Citigroup
June
l, 2004
Robert
E. Feldman
Executive Secretary
Federal Deposit Insurance Corporation
550 17th Street, NW
Washington, DC 20429
Public Information
Room
Office of the Comptroller of the Currency
250E Street, SW
Mail Stop 1-5
Washington, DC 20219
Attention: Docket No. 04-09
Becky Baker
Secretary of the Board
National Credit Union Administration
1775 Duke Street
Alexandria, VA 22314
Jennifer J. Johnson Secretary
Board of Governors of the Federal Reserve System
20th Street and Constitution Avenue, NW
Washington, DC 20551
Attention: Docket No, R.-1188
Regulation Comments
Chief Counsel's Office
Office of Thrift Supervision
1700 G Street, NW
Washington, DC 20552
Attention: Docket No. 2004-16
RE: FACT Act, Section 411: Medical Information
Dear Banking Agencies:
Citigroup appreciates
the opportunity to comment on the proposed rule implementing Section
411 of the Fair and Accurate
Credit Transactions
Act of 2003 ("FACT Act"). The proposed rule provides for
certain exceptions to the provisions of Section 411 that restrict the
inappropriate use of medical information in the credit process.
Section 411(a)
of the FACT Act adds a new Section 604(g)(2) to the Fair Credit Reporting
Act ("FCRA") to prohibit creditors
from obtaining or using medical information in connection with any
determination of a consumer's eligibility, or continued eligibility,
for credit. Section 411(b) adds a new Section 603(d)(3) to FCRA to
restrict the sharing of information with affiliates. Both of these
provisions have the potential to have a significant adverse impact
on various Citigroup businesses, and Citigroup commends the Banking
Agencies ("Agencies") for ably balancing the protections
these sections provide to consumers with the needs of creditors to
obtain, use and share certain types of medical information in a manner
consistent with such consumer protections.
Timing of the Rule
The Agencies have requested comment on the possible effective date
of the proposed rule, suggesting 90 days after the proposed rule is
adopted as final. The most important principle with respect to timing
is the linkage of the statutory prohibition and the regulation's exceptions.
If the statute, Section 411 of the FACT Act, is effective June 4, 2004,
the proposed rule granting exceptions to the statutory prohibition
should become effective on that date, as well. While ordinarily it
is preferable to have a delayed effective date for a new regulation
to permit the regulated entities time to establish the internal policies
and procedures necessary to comply, in this case it is important to
link the effective dates of the prohibition and the exceptions.
To allow the time necessary to understand final rule, to adjust practices
in multiple businesses, and to write policies and procedures, Citigroup
believes both Section 411 both the statutory provision and the proposed
rule should become effective a minimum of 90 days after the proposed
rule becomes final. Citigroup must apply this new analysis of what
constitutes medical information and how it is used across multiple
business lines and scores of legal entities.
It must apply the new regulation to a credit card business with in
excess of 80,000,000 US accounts, to the nation's fifth largest prime
mortgage originator and fifth largest servicer, to a significant auto
finance business, a non-bank finance company, and 10 depository institutions,
as well as a debt cancellation business. To locate all possible entry
points for medical information and provide appropriate safeguards at
each point is a task requiring weeks and months of preparation. Nevertheless,
enforcement of the Agencies of the statutory prohibition without the
exceptions would be more damaging for such businesses and burdensome
for Citigroup to administer.
Scope of the Proposed Rule
Since the proposed rule is designed to provide reasonable exceptions
to the general prohibitions on obtaining, using or sharing medical
information with affiliates, it should be applicable to all kinds of
creditors so as to preserve a level playing field for all competitors.
As a general matter, the provisions of FCRA and the FACT Act, and,
in particular, Section 411 of the FACT Act, apply to a range of creditors
that is greater than those benefiting from the proposed regulation.
There is a wide
range of "creditors" that
make use of consumer credit reports that are not regulated by the
Banking Agencies.
Although Citigroup
believes that all of its subsidiaries would be "institutions
covered" as defined in the proposed regulation, it is not good
public policy to treat similar companies differently under the FACT
Act prohibition and the proposed regulation simply on the basis of
their status as subsidiaries of a bank holding company. Moreover, Citigroup
purchases loans from mortgage companies, auto dealers, brokers and
other lenders that would not be able to use financial information that
is also medical information that Citigroup and other banking organizations
consider to be critical to the credit process. To the extent that the
quality of the loans of these sellers of loans is impaired by incomplete
information, it can prove damaging to banking organizations purchasing
these loans.
There are a number of actions the Agencies should take to clarify
the scope of the regulation. First, at a minimum, the Agencies should
expand the coverage of the proposed rule to any creditor that sells
its loans to a federally regulated depository institution. This will
help to preserve the credit standards of the depository institutions.
Second, Citigroup
believes that the Federal Reserve should explicitly state that all
bank holding company non-depository
subsidiaries are "institutions
covered" by the regulation, even functionally regulated subsidiaries
of a bank holding company. Thus, a state licensed and regulated finance
company, an insurance company or a broker/dealer are within the scope
of this rule, to the extent that they engage in credit activities that
come within the scope of those activities addressed by FCRA and the
FACT Act.
Third, the Agencies
should recognize that a particular "creditor" may
be subject to the provisions of this proposed regulation with respect
to a portion of its activities. For example, a broker/dealer may well
have medical information that it obtained pursuant to a legal obligation
of suitability in recommending investments and a requirement to know
the customer's risk profile. The use of medical information as part
of a suitability due diligence is beyond the scope of this proposed
rule and Section 411 of the FACT Act, which focuses on the credit granting
process.
Fourth, this regulation
applies to eligibility for credit "offered,
primarily for personal, family or household purposes." It does
not appear that this regulation would apply to a loan granted to the
sole proprietor of a business solely for the purpose of expanding the
inventory of a business. It is reasonable to ask, therefore, whether
a personal loan could at any point be so significant to a particular
lender that the lender should be permitted to inquire about the health
of the borrower. Is the $10 million loan to purchase a yacht or a private
plane within the scope of the protections intended to be provided by
Section 411. Is there not some concept that at some level the purpose
of the credit changes or the level of risk is so significant that it
shifts the balance of the need to protect the individual consumer attempting
to obtain credit?
Additional Definitions
Information
regarding death is not "medical information." The
definition of "medical information" in the proposed regulation
should be modified to exclude two additional types of information.
First, any information with respect to the death of a borrower or co-borrower
or guarantor should be excluded explicitly.
Coded information
is not "medical information." In
addition, coded credit report information, which would otherwise
meet the definition
of medical information, should be explicitly excluded from the definition.
With all identifying information concerning the provider eliminated,
the remaining information is merely evidence of a debt like any other
information. Nevertheless, the very existence of the code indicates
a debt owed to a medical provider of some sort. Without an explicit
exclusion and a clear statement that for all purposes of the FACT Act,
i.e., obtaining, using and sharing with affiliates, the encoded information
is not medical, there could be circumstances in which some would argue
that the residual information could be medical for some purposes. For
example, a very large balance due on an encoded entry could suggest
a significant medical issue of some sort. It could call into question
whether the amount of the balance alone was the basis for a denial
or whether the fact that it was to an encoded provider played a role.
Debt cancellation
should be an exception, not part of the definition of "eligibility ... for credit." The treatment of debt cancellation
and debt suspension contracts (DCC/DSA) in the proposal, although appropriately
outside of the scope of the prohibition on obtaining, using or transferring
medical information, suffers from two shortcomings. First, it permits
medical information to be used only when determining whether the contracts
are "triggered." It is implied that such information can
be used in determining eligibility, as well, because the provision
is excluded from the definition of "eligibility, or continued
eligibility, for credit." Nevertheless, use of medical information
to determine eligibility for DCC/DSA is not explicit.
DCC/DSA is a product
in which some of the critical protections provided relate to medical
condition. Every phase of
the product -- structuring,
contract terms, triggering events and often eligibility — can
involve medical conditions that presume customer disclosure of medical
information. The entire process should be exempt from the medical information
restrictions. Citigroup supports the proposal of the Financial Services
Roundtable and the informal coalition of depository institutions offering
DCC/DSA products that the Agencies create a specific exception to permit
the use of medical information "to determine the eligibility for,
the triggering of, and the reactivation of a debt cancellation contract
or a debt suspension agreement."
Indeed, the placement of DCC/DSA as an exception to eligibility for
credit is confusing and the second shortcoming of its treatment in
the proposed regulation. The placement suggests DCC/DSA products are
not included in the process of determining credit eligibility. This
has unfortunate overtones for the classification of these products
as credit products by federal banking regulators. See the regulations
of the Comptroller of the Currency, 12 C.F.R. Part 37. Indeed, there
is an argument to be made that credit insurance should be listed in
paragraph (A) of the
exception to the credit eligibility process along with offers to the
consumer
of "employment, insurance products, or other non-credit
products or services" rather than with DCCIDSA products and other
forbearance products. Certainly, in terms of the regulatory structure
of the products that would be appropriate.
Financial Exception for the Use of Medical Information
Citigroup supports
the approach of the Agencies in providing for a general exception
for financial information, that
is, information relating
to "debts, expenses, income, benefits, collateral or the purpose
of the loan, including the use of proceeds." Such information,
although it may involve a medical provider or contain ancillary medical
information, is primarily financial in nature and creditors should
be free to use it as they would any similar financial information.
Citigroup presumes that this list is meant to be illustrative rather
than exclusive. Financial information could include information on
liens filed, for example.
Citigroup believes
that the third of the three requirements of this financial information
exception should be modified to allow
more flexibility.
The basis of the exception is to require the creditor use the financial
information, which is also medical information, no less favorably than "comparable" financial
information that is not medical information. The proposal then departs
from this principle in the final requirement and bans any reliance
on the medial information component of this information. Citigroup
suggests that the restriction be on the use for the disadvantage of
the consumer. If a creditor discovers disability income as a source
of repayment for a proposed loan, why should it be precluded from granting
that loan in part because the loan can be sold easily in the secondary
market because the borrower qualifies for a special program of a secondary
market provider to assist disabled persons?
Citigroup proposes that the Agencies amend the third criteria, which
now requires the creditor to take no account of a consumer's medical
condition, to permit an exception for positive treatment or to assist
the customer. The exception as written would impede a creditor from
taking advantage of current and future programs that provide subsidies
or credits or other favorable treatment designed to assist qualifying
borrowers.
Unsolicited Information.
In the same vein, the proposal applies a rule of construction for
receipt of unsolicited information
that allows
a creditor to "obtain" unsolicited information if it does
not use the information. Such a regulation would protect the consumer
from the misuse of medical information but would impede the ability
of the creditor to use the information for the benefit of the consumer.
It would be better to prohibit the use of the information to deny,
condition or negatively impact the decision to grant credit or the
terms on which the credit is offered. In some cases, consideration
of the medical information allows the creditor to treat the customer
differently by providing access to the credit or favorable terms. Where
receipt of the information is inadvertent on the part of the creditor
and is not the focus of the transaction, there is no reason to remove
that information from the credit process in those cases where it assists
the consumer.
Specific Additional Exceptions
Citigroup supports the additional exceptions contained in subsection
(d) of Section .30. The Agencies have identified certain circumstances
in which the prohibition on the use of medical information conflicts
with other public policy objectives. Citigroup also commends the Agencies
for providing consumers with the ability to authorize the receipt,
use and sharing with affiliates of medical information on a case-by-case
basis.
Citigroup offers comments on several of these specific exceptions.
First, the use of medical information to determine whether use of a
power of attorney or legal representative is necessary and appropriate
should be expanded to include medical information to determine competency.
Perhaps that is implied in the exception for a determination of the
need for a legal representative, but it should be made explicit.
In addition, there should be an exception to permit the creditor to
receive medical information required to resolve a dispute directly
with a consumer. Since the FACT Act allows for this direct consumer/creditor
dispute resolution, the creditor should be free to receive and use
medical information to alter the terms of the credit or to take other
actions with respect to the granting of credit that will resolve the
dispute. The creditor ordinarily would convey this information to credit
bureaus with a request that it be included in consumer's credit report
to explain the dispute resolution. Such dispute resolution may be by
phone and may involve an issue of some sensitivity with the consumer.
The consumer often may not want to delay resolution while the consumer
writes a detailed letter to the creditor that conveys the information
and authorizes the use of the information to resolve the dispute and
for such other purposes as necessary.
This leads to the final comment on the exceptions. The Agencies have
faced again and again the issue of written customer consent. Generally,
they have made accommodations for telephone and electronic transactions.
The consumer authorization for the use of consumer information should
address these same concerns. As noted above, if the consumer provides
information by telephone or email to resolve a dispute or to explain
information on an application for credit or to ask for forbearance
due to a medical emergency, a provision that requires the consumer
to compose, sign and mail a letter does little to address the consumer's
objective in the time frame implied by the consumer through the consumer's
choice of contacting the creditor.
The Agencies should consider actions that they have permitted in other
situations: recording the consumer's oral authorization, unsigned email
or other electronic message, note in the customer file by the creditor's
representative, use of preprinted forms. In all cases, the consumer
will provide the information or will be told of the information provided
by a third party in order to authorize its use. If the customer chooses
to give approval through other than a written signature on a self-composed
authorization, the creditor should not be compelled to delay use of
the medical information as the consumer directs.
If the Agencies
desire additional information or clarification, please contact James
E. Scott, Senior Regulatory Counsel, at 212-559-2485.
Very truly yours
Carl V. Howard
General Counsel - Bank Regulatory
|