorkpl@wellsfargo.com.
Sincerely yours,
Peter L. McCorkell
633 Folsom Street, Seventh Floor
San Francisco, CA 94107
