The ICBA also recommends that the statutory flexibility for
providing notices be restored to the final rule by allowing the notice to
come from either the company that discloses the information or the affiliate that receives it.
To
avoid confusion and other problems, the ICBA urges the agencies not to adopt
the concept of “constructive sharing.” And, the final rule should
eliminate other restrictions or qualifications not included in the statute,
as more fully explained below.
Including examples and model forms in the final rule is a helpful step, especially
for community banks, and will help alleviate the compliance burden. However,
the ICBA strongly encourages the agencies to allow sufficient time for companies
to comply with the requirements, especially since there are a great many regulatory
changes involved that will affect computer programming, employee training and
other changes to policies and procedures.
Scope and Examples
As noted above, section 624 of the FCRA limits the permissible
activities of an affiliate that receives “eligibility information.” Specifically,
an affiliate that receives eligibility information cannot use that information
to make a solicitation for marketing purposes unless the consumer receives
a notice and opportunity to opt out of receiving such solicitations. The
proposal would apply to any entity that shares information with affiliated
persons that
is used to make or send marketing solicitations.
The agencies have proposed to apply certain responsibilities
to both the “communicating
affiliate,” i.e., the company that shares information about a consumer,
and the “receiving affiliate,” i.e., the company that receives
the information and that would then use that information to market to consumers.
According to the proposal, it would be the responsibility of the communicating
affiliate to provide the notice to consumers, although an agent, including
the receiving affiliate, could provide the notice. The ICBA believes that
it would be simpler and less confusing to revise this approach slightly.
Instead
of requiring the communicating affiliate to provide the notice, the ICBA
recommends that the final rule allow either affiliate to provide the notice.
As a practical
matter, it will most likely be the communicating affiliate that does furnish
the notice. However, by not creating a restriction and allowing companies
flexibility for providing the notice will not detract from consumer protection.
Eliminating
the requirement that the communicating affiliate be responsible for providing
the notice will help alleviate regulatory burden. The critical element is
that the consumer receives the notice, not which company provides it.
The proposal also offers examples of how the rule applies. While these examples
are not exclusive, the FTC and the five banking regulatory agencies provide
that compliance with one of the examples to the extent applicable will constitute
compliance with the rule, but the SEC qualifies this safe harbor by suggesting
that compliance will depend on the surrounding facts and circumstances. The
ICBA believes that the agencies should all be consistent and specify that compliance
with one of the examples should constitute compliance with the rule. We also
encourage the agencies to include the examples in the final rule.
Definitions
Affiliate. The proposal would define an “affiliate” as “any
person that is related by common ownership or common corporate control with
another person.” Existing banking regulations define an affiliate as
another company that controls, is controlled, or is under common control
with a member bank,2 and the banking agencies have applied this same definition
to
the information sharing provisions under the GLBA privacy rules.3 Since GLBA
privacy notices and FCRA information sharing notices may be combined, it
would be less confusing, simpler and less burdensome to use one consistent
definition,
and the ICBA recommends the application of the existing definition used by
the banking agencies since that definition is already widely accepted.
Clear and Conspicuous. When providing consumers with notice
about information sharing and the right to opt out, the proposal requires
the notice to be “clear
and conspicuous.” This would be defined as “reasonably understandable
and designed to call attention to the nature and significance of the information
presented.” Supplemental guidance would outline what would be considered “clear
and conspicuous.”
At the outset, it is worth noting that this approach is virtually
identical to the definition that the Federal Reserve recently proposed for
use in five
separate consumer protection regulations under its purview, e.g., Truth-in-Lending
(Regulation Z), Truth-in-Savings (Regulation DD), and Equal Credit Opportunity
(Regulation B). The Federal Reserve approach was modeled on existing language
in its Regulation P, the regulation that implements the GLBA privacy provisions.
The ICBA expressed a number of concerns about the Federal Reserve’s proposal.
Primarily, our concerns were prompted by the potential that courts might construe
the Federal Reserve’s “clarification” as a distinct and
new approach that imposed new requirements for disclosures. We raised concerns
that the change would mandate extensive review of procedures, forms and training
manuals to ensure that existing operations complied with the new definition.
At that time, the ICBA urged the Federal Reserve to review definitions on
a
case-by-case basis as it reviewed individual regulations. Subsequently, the
Federal Reserve withdrew its proposal.
While the ICBA is a firm proponent of consistent regulatory
definitions where possible, we also recognize that there may be situations
where factors other
than consistency and simplicity come into play. This is one of those times.
One of the key distinctions between the FCRA and GLBA is that the FCRA contains
expanded enforcement provisions, including the right of private action, and
therefore expands potential liability beyond what is covered by GLBA. It
is not unrealistic to anticipate that consumer representatives may try to take
advantage of the differences in what reasonable minds believe constitutes “clear
and conspicuous” to bring suit. Therefore, the ICBA urges the agencies
to issue a Q&A or non-exclusive examples to provide guidance on what constitutes “clear
and conspicuous” and making it clear that compliance with one of these
examples constitutes compliance with the rule.
Eligibility Information. The proposed rule would
create the concept of “eligibility
information.” Generally, as defined by the proposal, eligibility
information would be any information that would be considered a “consumer
report”4 absent
one of the exceptions in FCRA section 603(d)(2)(A). While the ICBA agrees
with this approach, we are concerned that the definition proposed for the
affiliate
marketing rule may be unnecessarily complex and difficult to apply due
to the cross-references. To simplify the application of the definition
and to facilitate
compliance without the need for cross-references, the ICBA recommends that
the final rule take one additional step and define “eligibility information” using
the existing statutory elements as follows: “eligibility information
is any information that bears on a consumer’s credit worthiness,
credit standing, credit capacity, character, general reputation, personal
characteristics,
or mode of living which is used or expected to be used or collected in
whole or in part for the purpose of serving as a factor in establishing
the consumer's
eligibility for credit or insurance to market products and services for
personal, family or household purposes to that person.”
Pre-Existing Business Relationship. A critical
definition in the proposed rule is “pre-existing business relationship.” If
the consumer has a pre-existing business relationship with the “receiving
affiliate,” the
statute creates an exception from the restrictions on marketing and solicitation.
The proposal, tracking the statutory definition, would define a pre-existing
business relationship as one where there is (a) a financial contract between
the company and a consumer which is in force; (b) the purchase, rental,
or lease by the consumer of the company’s goods or services, or
a financial transaction (including holding an active account or a policy
in force or having
another continuing relationship) between the consumer and the company during
the 18-month period immediately preceding the date on which the consumer
is sent a solicitation; (c) an inquiry or application by the consumer
regarding
a product or service offered by the company during the 3-month period immediately
preceding the date on which the consumer is sent a solicitation covered
by this section.5 The ICBA agrees that it is appropriate
to incorporate the statutory language in the final rule. However, the
proposal omits the statutory language
that applies the pre-existing business relationship to a company or the
company’s
agent. The ICBA believes that this omission should be corrected in the
final rule, and that Congressional language that applies to agents should
be restored.
In the preamble discussion of pre-existing business relationship,
it is stated that an inquiry from a consumer must logically indicate that
the consumer
anticipates receiving information about products or services from the affiliate
and therefore
would not include instances where the consumer does not provide contact information.
The ICBA believes that this language should be eliminated as an unnecessary
and possibly confusing qualification. More important is the guidance in the
preamble that the consumer should “reasonably expect to receive information
from the affiliate about its products or services.” The ICBA recommends
that the final rule follow the statutory language.
Solicitation. As revised by the FACT Act, the FCRA prohibits
an affiliate from using “eligibility Information” to solicit a consumer for
marketing purposes unless the consumer receives a notice and opportunity to
opt out. The proposed definition of a “solicitation” generally
restates the statutory definition, including the exclusion for marketing aimed
at the general public. The ICBA agrees it is appropriate to exclude marketing
and advertising aimed at the general public that is not made using “eligibility
information,” and urges this be included in the final rule.
Affiliate Use of Eligibility Information for Marketing
As noted, the FACT Act prohibits the use of eligibility information for consumer
solicitation unless the consumer has received a notice and an opportunity to
opt out. However, the statute does not specify which party must furnish the
notice. As a result, the statute allows either the affiliate disclosing the
information or the affiliate receiving the information to provide the notice.
This flexibility permits companies and their affiliates to communicate with
consumers in the most logical and effective way given the particular circumstances.
The proposal, on the other hand, would require the company disclosing the information
to provide the notice and opportunity to opt out. While many companies will
chose to provide notice this way, the ICBA recommends that the final rule eliminate
this requirement since it was not included in the statute. Rather, companies
should be permitted to make their own assessment about how best to communicate
with consumers based on existing customer relationships.6
Constructive Sharing. The agencies are considering creating
the concept of “constructive
sharing” to further outline application of the restrictions on affiliate
marketing. As proposed, constructive sharing would take place if Affiliate
A asks Affiliate B to market Affiliate A’s product or service to Affiliate
B’s customers based on certain criteria. It is important to recognize
that Affiliate B does not share any eligibility information about any customers
with Affiliate A. However, if a consumer responds to the solicitation, then
Affiliate A may be aware that the customer met the defined eligibility criteria.
The proposal would characterize this as “constructive sharing.”
The ICBA believes that this interpretation goes beyond the
plain meaning of the statute, has the capacity to create confusion and unnecessary
regulatory
burden, and places an unnecessary restriction on working relationships between
affiliated companies. The ICBA strongly recommends the concept of “constructive
sharing” not be included in the final rule. First, no information about
consumers is actually shared between the companies. It is only when the consumer
responds to the solicitation that the first company would have any knowledge
about the eligibility of the consumer. Second, and more important, it is
the consumer who voluntarily initiates communication, and consumer initiated
communications
are otherwise exempt from the affiliate marketing restrictions by the statute.
Form of Notice. The statute merely requires that a consumer be given notice
and an opportunity to opt out before information shared among affiliates is
used for marketing purposes. There is nothing in the statute that specifies
the notice must be in writing. While it is logical that most companies will
furnish a written notice to demonstrate compliance, especially community banks
that are subject to regular supervision and examination, the ICBA does not
believe it is necessary to include a written notice requirement in the final
rule. Moreover, there may very well be circumstances, e.g., instances of telephone
communication, when an oral notice is in the best interests of the consumer.
Creating a restriction that is not included in the statute places an unnecessary
restriction on customer service and may work to the detriment of consumers.
Moreover, since technology is rapidly evolving and changing, this restriction
may become a barrier to improved customer service in the future absent a revision
to the rule.
General Duties of an Affiliate Receiving Eligibility Information
The proposal provides that an affiliate that receives eligibility information
may not use the information to solicit or market to a consumer unless the consumer
has received the requisite notice and opportunity to opt out. The ICBA agrees,
but also recommends that the final rule add language that allows the affiliate
that receives the information to rely on a statement by the affiliate communicating
the information that the consumer was given the notice and opportunity to opt
out.
Exceptions and Examples of Exceptions
Pre-Existing Business Relationship. As noted above, the proposal
would not apply if the affiliate that receives the eligibility information
about a
consumer has a pre-existing business relationship with the consumer. Subject
to our
comments above about the definition of “pre-existing business relationship,” the
ICBA believes that this exception is appropriate and should be retained in
the final rule.
Service Providers. A second exception from the application of the rule would
apply to service providers as long as the service provider is acting in the
shoes of the company that would otherwise be soliciting or marketing to a consumer.
However, the service provider could not then turn around and use the eligibility
information for other purposes. This is consistent with provisions in the GLBA
privacy rule. Since many community banks rely on service providers, this is
an important exception that should be retained in the final rule.
Communications Initiated by the Consumer. In accordance with
the statutory language, a third exception applies to marketing that is the
result of a
communication initiated by the consumer. However, the proposal adds a qualification
that
the communication from the consumer must be initiated orally, electronically,
or in writing. While this will cover virtually all communications, the ICBA
believes it would be better to state “whether” initiated orally,
electronically or in writing since that allows additional flexibility.
In the preamble to the proposed rule, additional language suggests that
further qualifications are intended. Specifically, the exception is restricted
to a
use of eligibility information that is responsive to the consumer’s
communication. For example, if a consumer calls an affiliate to ask about
retail locations
and hours, the affiliate may not then use eligibility information to make
solicitations to the consumer about specific products. The ICBA believes
that, while this
restriction may be well intentioned, it creates a vague standard that is
difficult to apply and subject to differing interpretations. Therefore, we
urge that
it not be included in the final rule.
Solicitations Authorized or Requested by the Consumer. Another
exception applies to solicitations authorized or requested by the consumer,
and the
ICBA supports this provision. However, the proposed rule adds an additional
qualification
requiring that these consumer communications be “an affirmative authorization
or request by the consumer orally, electronically, or in writing to receive
a solicitation.” The agencies also explains in the preamble that a
pre-selected check box or boilerplate language in a disclosure or contract
would not be
sufficient for an affirmative authorization or request. The ICBA believes
that this may unnecessarily restrict customer service and may be contrary
to consumer
interests, especially the provision that bars a consumer from simply checking
a box to request additional information. This adds an unnecessary qualification
to the exception that we recommend be deleted from the final rule.
Contents of Opt-Out Notice
The FACT Act specifies that the requisite notice must disclose
to the consumer that information may be shared among affiliates for the purpose
of making
solicitations to the consumer and then allow the consumer an opportunity and
simple method
to opt out of receiving such solicitations. The notice must be “clear,
conspicuous, and concise,” but it may provide the consumer with a menu
of options. Moreover, this notice may be coordinated and consolidated with
any other notice that is required under another provision of law. Specifically,
Congress intended that companies be allowed to combine this notice with the
privacy notices required by GLBA.
The ICBA does not object to the provisions of the proposal regarding the
notice. The ICBA also applauds the agencies for creating model notices that
companies may use since many community banks rely on such model notices for
required disclosures.
Reasonable Opportunity to Opt Out
Generally, consumers must be given a reasonable opportunity to opt out before
an affiliate can use eligibility information to market its products or services
to that consumer. The examples suggest that 30 days would be an appropriate
period of time in many instances. While these examples parallel those in the
GLBA privacy rules, past experience has suggested that regulators and others
are likely to use the 30 days set forth in the examples as a presumption that
the 30 days is a minimum requirement. Therefore, it is important that the final
rule clearly provide that, while 30 days is evidence of a reasonable period,
it is not intended to establish a de facto minimum.
Disclosure of Length of Time the Consumer Has to Opt
Out. The agencies asks
whether the notice should include a disclosure of how long a consumer has to
respond. Since the statute and the proposal allow consumers to opt out at any
time, the ICBA does not believe such a disclosure is necessary and would actually
be counter-productive by adding unnecessary language. First, the proposal requires
the notice to be concise, and since there is no time limit on when consumers
may respond to the notice, including superfluous language specifying a time
limit only detracts from the brevity of the notice. Second, including a time
limit in the notice may serve to confuse consumers who believe that after the
time specified has passed they can no longer exercise the right to opt out.
Reasonable and Simple Methods of Opting Out
The FACT Act requires that any method given to consumers to
opt out should be “simple.” The proposal further qualifies this
requirement by specifying that the method be both simple and reasonable and
then gives
examples
of means that meet the regulatory standard, such as designating check-off
boxes in a prominent position on relevant forms. The proposal also furnishes
examples
of mechanisms that do not satisfy the standard, such as requiring the consumer
to write his or her own letter opting out.
The ICBA appreciates the use of the examples in the proposal,
as they offer guidance for community banks to comply with the requirements.
However, we
also believe it is important for the final rule to stress that these are examples
and not mandates, nor are the examples exclusive means to comply with the
rule’s
requirements. And, similar to provisions in the GLBA privacy rules, the ICBA
recommends that the final rule specify that when a company furnishes customers
with a reasonable and simple method to opt out, the company is then not required
to honor opt outs through other mechanisms. This will facilitate compliance,
reduce costs and burdens, and obviate potential confusion about whether a
form of opt out not offered by the company is sufficient.
Duration and Effect of the Opt Out
The FACT Act specifies that once a consumer has opted out,
the election must be effective for at least five years beginning on the date
on which the election
is received unless the consumer revokes the election. The proposal also provides
that an opt out is effective for five years, beginning as soon as reasonably
practicable after the consumer’s opt-out election is received.
However, the proposal elaborates on the effectiveness of an
opt out by providing that the opt-out continues indefinitely if the customer
relationship terminates
while the opt-out is in effect. The ICBA disagrees with this approach and
believes it will cause costly and confusing difficulties for administration
and compliance.
It would be more appropriate and less confusing to all concerned – including
consumers – if the final rule specifies that the five-year minimum applies
in all instances, even if the company’s relationship with the consumer
is terminated. That will avoid the need for companies to track opt-out elections
indefinitely for consumers with which they no longer have a relationship.
Moreover, after five years, information a company has on file is likely to
be stale and
of minimal use for marketing purposes.
Effect of Opt Out. The agencies explain in the preamble to the proposal that
an opt-out is tied to the consumer and not the information. As a result, if
a consumer opted out but does not renew the opt-out at the end of the five
year period, an affiliate may use eligibility information to market to that
consumer, even if the information was received while the opt out was in effect.
The ICBA believes this is a logical approach and encourages that it be retained
in the final rule.
Time to Implement the Opt Out. The ICBA recommends that the
final rule incorporate a provision similar to those in the GLBA privacy rules
that allow a company
a reasonable period of time to implement a consumer’s election to opt
out before it becomes effective. Incorporating such a provision in the final
rule will help to eliminate confusion.
Extension of an Opt Out
While the FACT Act specifically permits the affiliate marketing notice to
be combined with the GLBA privacy notice, the proposal adds an additional provision
that would make that difficult if not impossible. While companies may allow
an opt-out election to be permanent, if the opt-out expires at the end of the
statutory five-year period, then a company would have to provide a consumer
with a special extension notice. Unlike the normal notice, an extension notice
would have to specifically inform the consumer that his or her existing opt-out
is about to expire and disclose that the consumer may extend this notice.
This provision makes it virtually impossible to allow
companies to combine the GLBA privacy notice with the affiliate marketing
notice, contrary to Congressional
intent. And, compliance with the proposed elements of an extension notice
would be an expensive proposition where the costs of administration are
likely to
far outweigh any limited benefits to the consumer. Creating a special notice
will demand new procedures for this one notice, including new software,
forms, policies and procedures and employee training. The ICBA believes
that this
unnecessarily complicates the administration of and compliance with the
rule. Instead, the ICBA recommends that the final rule not require a
special notice
or an extension of an opt-out.
Model Forms
As noted above, the proposal includes a number of model forms that community
banks may use to provide consumers with the necessary notice. While these forms
are not mandatory, use of the forms evidences compliance with the notice requirements.
Since many community banks rely on model forms to comply with regulatory requirements,
the ICBA applauds the agencies for developing them as templates that companies
may use. The ICBA also encourages the agencies to include the safe harbor for
companies the elect to use the model forms.
Effective Date
The FACT Act requires the agencies to issue a final rule by September 4, 2004
that must take effect no later than six months after it is issued. The agencies
ask if there is a need to delay the compliance date to permit financial institutions
to incorporate the affiliate marketing notice in their next annual GLBA privacy
notice, a consideration that the statute also requires the agencies to take
into account in promulgating the final rule.7
The ICBA believes that additional time will be necessary to allow companies
to comply with the final rule, especially since it will take time for the all
the agencies involved to coordinate comments and issue a final rule. And, because
it is likely that companies will have to make extensive changes to policies
and procedures to comply, it will be extremely important that the final rule
permit ample time for compliance. We recommend that companies be given one
year to comply once the final rule has been published.
Conclusion
The ICBA believes that the proposed rule generally reflects the statutory
language. However, as noted above, several adjustments should be made in the
final rule that better reflect both the statutory language and Congressional
intent. The ICBA recommends these changes be incorporated in the final rule
to eliminate unnecessary confusion for both consumers and community banks,
retain statutory flexibility for communications with customers, and reduce
unnecessary regulatory burden.
Thank you for the opportunity to comment. If you have any questions or would
like any additional information, please contact me by telephone at 202-659-8111
or by e-mail at robert.rowe@icba.org.
