Citigroup June l, 2004
Robert E. Feldman
Executive Secretary
Federal Deposit Insurance Corporation
550 17th Street, NW
Washington, DC 20429 Public Information Room
Office of the Comptroller of the Currency
250E Street, SW
Mail Stop 1-5
Washington, DC 20219
Attention: Docket No. 04-09 Becky Baker
Secretary of the Board
National Credit Union Administration
1775 Duke Street
Alexandria, VA 22314
Jennifer J. Johnson Secretary
Board of Governors of the Federal Reserve System
20th Street and Constitution Avenue, NW
Washington, DC 20551
Attention: Docket No, R.-1188 Regulation Comments
Chief Counsel's Office
Office of Thrift Supervision
1700 G Street, NW
Washington, DC 20552
Attention: Docket No. 2004-16 RE: FACT Act, Section 411: Medical Information
Dear Banking Agencies: Citigroup appreciates the opportunity to comment on the proposed rule implementing Section 411 of the Fair and Accurate Credit Transactions Act of 2003 ("FACT Act"). The proposed rule provides for certain exceptions to the provisions of Section 411 that restrict the inappropriate use of medical information in the credit process. Section 411(a) of the FACT Act adds a new Section 604(g)(2) to the Fair Credit Reporting Act ("FCRA") to prohibit creditors from obtaining or using medical information in connection with any determination of a consumer's eligibility, or continued eligibility, for credit. Section 411(b) adds a new Section 603(d)(3) to FCRA to restrict the sharing of information with affiliates. Both of these provisions have the potential to have a significant adverse impact on various Citigroup businesses, and Citigroup commends the Banking Agencies ("Agencies") for ably balancing the protections these sections provide to consumers with the needs of creditors to obtain, use and share certain types of medical information in a manner consistent with such consumer protections. Timing of the Rule The Agencies have requested comment on the possible effective date of the proposed rule, suggesting 90 days after the proposed rule is adopted as final. The most important principle with respect to timing is the linkage of the statutory prohibition and the regulation's exceptions. If the statute, Section 411 of the FACT Act, is effective June 4, 2004, the proposed rule granting exceptions to the statutory prohibition should become effective on that date, as well. While ordinarily it is preferable to have a delayed effective date for a new regulation to permit the regulated entities time to establish the internal policies and procedures necessary to comply, in this case it is important to link the effective dates of the prohibition and the exceptions. To allow the time necessary to understand final rule, to adjust practices in multiple businesses, and to write policies and procedures, Citigroup believes both Section 411 both the statutory provision and the proposed rule should become effective a minimum of 90 days after the proposed rule becomes final. Citigroup must apply this new analysis of what constitutes medical information and how it is used across multiple business lines and scores of legal entities. It must apply the new regulation to a credit card business with in excess of 80,000,000 US accounts, to the nation's fifth largest prime mortgage originator and fifth largest servicer, to a significant auto finance business, a non-bank finance company, and 10 depository institutions, as well as a debt cancellation business. To locate all possible entry points for medical information and provide appropriate safeguards at each point is a task requiring weeks and months of preparation. Nevertheless, enforcement of the Agencies of the statutory prohibition without the exceptions would be more damaging for such businesses and burdensome for Citigroup to administer. Scope of the Proposed Rule Since the proposed rule is designed to provide reasonable exceptions to the general prohibitions on obtaining, using or sharing medical information with affiliates, it should be applicable to all kinds of creditors so as to preserve a level playing field for all competitors. As a general matter, the provisions of FCRA and the FACT Act, and, in particular, Section 411 of the FACT Act, apply to a range of creditors that is greater than those benefiting from the proposed regulation. There is a wide range of "creditors" that make use of consumer credit reports that are not regulated by the Banking Agencies. Although Citigroup believes that all of its subsidiaries would be "institutions covered" as defined in the proposed regulation, it is not good public policy to treat similar companies differently under the FACT Act prohibition and the proposed regulation simply on the basis of their status as subsidiaries of a bank holding company. Moreover, Citigroup purchases loans from mortgage companies, auto dealers, brokers and other lenders that would not be able to use financial information that is also medical information that Citigroup and other banking organizations consider to be critical to the credit process. To the extent that the quality of the loans of these sellers of loans is impaired by incomplete information, it can prove damaging to banking organizations purchasing these loans. There are a number of actions the Agencies should take to clarify the scope of the regulation. First, at a minimum, the Agencies should expand the coverage of the proposed rule to any creditor that sells its loans to a federally regulated depository institution. This will help to preserve the credit standards of the depository institutions. Second, Citigroup believes that the Federal Reserve should explicitly state that all bank holding company non-depository subsidiaries are "institutions covered" by the regulation, even functionally regulated subsidiaries of a bank holding company. Thus, a state licensed and regulated finance company, an insurance company or a broker/dealer are within the scope of this rule, to the extent that they engage in credit activities that come within the scope of those activities addressed by FCRA and the FACT Act. Third, the Agencies should recognize that a particular "creditor" may be subject to the provisions of this proposed regulation with respect to a portion of its activities. For example, a broker/dealer may well have medical information that it obtained pursuant to a legal obligation of suitability in recommending investments and a requirement to know the customer's risk profile. The use of medical information as part of a suitability due diligence is beyond the scope of this proposed rule and Section 411 of the FACT Act, which focuses on the credit granting process. Fourth, this regulation applies to eligibility for credit "offered, primarily for personal, family or household purposes." It does not appear that this regulation would apply to a loan granted to the sole proprietor of a business solely for the purpose of expanding the inventory of a business. It is reasonable to ask, therefore, whether a personal loan could at any point be so significant to a particular lender that the lender should be permitted to inquire about the health of the borrower. Is the $10 million loan to purchase a yacht or a private plane within the scope of the protections intended to be provided by Section 411. Is there not some concept that at some level the purpose of the credit changes or the level of risk is so significant that it shifts the balance of the need to protect the individual consumer attempting to obtain credit? Additional Definitions Information regarding death is not "medical information." The definition of "medical information" in the proposed regulation should be modified to exclude two additional types of information. First, any information with respect to the death of a borrower or co-borrower or guarantor should be excluded explicitly. Coded information is not "medical information." In addition, coded credit report information, which would otherwise meet the definition of medical information, should be explicitly excluded from the definition. With all identifying information concerning the provider eliminated, the remaining information is merely evidence of a debt like any other information. Nevertheless, the very existence of the code indicates a debt owed to a medical provider of some sort. Without an explicit exclusion and a clear statement that for all purposes of the FACT Act, i.e., obtaining, using and sharing with affiliates, the encoded information is not medical, there could be circumstances in which some would argue that the residual information could be medical for some purposes. For example, a very large balance due on an encoded entry could suggest a significant medical issue of some sort. It could call into question whether the amount of the balance alone was the basis for a denial or whether the fact that it was to an encoded provider played a role. Debt cancellation should be an exception, not part of the definition of "eligibility ... for credit." The treatment of debt cancellation and debt suspension contracts (DCC/DSA) in the proposal, although appropriately outside of the scope of the prohibition on obtaining, using or transferring medical information, suffers from two shortcomings. First, it permits medical information to be used only when determining whether the contracts are "triggered." It is implied that such information can be used in determining eligibility, as well, because the provision is excluded from the definition of "eligibility, or continued eligibility, for credit." Nevertheless, use of medical information to determine eligibility for DCC/DSA is not explicit. DCC/DSA is a product in which some of the critical protections provided relate to medical condition. Every phase of the product -- structuring, contract terms, triggering events and often eligibility — can involve medical conditions that presume customer disclosure of medical information. The entire process should be exempt from the medical information restrictions. Citigroup supports the proposal of the Financial Services Roundtable and the informal coalition of depository institutions offering DCC/DSA products that the Agencies create a specific exception to permit the use of medical information "to determine the eligibility for, the triggering of, and the reactivation of a debt cancellation contract or a debt suspension agreement." Indeed, the placement of DCC/DSA as an exception to eligibility for credit is confusing and the second shortcoming of its treatment in the proposed regulation. The placement suggests DCC/DSA products are not included in the process of determining credit eligibility. This has unfortunate overtones for the classification of these products as credit products by federal banking regulators. See the regulations of the Comptroller of the Currency, 12 C.F.R. Part 37. Indeed, there is an argument to be made that credit insurance should be listed in paragraph (A) of the exception to the credit eligibility process along with offers to the consumer of "employment, insurance products, or other non-credit products or services" rather than with DCCIDSA products and other forbearance products. Certainly, in terms of the regulatory structure of the products that would be appropriate. Financial Exception for the Use of Medical Information Citigroup supports the approach of the Agencies in providing for a general exception for financial information, that is, information relating to "debts, expenses, income, benefits, collateral or the purpose of the loan, including the use of proceeds." Such information, although it may involve a medical provider or contain ancillary medical information, is primarily financial in nature and creditors should be free to use it as they would any similar financial information. Citigroup presumes that this list is meant to be illustrative rather than exclusive. Financial information could include information on liens filed, for example. Citigroup believes that the third of the three requirements of this financial information exception should be modified to allow more flexibility. The basis of the exception is to require the creditor use the financial information, which is also medical information, no less favorably than "comparable" financial information that is not medical information. The proposal then departs from this principle in the final requirement and bans any reliance on the medial information component of this information. Citigroup suggests that the restriction be on the use for the disadvantage of the consumer. If a creditor discovers disability income as a source of repayment for a proposed loan, why should it be precluded from granting that loan in part because the loan can be sold easily in the secondary market because the borrower qualifies for a special program of a secondary market provider to assist disabled persons? Citigroup proposes that the Agencies amend the third criteria, which now requires the creditor to take no account of a consumer's medical condition, to permit an exception for positive treatment or to assist the customer. The exception as written would impede a creditor from taking advantage of current and future programs that provide subsidies or credits or other favorable treatment designed to assist qualifying borrowers. Unsolicited Information. In the same vein, the proposal applies a rule of construction for receipt of unsolicited information that allows a creditor to "obtain" unsolicited information if it does not use the information. Such a regulation would protect the consumer from the misuse of medical information but would impede the ability of the creditor to use the information for the benefit of the consumer. It would be better to prohibit the use of the information to deny, condition or negatively impact the decision to grant credit or the terms on which the credit is offered. In some cases, consideration of the medical information allows the creditor to treat the customer differently by providing access to the credit or favorable terms. Where receipt of the information is inadvertent on the part of the creditor and is not the focus of the transaction, there is no reason to remove that information from the credit process in those cases where it assists the consumer. Specific Additional Exceptions Citigroup supports the additional exceptions contained in subsection (d) of Section .30. The Agencies have identified certain circumstances in which the prohibition on the use of medical information conflicts with other public policy objectives. Citigroup also commends the Agencies for providing consumers with the ability to authorize the receipt, use and sharing with affiliates of medical information on a case-by-case basis. Citigroup offers comments on several of these specific exceptions. First, the use of medical information to determine whether use of a power of attorney or legal representative is necessary and appropriate should be expanded to include medical information to determine competency. Perhaps that is implied in the exception for a determination of the need for a legal representative, but it should be made explicit. In addition, there should be an exception to permit the creditor to receive medical information required to resolve a dispute directly with a consumer. Since the FACT Act allows for this direct consumer/creditor dispute resolution, the creditor should be free to receive and use medical information to alter the terms of the credit or to take other actions with respect to the granting of credit that will resolve the dispute. The creditor ordinarily would convey this information to credit bureaus with a request that it be included in consumer's credit report to explain the dispute resolution. Such dispute resolution may be by phone and may involve an issue of some sensitivity with the consumer. The consumer often may not want to delay resolution while the consumer writes a detailed letter to the creditor that conveys the information and authorizes the use of the information to resolve the dispute and for such other purposes as necessary. This leads to the final comment on the exceptions. The Agencies have faced again and again the issue of written customer consent. Generally, they have made accommodations for telephone and electronic transactions. The consumer authorization for the use of consumer information should address these same concerns. As noted above, if the consumer provides information by telephone or email to resolve a dispute or to explain information on an application for credit or to ask for forbearance due to a medical emergency, a provision that requires the consumer to compose, sign and mail a letter does little to address the consumer's objective in the time frame implied by the consumer through the consumer's choice of contacting the creditor. The Agencies should consider actions that they have permitted in other situations: recording the consumer's oral authorization, unsigned email or other electronic message, note in the customer file by the creditor's representative, use of preprinted forms. In all cases, the consumer will provide the information or will be told of the information provided by a third party in order to authorize its use. If the customer chooses to give approval through other than a written signature on a self-composed authorization, the creditor should not be compelled to delay use of the medical information as the consumer directs. If the Agencies desire additional information or clarification, please contact James E. Scott, Senior Regulatory Counsel, at 212-559-2485. Very truly yours
Carl V. Howard
General Counsel - Bank Regulatory
| 
