MASTERCARD INTERNATIONAL
May 28, 2004
Robert E. Feldman
Executive Secretary
Federal Deposit Insurance Corporation
550 17th Street, NW
Washington, DC 20429
Public Information
Room
Office of the Comptroller of the Currency
250E Street, SW
Mail Stop 1-5
Washington, DC 20219
Attention: Docket No. 04-09
Becky Baker
Secretary of the Board
National Credit Union Administration
1775 Duke Street
Alexandria, VA 22314
Jennifer J. Johnson Secretary
Board of Governors of the Federal Reserve System
20th Street and Constitution Avenue, NW
Washington, DC 20551
Attention: Docket No, R.-1188
Regulation Comments
Chief Counsel's Office
Office of Thrift Supervision
1700 G Street, NW
Washington, DC 20552
Attention: Docket No. 2004-16
To Whom It May Concern:
MasterCard
International Incorporated ("MasterCard")1
submits this comment letter in response to the Proposed Rule ("Proposal")
issued by the Board of Governors of the Federal Reserve ("Board"),
the Office of the Comptroller of the Currency, the Federal Deposit
Insurance Corporation, the National Credit Union Administration,
and the Office of Thrift Supervision (collectively, "Agencies")
implementing Section 411 of the Fair and Accurate Credit Transactions
Act of 2003 ("FACT Act"). MasterCard appreciates the opportunity
to provide its comments on this important issue.
Background
Section 411(a)
of the FACT Act adds a new Section 604(g)(2) to the Fair Credit
Reporting
Act ("FCRA") to prohibit creditors
from obtaining or using medical information pertaining to a consumer
in connection with any determination of the consumer's eligibility,
or continued eligibility, for credit. The Agencies must prescribe
regulations that permit creditors to obtain or use medical information
for eligibility purposes where necessary and appropriate to protect
legitimate operational, transactional, risk, consumer, and other
needs, consistent with the congressional intent to restrict the use
of medical information for inappropriate purposes.
Section
411(b) of the FACT Act adds a new Section 603(d)(3) to the FCRA to
restrict
the
sharing of medical information and related lists
or descriptions with affiliates. In particular, Section 603(d)(3)
states that the statutory exclusions to the definition of a "consumer
report" provided in Section 603(d)(2) do not apply if medical
information or certain related lists is disclosed to an affiliate.
The effect of Section 603(d)(3) is that medical information that
otherwise meets the statutory definition of a "consumer report" may
not be shared among affiliates, unless certain exceptions apply,
including for disclosures in connection with the business of annuities
or disclosures for any purpose permitted without authorization under
certain regulations issued pursuant to the Health Insurance Portability
and Accountability Act of 1996. In Section 604(g)(3)(C) of the FCRA
Congress authorized the Agencies to provide additional exceptions
by regulation or order.
In General
The Proposal reflects careful consideration and thorough review
by the Agencies. The Agencies have addressed a complicated issue
and developed a Proposal that, for creditors within the stated scope
of the Proposal, generally preserves the ability to obtain and use
medical information for credit eligibility purposes where necessary
and appropriate to protect legitimate operational, transactional,
risk, consumer, and other needs, as intended by Congress. There are
a number of issues raised by the Proposal, however, that merit further
review. Perhaps most importantly, the Proposal creates uncertainty
regarding those entities that are not within the stated scope of
the Proposal. This issue as well as several others are addressed
below.
Purpose and Scope ( .1)
Each
of the Agencies has addressed the scope of its respective Proposal.
Generally speaking, each of the Agencies asserts that the scope
of its Proposal applies only to entities subject to that Agency's
jurisdiction (including certain affiliated entities in some circumstances).
For example, the Proposal would apply to a variety of creditors
that are banks or federally chartered credit unions. The Proposal
would not, however, appear to apply to a wide variety of finance
companies or other creditors, such as auto dealers, loan brokers,
or other arrangers of credit. We do not believe this was the congressional
intent and we urge the Agencies to broaden the scope of the final
rule ("Final Rule") to encompass all creditors.
Section
603(g)(2) generally states that, "[e]xcept as permitted
pursuant to...regulations prescribed under paragraph (5)(A), a creditor
shall not obtain or use medical information...pertaining to a consumer
in connection with any determination of the consumer's eligibility,
or continued eligibility, for credit." In paragraph (5)(A) of
Section 603(g), Congress then provided that "[e]ach Federal
banking agency and the National Credit Union Administration shall...prescribe
regulations that permit transactions under [Section 603(g)(2)] that
are determined to be necessary and appropriate to protect legitimate
operational, transactional, risk, consumer and other needs...consistent
with the intent...to restrict the use of medical information for
inappropriate purposes." Based on this provision, each of the
Agencies has set forth a Proposal that applies only to certain creditors.
This appears to create the possibility that creditors that are not
within the Agencies' stated scope will not be permitted to rely on
the Final Rule adopted by the Agencies. This will essentially eliminate
the ability of such creditors to underwrite loans without fear of
violating the FCRA and subjecting themselves to private rights of
action, including class action.2 We do not believe
that Congress intended such a result. In this regard, the plain language
of Section
603(g)(5)(A)
states that the Agencies "shall prescribe regulations that permit
transactions" in those circumstances where the transactions "are
determined to be necessary and appropriate to protect legitimate...needs...." This
language appears to direct the Agencies to adopt regulations permitting
transactions in those circumstances where the "necessary and
appropriate" standard has been met. This language, on its face,
is not limited in any way with respect to the types of entities covered
by the regulations. As a result, the regulatory directive to the
Agencies appears to authorize, and perhaps even require, the Agencies
to promulgate a rule covering any transaction where the "necessary
and appropriate" standard is met regardless of the types of
entities involved in those transactions.
We
also note that the specific drafting of other provisions of the FACT
Act
and the FCRA
strongly suggests that Congress did not intend
to exclude any subset of entities from the scope of the Agencies'
rules. In this regard, the language used to grant rulemaking authority
to the Agencies in Section 603(g)(2) stands in stark contrast to
rulemaking authority granted to federal agencies in other portions
of the FACT Act and the FCRA where the scope of those rulemakings
clearly was intended to be limited along jurisdictional lines. For
example, in Section 604(g)(3)(C), Congress granted rulemaking authority
to the Agencies and the Federal Trade Commission ("FTC")
but made it clear that such authority was granted only "with
respect to
any financial institution subject to the jurisdiction of such
agency." In Section 214(b) of the FACT Act, Congress granted
rulemaking authority to the Agencies and the FTC with respect to
the new affiliate marketing provisions, but limited the applicability "to
entities that are subject to their respective enforcement authority
under Section 621" of the FCRA. Indeed, Section 621(e) of
the FCRA grants broad rulemaking authority to the Agencies, but
limits the scope of the rules to certain persons subject to the
Agencies' jurisdiction.
In contrast,
we also note that the approach taken in Section 603(g)(2) and (5)(A)
appears
to be quite similar to the approach Congress traditionally
has taken when granting rulemaking authority in federal statutes
regulating consumer credit and other consumer financial services.
For example, in the Truth in Lending Act, the Electronic Fund Transfer
Act, and the Equal Credit Opportunity Act (collectively, the "Acts"),
Congress granted rulemaking authority to a single federal agency—the
Board—and the regulations promulgated by the Board apply to
all of the entities covered by the Acts, regardless of whether those
entities are subject to the Board's jurisdiction. Each of the Acts
then divides enforcement authority among several federal agencies
based on their respective, limited jurisdictions. Thus, the approach
taken in the Acts is to grant rulemaking authority to a particular
agency, have that rulemaking authority apply with respect to all
entities covered by each Act, and then limit enforcement authority
based on the respective jurisdictions of each of the agencies assigned
to enforce the statute. This appears to be essentially the same approach
used by Congress in enacting Section 603(g)(2). In this regard, Section
603(g)(2) grants rulemaking authority to the Agencies and existing
Section 621 of the FCRA divides enforcement responsibility among
the Agencies, the FTC, and others in much the same way as accomplished
under the Acts. The only difference between the approach taken in
Section 603(g)(2) and the more traditional approach taken in the
Acts is that Section 603(g)(2) assigns rulemaking responsibility
to multiple Agencies while the Acts assign rulemaking authority to
a single agency. There is no indication, however, that this difference
is intended to override the plain language directive to "permit
transactions" where those transactions are "determined
to be necessary and appropriate to protect legitimate...."
Just as importantly, we are unaware of any public policy goal that
is served by not applying the Final Rule to creditors that are not
within the jurisdiction of the Agencies. To the contrary, we believe
public policy generally, and consumers specifically, are ill served
if certain types of creditors are not permitted to use or obtain
medical information as a result of the narrow scope of the Final
Rule. Therefore, we urge the Agencies to broaden the scope of the
Final Rule to apply to all creditors. Should this occur, enforcement
against creditors outside the jurisdiction of the Agencies would
be handled as provided in the relevant provisions of the FCRA.
Examples
(§__.2)
The Proposal provides examples of certain compliant and noncompliant
activities. MasterCard believes that the use of examples provides
financial institutions with meaningful guidance on how to comply
with the Final Rule's requirements. Therefore, we urge the Agencies
to include relevant examples of permitted and prohibited uses of
medical information in the Final Rule.
Section §__.2
of the Proposal states that the examples are not exclusive, and that
compliance with an example, to the extent applicable,
constitutes compliance with the Proposal. We urge the Agencies to
retain this provision in the Final Rule. The examples provided by
the Agencies should serve as a safe harbor to financial institutions
seeking to comply with the Final Rule. Indeed, it would be inappropriate
to find an institution in violation of the Final Rule if the institution
were simply adhering to the Agencies' examples of permitted activities.
Definitions
(§__.3)
The Proposal establishes several definitions which appear to have
a general applicability, not only to the Final Rule, but also to
other provisions of the FCRA. It is important that any such definition
be reviewed and analyzed to ensure that it is appropriate not only
in the context of the Proposal, but other applicable provisions of
the FCRA as well.
Affiliate/Control
The Proposal
defines the term "affiliate" as "any
company that controls, is controlled by, or is under common control
with another company." The proposed definition is identical
to the definition of "affiliate" in the regulations implementing
Title V, Subtitle A of the Gramm-Leach-Bliley Act ("GLBA"). "Control" is
defined to mean: (i) direct or indirect ownership, control, or power
to vote 25 percent or more of the outstanding shares of any class
of voting security; (ii) control over the election of a majority
of the directors, trustees, or general partners; or (iii) the power
to exercise, directly or indirectly, a controlling influence over
the management or policies of the company. MasterCard believes these
definitions are appropriate and should be retained in the Final Rule.
Medical Information
The Proposal
provides a definition of "medical information" that
is consistent with the statutory language provided in Section 411
of the FACT Act and should be included in the Final Rule. We request,
however, that the Final Rule also clarify that information coded
in a manner consistent with Section 604(g)(1)(C) of the FCRA is not "medical
information" for purposes of the Final Rule. In this regard,
Congress provided specific consumer protections with respect to coded
tradeline data in consumer reports that may relate to a "medical
information furnisher." Such information does not meet the definition
of "medical information" included in the FCRA or in the
Proposal. Specifically, the coded information provides no insight
as to the consumer's physical, mental, or behavioral health or condition,
and therefore falls within a specific exception to the definition
of "medical information." Furthermore, in light of the
protections provided by Congress with respect to the coding of certain
information, we do not believe that any additional meaningful consumer
protections would be provided if such information were deemed to
be "medical information."
MasterCard also
believes it would be appropriate for the Agencies to provide clarification
that "medical information" must "relate
to" or "pertain to" a specific consumer. For example,
a database of information relating to the repayment behavior of thousands
of consumers, none of whom is personally identifiable, should not
be deemed to be "medical information." If such
information
were "medical information," creditors may have
difficulty in utilizing such data even for basic analytical purposes
that have no bearing or impact on any individual. We do not believe
this was the intent of Congress or the Agencies, and we urge the
Agencies to provide a clarification on this issue.
General
Prohibition on Obtaining or Using Medical Information (§__.30(a))
The Proposal
states that a "creditor may not obtain or use
medical information pertaining to a consumer in connection with any
determination of the consumer's eligibility, or continued eligibility,
for credit except as provided in" the Proposal.3 This language
tracks the statutory language in Section 604(g)(2) of the FCRA. We
commend the Agencies for using their discretionary authority to recognize
that there are circumstances where it is appropriate to obtain and/or
use medical information in connection with a determination of a consumer's
eligibility, or continued eligibility, for credit. We strongly urge
the Agencies to retain this approach in the Final Rule.
Eligibility, or Continued Eligibility, For Credit
The Proposal
provides for definitions of certain terms which apply only in the
Proposal.
One such term is "eligibility, or continued
eligibility, for credit," which is defined as applying to credit "offered,
primarily for personal, family, or household purposes." This
is consistent with longstanding interpretations of the FCRA4 and
should be retained in the Final Rule.
The Agencies
correctly note in the Supplementary Information that "[n]othing
in the statute prohibits a creditor from obtaining medical information
if the information is not obtained in connection with a determination
of the consumer's eligibility, or continued eligibility, for credit." MasterCard
agrees, and requests that the Agencies include similar language in
the Supplementary Information to the Final Rule. In light of the
exclusion from coverage by the statute (and therefore by the Final
Rule), the Agencies included in the Proposal activities that are
not included in the term "eligibility, or continued eligibility,
for credit." Specifically, the term does not include: (i) the
consumer's qualification or fitness to be offered employment, insurance
products, or other non-credit products or services; (ii) any determination
of whether the provisions of a debt cancellation contract, debt suspension
agreement, credit insurance product, or similar forbearance practice
or programs are triggered; (iii) authorizing, processing, or documenting
a payment or transaction on behalf of the consumer in a manner that
does not involve a determination of the consumer's eligibility, or
continued eligibility, for credit; or (iv) maintaining or servicing
the consumer's account in a manner that does not involve a determination
of the consumer's eligibility, or continued eligibility, for credit.
MasterCard appreciates the Agencies' clarification with respect to
certain items that are not related to credit eligibility. However,
MasterCard urges the Agencies to note that these exclusions are non-exclusive
examples of items that are not deemed to be "eligibility, or
continued eligibility, for
credit." We
also urge the Agencies to clarify that a creditor's determination
of a consumer's legal competency is not related to
eligibility for credit, but that it pertains to a determination of
the consumer's legal capacity.
MasterCard also
notes that the example with respect to debt cancellation contracts,
debt
suspension agreements, credit insurance products,
or similar forbearance practices or programs should be expanded beyond
what is provided in the Proposal. Specifically, the Proposal excludes
these items from the definition of "eligibility, or continued
eligibility, for credit" only with respect to whether such practices
or programs are "triggered." We believe that the more appropriate
approach would be to recognize that all issues related to debt cancellation
contracts and similar programs are not part of the consumer's "eligibility,
or continued eligibility, for credit." Indeed, not only are
such programs not related to a consumer's eligibility for credit,
but the Office of the Comptroller of the Currency has prohibited
a national bank from extending credit or altering the terms or conditions
of an extension of credit conditioned on the customer entering into
a debt cancellation contract or debt suspension agreement with the
bank.5 Therefore, MasterCard believes that issues related
to debt cancellation contracts and similar agreements or practices
fall outside
the scope of the prohibition on obtaining or using medical information.
Rule
of Construction: Unsolicited Medical Information (§__.30(b))
The Proposal acknowledges that creditors, in many instances, cannot
control the information they obtain with respect to a determination
of a consumer's eligibility for credit. For example, a consumer may
volunteer on an application, or in conversation with a loan officer,
that he or she has recently been ill.
We commend the Agencies for recognizing that creditors may receive
medical information on an unsolicited basis. In particular, the Proposal
states that a creditor does not obtain medical information for purposes
of the general prohibition on obtaining or using medical information
if the creditor: (i) receives medical information pertaining to a
consumer in connection with any determination of the consumer's eligibility,
or continued eligibility, for credit without specifically requesting
medical information; and (ii) does not use that information in determining
whether to extend or continue to extend credit to the consumer and
the terms on which credit is offered or continued. We believe the
Agencies should retain this provision in the Final Rule, with one
modification. In this regard, we believe consumers would benefit
if a creditor were permitted to use unsolicited medical information
in a manner no less favorable than it would use comparable information
that is not medical information. For example, this exception could
be useful in granting a consumer's emergency request that may involve
medical information.
Financial
Information Exception for Obtaining and Using Medical Information
(§__.30(c))
In addition to
receiving medical information on an unsolicited basis, creditors
may receive information that reflects on the consumer's
credit history or ability to repay a loan, but that is also medical
information. For example, a creditor may learn that a consumer owes
a debt
to a hospital. The creditor may need to use the fact that the consumer
owes a debt without regard to whether it is to a hospital or another
type of creditor.
The Proposal
addresses this type of situation. In particular, a creditor may
obtain and
use medical information pertaining to a consumer
in connection with any determination of the consumer's eligibility,
or continued eligibility, for credit so long as: (i) the information
relates to debts, expenses, income, benefits, collateral, or the
purpose of the loan; (ii) the creditor uses the medical information
in a manner and to an extent "that is no less favorable" than
it would use comparable information that is not medical information;
and (iii) the creditor does not take the consumer's physical, mental,
or behavioral health, condition or history, type of treatment, or
prognosis into account as part of any such determination.
We believe the
Agencies have taken the correct approach with respect to how creditors
may
use medical information in certain circumstances,
and urge that it be retained in the Final Rule. However, we believe
that the Agencies may be restricting the scope of the exception unnecessarily.
In particular, the Agencies limit the applicability of the exception
to those circumstances where the information relates to debts, expenses,
income, benefits, collateral, or the purpose of the loan. As a result,
the exception would not appear to apply if the information related
to other factors routinely used in credit underwriting, such as the
debtor's assets. In order to address this issue, we urge that the
exception included in the Final Rule be expanded to include information
that relates to "any other factor regularly used in credit eligibility
determinations." This would ensure that the exception covers
the full range of appropriate uses while also ensuring that consumers
are adequately protected. In particular, it is important to note
that the exception would only apply to the extent the creditor uses
the information in a manner and to an extent "that is no less
favorable" than it would use comparable non-medical information.
If the Agencies
determine that coded information reported by consumer reporting
agencies
should not be excluded from the definition of "medical
information," then the Agencies should clarify that coded information
about a medical debt received by a creditor from a consumer reporting
agency would be subject to the exceptions provided in Section .30(c).
Under this approach, the information would be "medical" but
the creditor should be permitted to take into account that the consumer
owes the debt so long as the creditor provides it no less favorable
treatment than other debts and the creditor does not take the consumer's
health, condition, history, treatment, or prognosis into account.
Specific
Exceptions for Obtaining, and Using Medical Information (§__.30(d))
There will be instances in which a creditor must obtain and use
medical information pertaining to a consumer in connection with a
determination of that consumer's eligibility for credit. For example,
if the creditor is financing a medical procedure, the creditor may
legitimately need information with respect to the procedure in order
to underwrite the loan. We applaud the Agencies for recognizing that
there are legitimate circumstances in which creditors must be permitted
to obtain and use medical information. These circumstances include
when the creditor is financing medical products or services, to prevent
and detect fraud, and if the consumer (or the consumer's legal representative)
requests in writing, on a separate form signed
by the
consumer (or the consumer's legal representative) that the creditor
use specific medical information for a specific purpose.
We believe the Agencies should retain this provision in the Final
Rule. If the Agencies do not exclude a determination of a consumer's
legal competency from the definition of "eligibility, or continued
eligibility, for credit," then we urge the Agencies to provide
an additional exception to allow a creditor to use medical information
for this purpose.
We urge, however,
that the Agencies consider a modification to the Supplementary
Information
regarding consumer consent. In particular,
the Supplementary Information states that the consent exception "is
designed to accommodate the particular medical condition or circumstances
of the individual consumer and is not intended to allow creditors
to obtain consent on a routine basis or as a part of loan applications
or documentation. This exception would not be met by a form that
contains a preprinted description of various types of medical information
and the uses to which it might be put." We do not believe this
interpretation is necessary and it may interfere with acceptable
practices. For example, a creditor that finances vision correction
procedures may wish to use pre-printed application forms, including
forms for obtaining consent. This type of practice appears to be
within the scope of those activities intended to be permitted by
the Agencies. The Supplementary Information, however, clouds the
issue. We therefore respectfully request the Agencies to delete this
statement from the Supplementary Information that is included with
the Final Rule or rewrite it to more precisely describe the practices
the Agencies intend to prohibit.
Limits
on Redisclosure of Information (§__.30(e))
The Proposal would restrict a person's ability to disclose to any
other person medical information it receives from a consumer reporting
agency or from the person's affiliate, except as necessary to carry
out the purpose for which the information was initially disclosed,
or as otherwise permitted by statute, regulation, or order. We urge
the Agencies to consider allowing a person to redisclose medical
information it receives in additional limited circumstances. For
example, a person should be able to redisclose medical information
it receives from a consumer reporting agency or an affiliate for
any purpose described in section 502(e) of the GLBA, such as for
fraud prevention or to a federal regulator, even if fraud prevention
or regulatory compliance were not among the specific reasons the
person obtained the medical information.
Sharing
Medical Information with Affiliates (§__.31)
Section 603(d)
of the FCRA sets forth the definition of a "consumer
report" and Section 603(d)(2) provides specific exceptions to
that definition. Under Section 603(d)(2), information that would
otherwise meet the definition of a consumer report is excluded from
the definition if such information is: (i) transaction and experience
information; (ii) a communication of transaction
and experience information among affiliates; or (iii) a communication
of other
information among affiliates if the consumer
is provided a notice and an opportunity to opt out. The FACT Act
amended the definition of "consumer report" by adding paragraph
603(d)(3) to provide that the exclusions from the definition of "consumer
report" do not apply with respect to information disclosed to
any affiliate if the information is: (i) medical information; (ii)
an individualized list or description based on the payment transactions
of the consumer for medical products or services; or (iii) an aggregate
list of identified consumers based on payment
transactions for medical products or services. Section 603(d)(3)
does not apply to disclosures: (i) in connection with the business
of annuities; (ii) for any purpose permitted without authorization
under certain regulations under the Health Insurance Portability
and Accountability Act; and (iii) as otherwise determined to be
necessary and appropriate by the FTC and the Agencies with respect to any financial institution subject to the jurisdiction
of such agencies, or applicable state insurance authority with respect
to persons engaged in providing insurance or annuities. In the Proposal,
the Agencies make it clear that Section 603(d)(3) also does not apply
to disclosures that are made for any purpose described in Section
502(e) of the GLBA, or in connection with a determination of a consumer's
eligibility, or continued eligibility, for credit consistent with
the Proposal. We believe these exclusions are appropriate and we
urge the Agencies to retain them in the Final Rule.
Once again, we
appreciate the opportunity to comment on the Proposal and we commend
the Agencies
for their thorough and thoughtful treatment
of this issue. If you have any questions concerning our comments,
or if we may otherwise be of assistance in connection with this issue,
please do not hesitate to call me, at the number indicated above,
or Michael F. McEneney at Sidley Austin Brown & Wood LLP, at
(202) 736-8368, our counsel in connection with this matter.
Sincerely,
Jodi Golinsky
Vice President and Senior Regulatory Counsel
_______________________
1 MasterCard is a SEC-registered private share corporation
that licenses financial institutions to use the MasterCard service marks in connection
with a variety
of payments systems.
2 For example, litigants could allege that a creditor that falls
outside the Agencies' scope violates the FCRA when it: (i) receives
medical information on an unsolicited basis; (ii) relies on scoring
models that take payment history, including payment history to hospitals
and similar creditors, into account; (iii) uses medical information
to comply with law.
3 These comments will use the term "creditor" to also mean "bank" as
provided in the Proposal issued by the Office of the Comptroller of the Currency.
4 See,
e.g., ¶ 3
F.R.R.S. 6-1630 ("[A] business transaction...is generally
beyond the scope of the [FCRA]."), and Statement of General
Policy or Interpretation; Commentary on the Fair Credit Reporting
Act, 55 Federal Register 18,804 at 18,810 and 18,811 (1990).
5 See 12 C.F.R. § 37.3(a).
|
