VISA August 16, 2004 Robert E. Feldman
Executive Secretary
Federal Deposit Insurance Corporation
550 17th Street, NW
Washington, DC 20429
Attention: RIN 3064-AC73
Office of the Comptroller of the Currency
250 E Street, SW
Mail Stop 1-5
Washington, DC 20219
Attention: Docket No. 04-16. Jennifer J. Johnson
Secretary
Board of Governors of the Federal
Reserve System
20th Street and Constitution Avenue, NW
Washington, DC 20551
Attention: Docket No. R-1203 Becky Baker
Secretary of the Board
National Credit Union Administration
1775 Duke Street
Alexandria, VA 22314 Regulation Comments
Chief Counsel's Office
Office of Thrift Supervision
1700 G Street, NW
Washington, DC 20552
Attention: No. 2004-31 Re: Fair Credit Reporting Act Affiliate Marketing Regulations Ladies and Gentlemen: This comment letter is submitted on behalf of Visa U.S.A. Inc. in response to the. notice of proposed rulemaking ("Proposed Rule") and request for public comment issued by the Board of Governors of the Federal Reserve System ("FRB"), the Federal Deposit Insurance Corporation, the National Credit Union Administration, the Office of the Comptroller of the Currency and the Office of Thrift Supervision (collectively, the "Agencies"), published in the Federal Register on July 15, 2004. Pursuant to the Fair Credit Reporting Act ("FCRA"), as amended by the Fair and Accurate Credit Transactions Act of 2003 ("FACT Act"), the Proposed Rule would prescribe regulations to implement section 624 of the FCRA concerning affiliate marketing. Visa appreciates the opportunity to comment on this important topic. The Visa Payment System, of which Visa U.S.A.1 is a part, is the largest consumer payment system, and the leading consumer e-commerce payment system, in the world, with more volume than all other major payment cards combined. Visa plays a pivotal role in advancing new payment products and technologies, including technology initiatives for protecting personal information and preventing identity theft and other fraud, for the benefit of its member financial institutions and their hundreds of millions of cardholders. BACKGROUND The FCRA expressly permits the sharing of information between affiliated entities. Specifically, the FCRA permits financial institutions to share transaction or experience data between affiliated entities without limitation.2 The FCRA also permits financial institutions to share information that otherwise would be considered consumer reports with their affiliates if their customers are provided notice and an opportunity to opt out before this information is shared.3 However, section 624 of the FCRA, as added by section 214 of the FACT Act, limits the ability of a financial institution to use certain information received from its affiliates for marketing purposes. Specifically, section 624(a)(1) of the FCRA states that "[a]ny person that receives from another person related to it by common ownership or affiliated by corporate control a communication of information that would be a consumer report, but for [the exceptions in] section 603(d)(2)(A), may not use the information to make a solicitation for marketing purposes to a consumer about its products or services, unless" the consumer is provided notice and an opportunity to opt out, and the consumer does not opt out.4 Section 214(b) of the FACT Act requires the Agencies, the Federal Trade Commission ("FTC") and the Securities and Exchange Commission, with respect to the entities subject to their respective FCRA enforcement authority, to "prescribe [consistent and comparable] regulations to implement section 624 of the" FCRA.5 The Proposed Rule would implement section 624 of the FCRA. However, the requirements of the Proposed Rule differ materially in both nature and structure from the requirements of section 624 of the FCRA, as well as the privacy provisions of the Gramm-Leach-Bliley Act ("GLBA"). For example, the Supplementary Information to the Proposed Rule ("Supplementary Information") introduces a new concept of so-called "constructive sharing" of consumer information that is well beyond the scope of section 624. In fact, the Proposed Rule contains many new and unique provisions not found in the statute itself, and these provisions raise questions as to the scope and operation of the affiliate marketing initiatives in section 624. Many, but not all, of these issues are addressed in this letter. THE FINAL RULE SHOULD NOT IMPOSE RESPONSIBILITIES ON THE FINANCIAL INSTITUTION THAT SHARES ELIGIBILITY INFORMATION WITH AN AFFILIATE The Proposed Rule would impose the responsibilities found in section 624 on a financial institution that shares consumer report and certain transaction and experience information (referred to in the Proposed Rule as "eligibility information") with an affiliate. Specifically, proposed section .20(a) would require that if a financial institution communicates eligibility information to an affiliate, the receiving affiliate may not use this information to make or send solicitations to consumers, unless the financial institution sending the information to the affiliate first provides the consumers with notice and an opportunity to opt out, and the consumers do not opt out. Visa believes that the final rule should not impose the section 624 notice obligation on the financial institution that shares eligibility information with an affiliate, because there is no basis in the statute for doing so. Section 624 of the FCRA does not establish any restriction on the sharing of information with or among affiliates. Instead, section 624 only provides that an affiliate that receives eligibility information may not use this information to make marketing solicitations, absent an applicable exception, unless the consumer first is given notice and an opportunity to opt out. Specifically, section 624(a)(1) states that "[a]ny person that receives [eligibility information from an affiliate] may not use the information to make a solicitation for marketing purposes."6 The Agencies acknowledge this exact point in the Supplementary Information, which states that "[s]ection 624 governs the use of information by an affiliate, not the sharing of information with or among affiliates."7 Additionally, the Supplementary. Information states that section 624 "is drafted as a prohibition on the affiliate that receives [eligibility] information from using such information to send solicitations, rather than as an affirmative duty imposed on the affiliate that sends or communicates that information."8 Although this principle is appropriately highlighted by the Agencies in the Supplementary Information, the Proposed Rule nonetheless would impose an affirmative duty on a financial institution that shares eligibility information to provide consumers notice and an opportunity to opt out. While the affiliated companies may well decide among themselves that it is most efficient to have the affiliate that shares the information also provide the notice, there simply is no basis in the FCRA to obligate the sharing affiliate to do so. In this regard, section 624 of the FCRA is covered by the FCRA private right of action provisions in sections 616 and 617. Under the Proposed Rule, a financial institution that shares eligibility information with an affiliate could be liable to its customers if that information is used by its affiliates to make solicitations to those customers and the financial institution did not provide the customers with notice and an opportunity to opt out. Under the Proposed Rule, a financial institution seeking to avoid civil liability would be required to pursue one of several courses of action before sharing eligibility information: (1) require receiving affiliates to commit that they will not use the information for marketing purposes; (2) always provide the notice before sharing the information with affiliates; or (3) never share the information with affiliates. In many cases, none of these solutions is practical. Even if a financial institution contracted with its affiliates concerning the use of eligibility information, the financial institution still could be exposed to potential liability, for negligent noncompliance if any of the affiliates uses the information to make a solicitation to a consumer who had not previously received notice and an opportunity to opt out. Financial services holding companies typically have common customer information databases that can be accessed by all affiliates, and nothing in section 624 restricts the continued ability of holding companies to maintain such databases. The only appropriate way to address the affiliate marketing limitation in section 624 is by placing the burden of the notice requirement and proper use requirement on the affiliate that receives and uses the information, as reflected in the FCRA itself. Moreover, because section 624 does not limit the ability of financial institutions to share eligibility information with affiliates, by imposing duties on institutions that share eligibility information, the Proposed Rule goes beyond the scope of section 624, and in doing so would expose financial institutions to civil liability based on the use of this information by their affiliates. Since the Proposed Rule is consistent with neither the statutory language of section 624, nor with the legislative intent behind this provision, Visa believes that the final rule should not impose new duties on entities that share eligibility information with affiliates, as. long as. this sharing is permitted by section 603. THE FINAL RULE SHOULD NOT REQUIRE ANY SPECIFIC ENTITY TO PROVIDE THE. NOTICE As noted above, the Proposed Rule would require a financial institution that shares eligibility information with an affiliate to provide the opt-out notice to the consumer. Visa believes that the final rule should not require any specific entity to provide the notice, but instead should only require that the consumer receive the required notice before an entity may make a solicitation to the consumer based on eligibility information received from its affiliates. The person who physically provides the notice is irrelevant. In this regard, for example, the FCRA specifically contemplates that the affiliate receiving and using eligibility information to make marketing solicitations to consumers could be the person who provides the notice. Section 624(b) of the FCRA states that: A notice or other disclosure under this section may be coordinated and consolidated with any other notice required to be issued under any other provision of law by a person that is subject to this section, and a notice or other disclosure that is equivalent to the notice . . . and that is provided by a person described in subsection (a) to a consumer together with disclosures required by any other provision of law, shall satisfy the requirements of subsection (a).9 Even though the Proposed Rule clearly contradicts this plain, unambiguous language, the Agencies still correctly point out in the Supplementary Information that the FCRA does not specify which entity must provide the opt-out notice.10 This lack of specification of the party who must provide the notice, however, does not override the clear language of section 624(b) that the affiliate receiving and using eligibility information from an affiliate to make a marketing solicitation may provide the notice. The Agencies explain that the FCRA and the FACT Act "suggest" that the notice should be provided by the entity that communicates the eligibility information. Specifically, the Agencies state that section 624(a)(1)(A) requires that the notice disclose to the consumer that "information may be communicated" among affiliates for the purpose of making solicitations, which the Agencies conclude "suggests" that the entity communicating the eligibility information must provide the notice.11 This statement, however, does no more than inform the consumer that affiliated entities may make solicitations based on information they receive from each other and that the consumer may opt out of the marketing use, not the sharing, of this information. Under the statute, any entity is capable of providing this notice and the Agencies should not read into section 624 a specific requirement that does not exist in the statute itself. The Agencies also note that section 214(b)(3) of the FACT Act requires the Agencies to consider existing affiliate sharing notification practices and provide for coordinated and consolidated notices.12 This provision does not imply that the entity sharing information with an affiliate must provide the notice, or even that it is the entity that should have the responsibility for providing the notice. Congress only sought to ensure that the notice requirement would be consistent with existing disclosure practices and could be coordinated with other disclosures required by law. By simply requiring that the notice has been provided before information received from an affiliate is used for marketing purposes, the Agencies' resulting rule would be fully consistent with the statutory mandate for coordination and consolidation with other notices, even though it would leave that coordination to the institution or institutions providing the notices. In short, Visa believes that the final rule should not require any specific entity to provide the opt-out notice, but should only require that the consumer receive an opt-out notice that covers an affiliate's use of eligibility information for marketing purposes before a solicitation based on that information is made to the consumer. This approach would promote flexibility by allowing any affiliate to provide the notice. This approach also would recognize the fact that any affiliate may receive eligibility information, as is clearly permitted by the FCRA, without intending to use, or before deciding to use, this information to make marketing solicitations. Allowing the entity that uses eligibility information to provide the notice, or to ensure that some other entity has provided the notice, would not require a determination to be made at the time the information is shared, or placed into a centralized database, whether it will be used to make a solicitation. In addition, an entity that later decides to use this information for marketing would not be required to contact the affiliate that shared the information to have that affiliate provide the notice. Most importantly, allowing the entity that uses eligibility information received from an affiliate to provide the notice, or to ensure that some other entity has provided the notice, would be consistent with the plain language of section 624(b) of the FCRA. THE FINAL RULE SHOULD NOT ADDRESS SO-CALLED "CONSTRUCTIVE SHARING" The Agencies specifically request comment on whether the Proposed Rule should apply "if affiliated companies seek to avoid providing notice and opt out by engaging in the `constructive sharing' of eligibility information to conduct marketing."13 As described by the Agencies, constructive sharing occurs when a financial institution uses its own information to make marketing solicitations to its own customers concerning an affiliate's products or services, and the consumers' responses provide the affiliate with discernible eligibility information about the consumers. The term "constructive sharing" is not used in section 624 of the FCRA, or anywhere else in the FCRA or the FACT Act. Neither the letter nor the purpose of section 624 applies to so-called "constructive sharing." This concept of "constructive sharing" is a creation of the Agencies, not that of Congress. Accordingly, the final rule should not address "constructive sharing." Simply put, section 624 does not cover "constructive sharing" as described by the Agencies. Even if section 624 did cover "constructive sharing," section 624 also would exempt "constructive sharing" from its requirements, since any receipt and use of information from the consumer would coincide with the consumer's submission of the response form, which would constitute an inquiry within the meaning of section 624 and trigger application of the pre-existing business relationship exception under that section. Moreover, the very structure of section 624 was designed to encourage financial institutions within the holding company structure to conduct marketing through an affiliate that has a pre-existing business relationship with its. customers. Specifically, for example, the pre-existing business relationship. exception, as contrasted with the notice requirements imposed by section 624 on the use of eligibility information to market to consumers with whom a financial institution does not have a pre-existing business relationship, creates an incentive to conduct marketing in holding companies through financial institutions with the existing customer relationships. Section 624 Does Not Cover "Constructive Sharing" Section 624 does not limit the sharing of information. Section 624 addresses only the use of information after it has been shared and not the sharing of information itself. In effect, section 624, like the FTC Telemarketing Sales Rule, gives consumers the ability to opt out of certain marketing practices—in the case of section 624, the use of information that Congress deemed sensitive for direct marketing when conducted by affiliated companies. As such, the focus and terms of section 624 are much narrower than the focus of general privacy legislation, such as the privacy provisions of title V of the GLBA that restrict the disclosure, as opposed to the use, of information.
Specifically, section 624 of the FCRA applies only if four elements are present: (1) An entity has received information from an affiliate;
(2) This information would be a consumer report if the exceptions to the definition of consumer report in the FCRA for transaction and experience information and other information shared with affiliates did not apply;
(3) The entity uses this information to make marketing solicitations to consumers; and
(4) The marketing solicitations are for the products or services of the entity receiving the information and making the solicitations.14 If any, one of these four elements is not present, section 624 does not require notice and an opportunity to opt out before an entity can make a marketing solicitation to consumers based on eligibility information. These four elements are not all present in "constructive sharing." Moreover, the plain language of section 624 of the FRCA does not prohibit an entity from using its own information to solicit its own customers for the products or services of a third party, including an affiliate. Section 624 of the FCRA applies only when an entity uses eligibility information received from an affiliate to make a marketing solicitation to a consumer. If an entity uses its own information to market an affiliate's products or services, the entity has not used eligibility information received from an affiliate. If an entity does not receive eligibility information from an affiliate before the marketing solicitation is made, section 624 simply does not apply, and the entity may make a solicitation to a consumer without the consumer receiving notice and an opportunity to opt out. In "constructive sharing," the entity making the solicitation does not receive eligibility information from an affiliate, and the entity on whose behalf the solicitation is made only receives information from a consumer's response after the solicitation has been made. As a result, section 624 cannot apply. In addition, section 624 of the FCRA applies only when an institution uses eligibility information received from an affiliate to make a marketing solicitation concerning "its" products or services.15 The word "its" in "about its products or services" is. not ambiguous and clearly refers to the entity that makes the solicitations and not the affiliate communicating the eligibility information. If an entity is marketing the products or services of its affiliate, the entity would not be marketing its own products or services and, as a result, section 624 would not require notice and an opportunity to opt out. In "constructive sharing," an entity does not market its own products or services, and, as a result, section 624 cannot apply. Section 624 Excepts "Constructive Sharing" Even if one were to disregard totally these required statutory factors, section 624 of the FCRA still would not apply to "constructive sharing" because one or more exceptions would apply. For example, section 624 expressly excludes from the notice and opt-out requirement any person who uses information to make marketing solicitations "to a consumer with whom the person has a pre-existing business relationship."16 The pre-existing business relationship exception is not limited to the institution's own products or services. A statement by Representative Oxley, Chairman of the House Financial Services Committee, underscores this result by clarifying that "[a]n entity that has a pre-existing business relationship with the consumer can send a marketing solicitation to that consumer on its own behalf or on behalf of another affiliate."17 As a result, the notice and opt-out requirement cannot apply when an entity makes marketing solicitations for an affiliate's products or services to its own customers because the entity has a pre-existing business relationship with its customers. In "constructive sharing," the pre-existing business relationship exception applies because an entity makes solicitations to its own customers with whom the entity has a pre-existing business relationship. Furthermore, when the affiliate on whose behalf the solicitations are made receives an application or inquiry from the consumer, which includes the consumer's response to the solicitation that leads to the so-called "constructive sharing," that affiliate would be able to receive and use discernable information of its affiliated companies to respond to the communication because the affiliate would then have a pre-existing business relationship with the consumer as a result of the consumer's inquiry. Indeed, the literal language of the pre-existing business relationship exception goes well beyond "constructive sharing." For example, if a financial institution obtains a list of an affiliate's customers from a common, shared database and applies its own criteria to this list, and then requests the affiliate to solicit its own customers for the financial institution's products on its behalf, section 624 should not apply, as long as the affiliate makes its own decision whether or not to send the solicitations, and then in fact sends the solicitations. In these circumstances, because the affiliate making the ultimate decision on whether or not to make the solicitation, and then sends the solicitation, has a pre-existing business relationship with the consumer, section 624 simply does not apply. In this regard, the affiliate with the customer relationship that makes the decision whether or not to send the marketing solicitations still has a strong incentive to maintain that customer relationship and would take care not to jeopardize that relationship by over aggressively marketing the financial institution's products or services. In addition, as discussed below, the limitation in the servicing exception does not prohibit the financial institution from making solicitations on behalf of the affiliate, even though the affiliate could not make those solicitations on its own behalf.. The servicing exception in section 624(a)(4)(C) states that "this subparagraph shall not be construed" to permit an entity to make a solicitation on behalf of an affiliate that could not otherwise provide the solicitation on its own behalf.18 Clearly, this limitation is limited to the servicing exception only. The exceptions in section 624 are listed in the disjunctive and, as a result, if any exception applies, the notice and opt-out requirement does not apply. As a result, the restricting language in the servicing exception in no way limits the application of the pre-existing business relationship exception.
Attempts to Address "Constructive Sharing" are not Consistent with the Purposes of Section 624 Not only does the plain language of section 624 of the FCRA not apply, but the policy and purpose behind section 624 does not support any attempt to apply the notice and opt-out requirement to "constructive sharing." The use of information by an entity to market an affiliate's products to its own customers is not the equivalent of an affiliate using the same information to market to another entity's customers. An entity that makes marketing solicitations to its own customers has a strong incentive to maintain those customer relationships and will take care not to jeopardize those relationships by over aggressively marketing its products or services. A recent study by the Secretary of the Treasury Department highlighted this important point in its key findings. The study noted that "[m]ost businesses have a powerful market interest in not annoying their customers with unwanted solicitations, particularly businesses that value customer loyalty."19 An affiliate that lacks a current customer relationship may see less to lose through aggressive marketing practices. The scheme established in section 624 that limits the marketing practices of an affiliate without a customer relationship, but does not limit the marketing practices of the institution with a customer relationship, is based on this distinction. Whether the section 624 notice and opt-out requirement applies depends on who markets the product not what the product is or whose product it is. Solicitations for the same product are treated differently depending on who makes those solicitations. The distinguishing characteristic of the different standards that apply to marketing solicitations depending on whether the entity or affiliate makes the solicitation is each party's marketing incentives. In addition, "constructive sharing" actually promotes the privacy of customer information. An affiliate whose products are marketed by an entity with the customer relationship does not receive or use affiliate customer information for marketing purposes unless the customer elects to respond to the solicitation. Allowing an entity to market an affiliate's products or services to the entity's own customers eliminates the need to transfer customer information to the affiliate for marketing purposes and places the consumer in control of whether the information will be communicated to the affiliate through the consumer's response. Application of Section 624 to Agencies' Example of "Constructive Sharing" The Supplementary Information presents the following hypothetical example of "constructive sharing": An insurance company provides an affiliated bank with specific eligibility criteria for the purpose of having the bank make solicitations on behalf of the insurance company to bank customers who meet those criteria; in addition, a consumer's response provides the insurance company with discernible eligibility information, such as a response form that is coded to identify the consumer as meeting the eligibility criteria.20
Section 624 does not apply to this hypothetical example because the bank is not using eligibility information received from an affiliate in order to make solicitations. The bank receives eligibility criteria from the affiliated insurance company, but these criteria are not eligibility information. Section 624 does not prohibit an entity from using its own information to make solicitations, but only regulates the use of eligibility information received from an affiliate. Section 624 also would not apply to the insurance company because the insurance company is not using eligibility information received from an affiliate in order to make solicitations. If the bank's customer responds to the solicitation by returning the solicitation to the insurance company, the notice and opt-out requirement still would not apply to the use of eligibility information at that point by the insurance company because the inquiry to the insurance company would trigger application of the pre-existing business relationship exception. More specifically, by responding to the solicitation, the bank's customer also would create a pre-existing business relationship with the insurance company, and the insurance company could, for a period of at least three months, use eligibility information received from any affiliate in connection with its marketing to the consumer. In addition, if the bank's customer responds to the solicitation, section 624 would not apply to any use of eligibility information in response to a communication initiated by the consumer because that use is covered by yet another exception in section 624; namely, a communication initiated by a consumer. "Constructive Sharing" is Beyond the Scope of Section 624 Rulemaking Section 214(b)(1) of the FACT Act requires the Agencies to "prescribe regulations to implement section 624 of the" FCRA. The Agencies are authorized and directed to write rules to implement the notice and opt-out requirement. If the Agencies prescribe rules to limit conduct that is not addressed by section 624, such as by limiting the ability of an entity to market its affiliate's products or services to its own customers, those rules likely should not be viewed as implementing section 624, unless the language of section 624 was ambiguous or would lead to an absurd result. As discussed above, the plain language of section 624 is not ambiguous, and it would not lead to an absurd result. The pre-existing business relationship exception in section 624 is not ambiguous, because the general limitation of section 624 expressly refers to an institution making solicitations for "its products or services," while the pre-existing business relationship exception has no such reference.21 Similarly, the definition of "solicitation" is not ambiguous on this point. Section 624 defines a "solicitation" as "the marketing of a product or service initiated by a person to a particular consumer that is based on an exchange of information described in [section 624(a)), and is intended to encourage the consumer to purchase such product or service, but does not include communications that are directed at the general public" or provided for in the Agencies' regulations.22 This definition is not rendered ambiguous because it does not indicate which party's products or services are marketed. As noted above, section 624(a)(1) specifically states that a solicitation covered by section 624 concerns the solicitor's products or services. Because the notice and opt-out requirement only applies with respect to solicitations for the solicitor's own products and services, the definition does not need to restate whose products or services are at issue. The section only applies to solicitations regarding one entity's products or services—those of the solicitor. EXCEPTIONS TO THE NOTICE AND OPT-OUT REQUIREMENT Proposed section .20(c) includes several exceptions to the notice and opt-out requirement that generally track the statutory exceptions provided in section 624(a)(4) of the FCRA. These proposed exceptions provide that the notice and opt-out requirement does not apply when an entity uses eligibility information received from an affiliate in certain instances, including: (1) to make or send solicitations to consumers with whom the entity has a pre-existing business relationship; (2) to perform services on behalf of an affiliate; (3) to respond to a communication initiated by a consumer; and (4) to respond to an affirmative authorization or request by the consumer. Although these exceptions appropriately are listed in the disjunctive in the Proposed Rule, Visa believes that the Agencies nonetheless also should state specifically that if any one exception applies, the final rule is not applicable. Pre-Existing Business Relationship Exception Proposed section .20(0(l) would provide an exception for a person that makes or sends a solicitation to a consumer with whom the person has a pre-existing business relationship. Proposed section .3(m) would define a "pre-existing business relationship" as a relationship between a consumer and a person that is based on any one of three factors. First, a relationship based on a financial contract between the parties that is in force on the date that a solicitation is made or sent to the consumer would qualify as a pre-existing business relationship.23 The Agencies should clarify that a "financial contract" includes any in-force contract relating to a financial product or service covered by title V of the GLBA, such as a credit card account in which charging privileges are in effect or that has an outstanding balance. Second, a relationship based on a consumer's purchase, rental or lease of the person's products or services, or a financial transaction with the person (including holding an active account or an in-force policy) during the 18 months preceding the date that a solicitation is made or sent to the consumer would qualify as a pre-existing business relationship.24 Although the Agencies provide an example of an insurance policy in the Proposed Rule, it is not clear at what point the 18-month time period begins with respect to many purchase, rental, lease or financial transactions. The Agencies should clarify that the 18-month period begins to run at the time that all contractual responsibilities under the purchase, rental, lease or financial transaction expire. In addition, it is not clear what constitutes an active account that would qualify as a pre-existing business relationship. Any account with outstanding contractual responsibilities on either side of an account relationship should be considered to be an active account, regardless of whether individual transactions occur or do not occur under the account. Third, a relationship based on a consumer's inquiry or application regarding the person's products or services during the three months. preceding the date on which a solicitation is made or sent to the consumer would qualify as a pre-existing business relationship.25 The Agencies indicate in the Supplementary Information that with respect to consumer inquiries, the FCRA definition is similar to the "established business relationship" under the amended FTC Telemarketing Sales Rule, which the Agencies believe "suggests that it would be appropriate to consider the reasonable expectations of the consumer in determining the scope of this exception."26 As a result, the Agencies conclude that "an inquiry includes any affirmative request by a consumer for information, such that the consumer would reasonably expect to receive information from the affiliate about its products or services."27 Additionally, the Agencies indicate in the Supplementary Information that "[a] consumer would not reasonably expect to receive information from the affiliate if the consumer does not request information or does not provide contact information to the affiliate."28 Visa believes that this expectation standard requires a financial institution receiving an inquiry to project or interpret the consumer's state of mind. The difficulty of this standard is illustrated by the Agencies' own description of the standard. The Agencies state that in order for a consumer's inquiry to result in a pre-existing business relationship, the consumer must both request information and provide contact information. In practice, however, either of these actions necessarily reflects the consumer's expectation that he or she will receive a solicitation. In addition, these terms suggest that "magic words" may be required for an inquiry to lead to a pre-existing business relationship. For example, is the statement, "I am interested in X," a request or must the consumer say, "send me information about X." As proposed by the Agencies, the expectation standard would severely limit the inquiries and applications that would establish a pre-existing business relationship. To the contrary, section 624(d)(1)(C) of the FCRA contains no such limitation on the types of inquiries or applications that would comprise a pre-existing business relationship. Under the FCRA, if a consumer has made any inquiry or application within the preceding three months, the pre-existing business relationship exception applies, without regard to the ability of a company to interpret the consumer's state of mind while doing so. For example, if a consumer inquires to an entity concerning reasonably identifiable products or services or indicates interest in products or services offered by a reasonably identifiable type of person, the affiliate that offers those types of products or services should be considered to have a pre-existing business relationship with that consumer and, thus, should be able to use affiliate information to send solicitations to that consumer. Proposed section .20(d)(1) provides examples of situations that qualify and do not
qualify as pre-existing business relationships. Proposed section .20(d)(1)(iii) states that if a consumer inquires about an affiliate's products or services and provides contact information for receipt of this information, the affiliate can use eligibility information to. make the consumer a solicitation within three months. Although providing contact information may be an indication that a consumer reasonably expects to receive solicitations, as noted above, this exception should not hinge on providing contact information. For example, in the context of an e-mail request, the contact information may, be self-evident and the consumer may conclude that it is unnecessary to resubmit this information. Similarly, the return address on an envelope or the captured telephone number of a consumer requesting information about products or services should be sufficient
even if the consumer neglects to more specifically include his or her address or telephone number. Additionally, the Agencies request comment on whether there are additional circumstances that should be included within the definition of pre-existing business relationship. 29 Visa believes that the term pre-existing business relationship should be defined to include relationships arising out of the ownership of servicing rights, a participation interest in lending transactions, and similar relationships. Servicing Exception Proposed section .20(c)(3) would provide an exception for a person that uses eligibility information to perform services on behalf of an affiliate. Proposed section .20(c)(3) states that this exception is not to be "construed as permitting a bank to make or send solicitations on its behalf or on behalf of an affiliate if the bank or the affiliate, as applicable, would not be permitted to make or send the solicitation as a result of the election of the consumer to opt out." This limitation, however, does not track the language of the FCRA. Section 624(a)(4)(C) states that the servicing exception does not permit "a person to send solicitations on behalf of another person, if such other person would not be permitted to send the solicitation on its own behalf as a result" of a consumer's opt out. In addition, as noted above, the limitation in section 624(a)(4)(C) only applies to the servicing exception. The Agencies should clarify that this limitation does not determine the applicability of any other exception. Consumer-Initiated Communications Exception Proposed section .20(c)(4) would provide an exception for a person that uses eligibility information "[i]n response to a communication initiated by the consumer orally, electronically, or in writing." The Supplementary Information indicates that to be covered by the consumer-initiated communication exception, "use of eligibility information must be responsive to the communication initiated by the consumer."30 As an example, the Supplementary Information indicates that if a consumer calls an affiliate to ask about the affiliate's products or services, only "solicitations related to those products or services would be responsive to the communication and thus permitted under the exception."31 Visa believes that this concept of "responsive" solicitations is subjective and encourages an overly narrow reading of this exception. Consumers may not be familiar with the various types of products or services that are available and may rely on the financial institution to inform them about available options and to offer guidance concerning the products or services that would best suit their needs. In addition, a consumer may not be familiar with which affiliates offer specific products or services. A financial institution should not be limited in its ability to use eligibility information obtained from an affiliate to respond to a consumer who initiates a communication with the financial institution about any product or service. After all, an inquiry by a consumer would trigger an entirely separate exception, namely the pre-existing business relationship exception, so an overly narrow reading of the consumer-initiated communication exception would serve no purpose whatsoever. More specifically, if a consumer calls an affiliate to ask about its products or services, this call would qualify as an inquiry by the consumer concerning the affiliate's products or services. The affiliate then would not need to rely solely on the consumer-initiated communication exception because the affiliate would also be covered by the pre-existing business relationship exception. The consumer-initiated communication exception is clearly intended to be broader in scope and, therefore, to apply to less specific communications than the inquiry prong of the pre-existing business relationship exception, or it would be redundant. The Proposed Rule also would provide examples of the consumer-initiated communication exception. For example, proposed section .20(d)(2)(i) indicates that if a consumer initiates a call to a securities affiliate concerning its products or services and provides contact information for receiving that information, the securities affiliate may use eligibility information from another affiliate to make solicitations in response to the call. Requiring that the consumer provide contact information suggests that the affiliate could not solicit the consumer over the phone on the same call, but would have to mail or e-mail a solicitation to the consumer. As in the case of the pre-existing business relationship exception, nothing in section 624 even suggests that a consumer's communication should be required to include the consumer's contact information in order for the exception to apply. Proposed section .20(d)(2)(ii) would provide an additional example that if an affiliate makes an initial marketing call without the use of affiliate information and leaves a message for the consumer to call back, the consumer's response is a communication initiated by the affiliate, and not the consumer. Visa believes that any such consumer call should be viewed as a communication "initiated" by the consumer, whether or not the consumer is responding to an affiliate's call or some other communication, so long as the affiliate's message makes clear the purpose of the call. If an affiliate has left a clear message, the consumer is in a position to decide whether he or she wants to return the call based on the product or service or the affiliate involved. If a consumer does not wish to receive a solicitation, he or she simply does not have to initiate a telephone call in response to the message. The proposed limitation may emanate from a concern by the Agencies that affiliates may "trick" the consumer into initiating a communication and, thereby, avoid the notice requirement. However, the Agencies should address deceptive practices under their unfair or deceptive acts or practices authority under the Federal Trade Commission Act, rather than in a FACT Act rulewriting. In this regard, if the message left by the affiliate states the purpose of the call and the consumer elects to respond, it cannot be said that the affiliate has "tricked" the consumer into making that call. Consumer Affirmative Authorization or Request Exception Proposed section .20(c)(5) would provide an exception for a person that uses eligibility information "[i]n response to an affirmative authorization or request by the consumer orally, electronically, or in writing to receive a solicitation." This proposed exception does not track the statutory language. Section 624(a)(4)(E) of the FCRA does not require the consumer's authorization or request to be "affirmative." The Proposed Rule and the Supplementary Information do not indicate how an authorization or request would be "affirmative," or the justification for adding this language, except to say that a preselected check box does not satisfy this requirement. Consumers are familiar with check boxes, and if a consumer has the ability to "unselect" a pre-selected check box, the exception should apply. More broadly, Visa believes that the exception should not be limited artificially. A request or authorization can be manifested in many ways. Adding the requirement that a request or authorization be affirmative will only inject uncertainty or pedantic reaffirmation into the process. In addition, Visa requests that the Agencies clarify that a consumer's authorization or request does not have to refer to a specific product or service or to a specific provider of products or services in order for the exception to apply. As discussed above, the exception should apply if the consumer's authorization or request concerns a type of product or service or a type of provider of products or services. GRANDFATHERING OF CERTAIN ELIGIBILITY INFORMATION Proposed section .20(e) would provide that the. notice and opt-out requirement does not apply to the use of eligibility, information shared by an affiliate to make or send solicitations to consumers if "such information was received by the" affiliate prior to the mandatory compliance date. This proposed language differs from the corresponding provision in section 624 itself. Section 624(a)(5) states that "the use of information to send a solicitation to a consumer [is not prohibited] if such information was received prior to the date on which persons are required to comply with regulations implementing this subsection." Section 624 does not limit the information that is grandfathered to eligibility information received by the affiliate that would use this information to make solicitations. Visa believes that the final rule should grandfather all information that is received by the financial institution that would be shared with its affiliates, or that has been or will be placed into a common database. THE FINAL RULE SHOULD EXTEND THE COMPLIANCE DATE The Supplementary Information indicates that the mandatory compliance date will be included in the final rules.32 The Agencies specifically, request comment on whether the mandatory compliance date "should be different from the effective date of the final regulations."33 Section 214(b)(4)(B) of the FACT Act provides that the regulations will be effective within six months after being issued in final form. Visa believes that the final rule should provide at least an additional six months for compliance; that is, financial institutions should be given at least an additional twelve months after the rule is issued in final form to comply with the notice and opt-out requirement. This additional compliance time would assist financial institutions that must make significant changes to business practices. and procedures in order to comply with the final rule. Financial institutions cannot design comprehensive compliance programs before the rules are issued in final form because of the uncertainty surrounding the rules until they are released in final form. This problem is illustrated by the many issues raised in this and other comment letters. In addition, many institutions will attempt to coordinate and consolidate the affiliate marketing notice with their annual GLBA privacy notice. This coordination was contemplated by the effective date for this provision incorporated into section 624. However, in practice the transition period in section 624 is inadequate. Many GLBA notices are mailed after March of each year. Further, to the extent that the Proposed Rule is finalized later than the September date set forth in the FACT Act, even more GLBA notices for 2005 will have been mailed. Accordingly, Visa believes that the Agencies should allow financial institutions that intend to consolidate their affiliate marketing notice with their GLBA notice for existing customers to begin complying with the final rule at the time that they provide their next GLBA notice following the established effective date or December 31, 2005, whichever is earlier. This "roll-out" would allow financial institutions to coordinate and consolidate the affiliate marketing notice with their "next" GLBA privacy notice, if the institutions so choose, consistent with the statutory directive that financial institutions have the opportunity to "coordinate" and "consolidate" their affiliate marketing notice "with any other notice required to be issued under any other provision of law."34 In addition, this "roll-out" would also benefit consumers who would receive the affiliate marketing notice and the GLBA privacy notice together and, therefore, could make all of their privacy choices at the same time. EXCLUSIONS FROM THE DEFINITION OF "SOLICITATION" Proposed section .3(n)(1) would define a "solicitation" as marketing initiated to a particular person that is "[biased on eligibility information" received from an affiliate and "[i]ntended to encourage the consumer to purchase" a product or service. Proposed section .3(n)(2) would exclude from the definition of "solicitation" "communications that are directed at the general public and distributed without the use of eligibility information." Visa supports the Agencies' determination that communications that are directed at the general public should not be considered solicitations. However, the Agencies should clarify that all communications that are directed at the general public are excluded from the definition of solicitation, whether or not these communications may be based on eligibility information received from an affiliate. Section 624(d)(2) of the FCRA states that the term "solicitation" "does not include communications that are directed at the general public." The FCRA does not limit or qualify which communications directed at the general public are excluded. An entity should be permitted to use information received from affiliates to develop communications directed at the general public, such as television and radio ads. In addition, Visa believes that the final rule should clarify that any marketing solicitation that is distributed without the use of eligibility information received from an affiliate would not qualify as a solicitation.
THE FINAL RULE SHOULD NOT ADDRESS "SENDING" SOLICITATIONS Throughout the Proposed Rule, the Agencies refer to "making" or "sending" solicitations.35 For instance, proposed section .20(b) would prohibit an affiliate that receives eligibility information from using this information "to make or send" solicitations to a consumer. Visa believes that the Agencies should remove all references to "sending" solicitations from the final rule. Section 624 of the FCRA only concerns the use of eligibility information to "make" solicitations and does not address "sending" solicitations. By referring to sending solicitations, the Proposed Rule could be interpreted as applying the notice and opt-out requirement to servicers that send solicitations on behalf of another entity. Although it is not clear what the Agencies believes "send" refers to, reference to "send" would be redundant if it only covered the same use as "make." If "make" and "send" are not synonymous, the Agencies would be regulating conduct that is not addressed in section 624. THE FINAL RULE SHOULD NOT DEFINE "CLEAR AND CONSPICUOUS" Proposed section .20(a)(i) would require a financial institution that shares eligibility information with an affiliate to provide the consumer with "a clear and conspicuous notice" that the consumer's information may be communicated to, and used by, an affiliate to make marketing solicitations to the consumer. Proposed section .3(c) would define "clear and conspicuous" as "reasonably understandable and designed to call attention to the nature and significance of the information presented." Visa believes that the Agencies should not attempt to define "clear and conspicuous" in the final rule and that, in fact, the proposed definition of "clear . and conspicuous" could significantly increase the risk of civil liability to financial institutions. As noted above, section 624 of the FCRA is covered by the private right of action provisions in sections 616 and 617. Consequently, the proposed definition could expose financial institutions to liability, even if the opt-out notice is completely accurate and even if the consumer is not harmed. As a result, this definition would foster litigation without any corresponding benefit to consumers. Recognizing the problems with attempting to specify what it means for information to be "clear and conspicuous" the FRB recently withdrew a proposal that would have applied such a disclosure standard to Regulations B, E, M and Z. Visa believes that the FCRA affiliate marketing rulemaking is not the appropriate forum to experiment further with defining "clear and conspicuous." THE FINAL RULE SHOULD PERMIT ORAL NOTICES In the Supplementary Information, the Agencies indicate that proposed section .20(a),
which would require the affiliate sharng eligibility information to provide the consumer notice, "contemplates that the opt out notice will be provided to the consumer in writing or, if the consumer agrees, electronically."36 The Agencies specifically request comments on whether there are circumstances in which it is necessary and appropriate to allow an oral notice.
Visa believes that the final rule should permit oral notices. If an entity communicates with a consumer in person or by telephone and an exception does not apply, section 624 would require a written or electronic notice in order to make solicitations using eligibility information received from an affiliate. When this occurs, an entity should be permitted to provide the consumer with an oral notice so it can determine whether or not it can use affiliate information to offer the consumer a product or service at that time. However, if the final rule only permits the notice to be provided in writing, an affiliate will not be able to use affiliate information during the telephone call, even though the consumer affirmatively indicates that the affiliate can do so, because there is no opportunity to provide the notice in writing during the call. THE FINAL RULE SHOULD PERMIT FINANCIAL INSTITUTIONS TO PROVIDE AN OPT-OUT OPPORTUNITY AT THE TIME OF THE TRANSACTION Proposed section .22(a) would provide that before an affiliate may use eligibility information received from a financial institution, the financial institution "must provide the consumer with a reasonable opportunity, following the delivery of the opt out notice, to opt out." For example, proposed section .22(b)(1) indicates that a financial institution provides a consumer a reasonable opportunity to opt out if the financial institution "mails the opt out notice to a consumer and gives the consumer 30 days from the date the [financial institution] mailed the notice to elect to opt out by any reasonable means." Proposed section .22(b)(3), however, would permit a financial institution to provide a consumer the opt-out notice at the time of an electronic transaction "and request[] that the consumer decide, as a necessary part of proceeding with the transaction, whether to opt out before completing the transaction." Visa believes that the final rule should permit a financial institution to provide the opt-out opportunity at the time of any type of transaction, not just an on-line transaction, and cause the consumer to decide whether to opt out as a necessary step in proceeding with the transaction. The opt-out decision is no more important than the consumer's decision on the transaction itself, and there is no reason why the consumer's decision cannot be made at that time. THE FINAL RULE SHOULD NOT ADDRESS METHODS OF OPT OUT THAT ARE NOT REASONABLE OR SIMPLE Proposed section .23(b) would provides examples of methods of opting out that are not reasonable or simple. Because of the potential for private litigation based on section 624, Visa believes that the final rule should not include these, or any other, examples of methods of opting out that are not reasonable or simple. The examples provided in proposed section .23(b), including requiring the consumer to write a letter to the financial institution, find no basis in section 624, which simply requires that the "the method provided [for opting out must] be simple."37 These examples are likely to be used in litigation to argue that financial institutions are not meeting the regulatory standard. "AFFILIATE" SHOULD BE DEFINED AS DEFINED IN THE GLBA Proposed section .3(b) would define an "affiliate" as "any person that is related by common ownership or common corporate control with another person." The Supplementary Information indicates that this proposed definition "simplifies the various FCRA and FACT ACT formulations [of the term affiliate)."38 Visa strongly supports the Agencies' efforts to simplify this definition. Visa believes that the most effective way to simplify this definition would be to make it completely consistent with the definition of the same term in the GLBA rules. The interrelationship between the GLBA and the FCRA is difficult enough without having different definitions for affiliate. Visa appreciates the opportunity to comment on this important topic. If you have any questions concerning these comments, or if we may otherwise be of assistance in connection with this matter, please do not hesitate to contact me, at (415) 932-2178. Sincerely,
Russell W. Schrader
Senior Vice President and
Assistant General Counsel
VISA U.S.A. Inc.
P.O. Box 194607
San Francisco, CA 94119
1 Visa U.S.A. is a membership organization comprised of U.S. financial institutions licensed to use the Visa service marks in connection with payment systems.
2 FCRA § 603(d)(2)(A)(i).
3 FCRA § 603(d)(2)(A)(iii).
4 In this comment letter, the information covered by section 624 will be referred to as "eligibility information," similar to the Proposed Rule.
5 FACT Act §§ 214(b)(1)-(2).
6 FCRA § 624(a)(1) (emphasis added).
7 69 Fed. Reg. 42,502, 42,504 (July 15, 2004) (emphasis added).
8 Id.
9 FCRA § 624(b) (emphasis added).
10 969 Fed. Reg. at 42,504.
11 69 Fed. Reg. at 42,504.
12 Id.
13 69 Fed. Reg. at 42,507.
14 FCRA § 624(a)(1).
15 FCRA § 624(a)(1).
16 FCRA § 624(a)(4)(A).
17 149 Cong. Rec. E2515 (daily ed. Dec. 8, 2003).
18 FCRA § 624(a)(4)(C) (emphasis added).
19 Security of Personal Financial Information: Report on the Study Conducted Pursuant to Section 508 of the Gramm-Leach-Bliley Act of 1999, Secretary of the Treasury Department 54 (June 2004).
20 69 Fed. Reg. at 42,507.
21 FCRA §§ 624(a)(1), (a)(4)(A).
22 FCRA § 624(d)(2).
23 Proposed § .3001)
24 Proposed § .3(m)(2).
25 Proposed § .3(m)(3).
26 69 Fed. Reg. at 42,508.
27 Id.
28 Id.
29 69 Fed. Reg. at 42,505.
30 Id at 42,508.
31 Id
32 69 Fed. Reg. at 42,509.
33 Id.
34 FCRA § 624(b).
35 See, e.g., proposed §§ .20(a), .20(b), .22(a), _.26(a).
36 69 Fed. Reg. at 42,507.
37 FCRA § 624(a)(2)(B)
38 69 Fed. Reg. at 42,505. |
