WELLS FARGO VIA www.regulations.gov Office of the Comptroller of the Currency
Docket No. 04-13 Board of the Governors of the Federal Reserve System
Docket No. R-1199 Federal Deposit Insurance Corporation
RIN 3064-AC77 Office of Thrift Supervision
No. 2004-26; RIN 1550-AB87 July 23, 2004 Subject: Proper Disposal of Consumer Report Information under FACTA Ladies and Gentlemen: Wells Fargo & Company ("Well Fargo") appreciates the opportunity to comment on the notice of proposed rulemaking (the "Proposal") issued by the above-named agencies (the "Agencies") with respect to the proper disposal of consumer information under the Fair and Accurate Credit Transactions Act of 2003. Wells Fargo is one of the country's leading integrated financial services organizations. Wells Fargo includes a national bank with branches in 23 states, a consumer finance company, insurance agencies and brokerages, and securities broker-dealers and investment advisors. Wells Fargo generally supports the approach taken by the Agencies in the Proposal. These comments will focus on areas where we believe clarification or modification would be appropriate. First and foremost, we strongly support the approach of incorporating the requirement for proper disposal of "consumer information" (as defined in the Proposal) into the Interagency Guidelines Establishing Standards for Safeguarding Customer Information (the "Guidelines"). This will preserve the ability of different financial institutions to take different measures to achieve the basic goals of the Guidelines, including proper disposal of consumer information, depending on the structure and circumstances of the particular institution, and to integrate proper disposal into their overall information security programs. Because proper disposal of consumer information is an integral part of information security, we believe that many institutions already include records disposal procedures in their information security programs. Thus we believe the Agencies should make it clear that, if the scope of the institution's information security program already includes proper disposal of consumer information (even if it does not use the same terms found in the Proposal, such as "consumer information"), the institution is not required to make changes to its information security policy or program specifically in response to the Proposal. Likewise, we believe that the confidentiality and/or information security provisions in many existing contracts between financial institutions and their service providers are broad enough to cover proper disposal of consumer information by the service provider. The Agencies should make it clear that such contracts do not need to be amended specifically in response to the Proposal, even if they do not contain the same terminology. There are also instances where there is no expectation that the service provider will dispose of consumer information relating to an institution, for example, where the service provider does not make copies or extracts of the information and is expected to return all such information to the institution which provided it. The Agencies should make it clear that contracts with service providers in such cases are not required to contain "proper disposal" provisions. Finally, to the extent that institutions are required to modify existing contracts with service providers to include "proper disposal" provisions, we believe that one year is too short a time to complete such modifications. Large institutions may have hundreds of such contracts, and may maintain and administer those contracts in a decentralized structure. Accordingly, it may take significant time to identify, locate and review such contracts, and then to negotiate and execute modifications with the service provider. In addition, in many instances it will be more efficient for the institution to deal with "proper disposal" modifications in connection with other contract changes or renewals rather than as a stand-alone amendment. Thus, we believe that a two-year period for amending existing contracts (as was the case with modifications to existing contracts under the original Guidelines) would be appropriate. Wells Fargo is grateful for the opportunity to comment on the Proposal. If you have any questions regarding our comments, please contact the undersigned at (415) 396-0940 or mccorkpl@wellsfargo.com. Sincerely yours,
Peter L. McCorkell
633 Folsom Street, Seventh Floor
San Francisco, CA 94107
| 
