VISA
August 16, 2004
Robert E. Feldman
Executive Secretary
Federal Deposit Insurance Corporation
550 17th Street, NW
Washington, DC 20429
Attention: RIN 3064-AC73
Office of the Comptroller of the Currency
250 E Street, SW
Mail Stop 1-5
Washington, DC 20219
Attention: Docket No. 04-16.
Jennifer J. Johnson
Secretary
Board of Governors of the Federal
Reserve System
20th Street and Constitution Avenue, NW
Washington, DC 20551
Attention: Docket No. R-1203
Becky Baker
Secretary of the Board
National Credit Union Administration
1775 Duke Street
Alexandria, VA 22314
Regulation Comments
Chief Counsel's Office
Office of Thrift Supervision
1700 G Street, NW
Washington, DC 20552
Attention: No. 2004-31
Re: Fair Credit Reporting Act Affiliate Marketing Regulations
Ladies and Gentlemen:
This comment letter is submitted on behalf of Visa U.S.A. Inc. in
response to the. notice of proposed rulemaking ("Proposed Rule") and request
for public comment issued by the Board of Governors of the Federal Reserve
System ("FRB"), the Federal Deposit Insurance Corporation, the National
Credit Union Administration, the Office of the Comptroller of the Currency
and the Office of Thrift Supervision (collectively, the "Agencies"),
published in the Federal Register on July 15, 2004. Pursuant to the Fair
Credit Reporting Act ("FCRA"), as amended by the Fair and Accurate Credit
Transactions Act of 2003 ("FACT Act"), the Proposed Rule would prescribe
regulations to implement section 624 of the FCRA concerning affiliate
marketing. Visa appreciates the opportunity to comment on this important
topic.
The Visa Payment System, of which Visa U.S.A.1 is a part, is the largest
consumer payment system, and the leading consumer e-commerce payment system,
in the world, with more volume than all other major payment cards combined.
Visa plays a pivotal role in advancing new payment products and
technologies, including technology initiatives for protecting personal
information and preventing identity theft and other fraud, for the benefit
of its member financial institutions and their hundreds of millions of
cardholders.
BACKGROUND
The FCRA expressly permits the sharing of information between affiliated
entities. Specifically, the FCRA permits financial institutions to share
transaction or experience data between affiliated entities without
limitation.2 The FCRA also permits financial institutions to share
information that otherwise would be considered consumer reports with their
affiliates if their customers are provided notice and an opportunity to opt
out before this information is shared.3 However, section 624 of the FCRA, as
added by section 214 of the FACT Act, limits the ability of a financial
institution to use certain information received from its affiliates for
marketing purposes. Specifically, section 624(a)(1) of the FCRA states that
"[a]ny person that receives from another person related to it by common
ownership or affiliated by corporate control a communication of information
that would be a consumer report, but for [the exceptions in] section
603(d)(2)(A), may not use the information to make a solicitation for
marketing purposes to a consumer about its products or services, unless" the
consumer is provided notice and an opportunity to opt out, and the consumer
does not opt out.4 Section 214(b) of the FACT Act requires the Agencies,
the Federal Trade Commission ("FTC") and the Securities and Exchange
Commission, with respect to the entities subject to their respective FCRA
enforcement authority, to "prescribe [consistent and comparable] regulations
to implement section 624 of the" FCRA.5
The Proposed Rule would implement section 624 of the FCRA. However, the
requirements of the Proposed Rule differ materially in both nature and
structure from the requirements of section 624 of the FCRA, as well as the
privacy provisions of the Gramm-Leach-Bliley Act ("GLBA"). For example, the
Supplementary Information to the Proposed Rule ("Supplementary Information")
introduces a new concept of so-called "constructive sharing" of consumer
information that is well beyond the scope of section 624. In fact, the
Proposed Rule contains many new and unique provisions not found in the
statute itself, and these provisions raise questions as to the scope and
operation of the affiliate marketing initiatives in section 624. Many, but
not all, of these issues are addressed in this letter.
THE FINAL RULE SHOULD NOT IMPOSE RESPONSIBILITIES ON THE FINANCIAL
INSTITUTION THAT SHARES ELIGIBILITY INFORMATION WITH AN AFFILIATE
The Proposed Rule would impose the responsibilities found in section 624
on a financial institution that shares consumer report and certain
transaction and experience information (referred to in the Proposed Rule as
"eligibility information") with an affiliate. Specifically, proposed section
.20(a) would require that if a financial institution communicates
eligibility information to an affiliate, the receiving affiliate may not use
this information to make or send solicitations to consumers, unless the
financial institution sending the information to the affiliate first
provides the consumers with notice and an opportunity to opt out, and the
consumers do not opt out.
Visa believes that the final rule should not impose the section 624
notice obligation on the financial institution that shares eligibility
information with an affiliate, because there is no basis in the statute for
doing so. Section 624 of the FCRA does not establish any restriction on the
sharing of information with or among affiliates. Instead, section 624 only
provides that an affiliate that receives eligibility information may not use
this information to make marketing solicitations, absent an applicable
exception, unless the consumer first is given notice and an opportunity to
opt out. Specifically, section 624(a)(1) states that "[a]ny person that
receives [eligibility information from an affiliate] may not use the
information to make a solicitation for marketing purposes."6 The Agencies
acknowledge this exact point in the Supplementary Information, which states
that "[s]ection 624 governs the use of information by an affiliate, not the
sharing of information with or among affiliates."7 Additionally, the
Supplementary. Information states that section 624 "is drafted as a
prohibition on the affiliate that receives [eligibility] information from
using such information to send solicitations, rather than as an affirmative
duty imposed on the affiliate that sends or communicates that information."8
Although this principle is appropriately highlighted by the Agencies in the
Supplementary Information, the Proposed Rule nonetheless would impose an
affirmative duty on a financial institution that shares eligibility
information to provide consumers notice and an opportunity to opt out. While
the affiliated companies may well decide among themselves that it is most
efficient to have the affiliate that shares the information also provide the
notice, there simply is no basis in the FCRA to obligate the sharing
affiliate to do so.
In this regard, section 624 of the FCRA is covered by the FCRA private
right of action provisions in sections 616 and 617. Under the Proposed Rule,
a financial institution that shares eligibility information with an
affiliate could be liable to its customers if that information is used by
its affiliates to make solicitations to those customers and the financial
institution did not provide the customers with notice and an opportunity to
opt out. Under the Proposed Rule, a financial institution seeking to avoid
civil liability would be required to pursue one of several courses of action
before sharing eligibility information: (1) require receiving affiliates to
commit that they will not use the information for marketing purposes; (2)
always provide the notice before sharing the information with affiliates; or
(3) never share the information with affiliates. In many cases, none of
these solutions is practical. Even if a financial institution contracted
with its affiliates concerning the use of eligibility information, the
financial institution still could be exposed to potential liability, for
negligent noncompliance if any of the affiliates uses the information to
make a solicitation to a consumer who had not previously received notice and
an opportunity to opt out. Financial services holding companies typically
have common customer information databases that can be accessed by all
affiliates, and nothing in section 624 restricts the continued ability of
holding companies to maintain such databases.
The only appropriate way to address the affiliate marketing limitation in
section 624 is by placing the burden of the notice requirement and proper
use requirement on the affiliate that receives and uses the information, as
reflected in the FCRA itself. Moreover, because section 624 does not limit
the ability of financial institutions to share eligibility information with
affiliates, by imposing duties on institutions that share eligibility
information, the Proposed Rule goes beyond the scope of section 624, and in
doing so would expose financial institutions to civil liability based on the
use of this information by their affiliates. Since the Proposed Rule is
consistent with neither the statutory language of section 624, nor with the
legislative intent behind this provision, Visa believes that the final rule
should not impose new duties on entities that share eligibility information
with affiliates, as. long as. this sharing is permitted by section 603.
THE FINAL RULE SHOULD NOT REQUIRE ANY SPECIFIC ENTITY TO PROVIDE THE.
NOTICE
As noted above, the Proposed Rule would require a financial institution
that shares eligibility information with an affiliate to provide the opt-out
notice to the consumer. Visa believes that the final rule should not require
any specific entity to provide the notice, but instead should only require
that the consumer receive the required notice before an entity may make a
solicitation to the consumer based on eligibility information received from
its affiliates. The person who physically provides the notice is irrelevant.
In this regard, for example, the FCRA specifically contemplates that the
affiliate receiving and using eligibility information to make marketing
solicitations to consumers could be the person who provides the notice.
Section 624(b) of the FCRA states that:
A notice or other disclosure under this section may be coordinated and
consolidated with any other notice required to be issued under any other
provision of law by a person that is subject to this section, and a notice
or other disclosure that is equivalent to the notice . . . and that is
provided by a person described in subsection (a) to a consumer together with
disclosures required by any other provision of law, shall satisfy the
requirements of subsection (a).9
Even though the Proposed Rule clearly contradicts this plain, unambiguous
language, the Agencies still correctly point out in the Supplementary
Information that the FCRA does not specify which entity must provide the
opt-out notice.10 This lack of specification of the party who must provide the notice, however, does not override the clear
language of section 624(b) that the affiliate receiving and using
eligibility information from an affiliate to make a marketing solicitation
may provide the notice.
The Agencies explain that the FCRA and the FACT Act "suggest" that the
notice should be provided by the entity that communicates the eligibility
information. Specifically, the Agencies state that section 624(a)(1)(A)
requires that the notice disclose to the consumer that "information may be
communicated" among affiliates for the purpose of making solicitations,
which the Agencies conclude "suggests" that the entity communicating the
eligibility information must provide the notice.11 This statement, however,
does no more than inform the consumer that affiliated entities may make
solicitations based on information they receive from each other and that the
consumer may opt out of the marketing use, not the sharing, of this
information. Under the statute, any entity is capable of providing this
notice and the Agencies should not read into section 624 a specific
requirement that does not exist in the statute itself.
The Agencies also note that section 214(b)(3) of the FACT Act requires
the Agencies to consider existing affiliate sharing notification practices
and provide for coordinated and consolidated notices.12 This provision does
not imply that the entity sharing information with an affiliate must provide
the notice, or even that it is the entity that should have the
responsibility for providing the notice. Congress only sought to ensure that
the notice requirement would be consistent with existing disclosure
practices and could be coordinated with other disclosures required by law.
By simply requiring that the notice has been provided before information
received from an affiliate is used for marketing purposes, the Agencies'
resulting rule would be fully consistent with the statutory mandate for
coordination and consolidation with other notices, even though it would
leave that coordination to the institution or institutions providing the
notices.
In short, Visa believes that the final rule should not require any specific
entity to provide the opt-out notice, but should only require that the
consumer receive an opt-out notice that covers an affiliate's use of
eligibility information for marketing purposes before a solicitation based
on that information is made to the consumer. This approach would promote
flexibility by allowing any affiliate to provide the notice. This approach
also would recognize the fact that any affiliate may receive eligibility
information, as is clearly permitted by the FCRA, without intending to use,
or before deciding to use, this information to make marketing solicitations.
Allowing the entity that uses eligibility information to provide the notice,
or to ensure that some other entity has provided the notice, would not
require a determination to be made at the time the information is shared, or
placed into a centralized database, whether it will be used to make a
solicitation. In addition, an entity that later decides to use this
information for marketing would not be required to contact the affiliate
that shared the information to have that affiliate provide the notice. Most
importantly, allowing the entity that uses eligibility information received
from an affiliate to provide the notice, or to ensure that some other entity
has provided the notice, would be consistent with the plain language of
section 624(b) of the FCRA.
THE FINAL RULE SHOULD NOT ADDRESS SO-CALLED "CONSTRUCTIVE SHARING"
The Agencies specifically request comment on whether the Proposed Rule
should apply "if affiliated companies seek to avoid providing notice and opt
out by engaging in the `constructive sharing' of eligibility information to
conduct marketing."13 As described by the Agencies, constructive sharing
occurs when a financial institution uses its own information to make
marketing solicitations to its own customers concerning an affiliate's
products or services, and the consumers' responses provide the affiliate
with discernible eligibility information about the consumers.
The term "constructive sharing" is not used in section 624 of the FCRA,
or anywhere else in the FCRA or the FACT Act. Neither the letter nor the
purpose of section 624 applies to so-called "constructive sharing." This
concept of "constructive sharing" is a creation of the Agencies, not that of
Congress. Accordingly, the final rule should not address "constructive
sharing." Simply put, section 624 does not cover "constructive sharing" as
described by the Agencies. Even if section 624 did cover "constructive
sharing," section 624 also would exempt "constructive sharing" from its
requirements, since any receipt and use of information from the consumer
would coincide with the consumer's submission of the response form, which
would constitute an inquiry within the meaning of section 624 and trigger
application of the pre-existing business relationship exception under that
section.
Moreover, the very structure of section 624 was designed to encourage
financial institutions within the holding company structure to conduct
marketing through an affiliate that has a pre-existing business relationship
with its. customers. Specifically, for example, the pre-existing business
relationship. exception, as contrasted with the notice requirements imposed
by section 624 on the use of eligibility information to market to consumers
with whom a financial institution does not have a pre-existing business
relationship, creates an incentive to conduct marketing in holding companies
through financial institutions with the existing customer relationships.
Section 624 Does Not Cover "Constructive Sharing"
Section 624 does not limit the sharing of information. Section 624
addresses only the use of information after it has been shared and not the
sharing of information itself. In effect, section 624, like the FTC
Telemarketing Sales Rule, gives consumers the ability to opt out of certain
marketing practicesin the case of section 624, the use of information that
Congress deemed sensitive for direct marketing when conducted by affiliated
companies. As such, the focus and terms of section 624 are much narrower
than the focus of general privacy legislation, such as the privacy
provisions of title V of the GLBA that restrict the disclosure, as opposed
to the use, of information.
Specifically, section 624 of the FCRA applies only if four elements are
present:
(1) An entity has received information from an affiliate;
(2) This information would be a consumer report if the exceptions to the
definition of consumer report in the FCRA for transaction and experience
information and other information shared with affiliates did not apply;
(3) The entity uses this information to make marketing solicitations to
consumers; and
(4) The marketing solicitations are for the products or services of the
entity receiving the information and making the solicitations.14
If any, one of these four elements is not present, section 624 does not
require notice and an opportunity to opt out before an entity can make a
marketing solicitation to consumers based on eligibility information. These
four elements are not all present in "constructive sharing."
Moreover, the plain language of section 624 of the FRCA does not prohibit
an entity from using its own information to solicit its own customers for
the products or services of a third party, including an affiliate. Section
624 of the FCRA applies only when an entity uses eligibility information
received from an affiliate to make a marketing solicitation to a consumer.
If an entity uses its own information to market an affiliate's products or
services, the entity has not used eligibility information received from an
affiliate. If an entity does not receive eligibility information from an
affiliate before the marketing solicitation is made, section 624 simply does
not apply, and the entity may make a solicitation to a consumer without the
consumer receiving notice and an opportunity to opt out. In "constructive
sharing," the entity making the solicitation does not receive eligibility
information from an affiliate, and the entity on whose behalf the
solicitation is made only receives information from a consumer's response
after the solicitation has been made. As a result, section 624 cannot apply.
In addition, section 624 of the FCRA applies only when an institution uses
eligibility information received from an affiliate to make a marketing
solicitation concerning "its" products or services.15 The word "its" in
"about its products or services" is. not ambiguous and clearly refers to the
entity that makes the solicitations and not the affiliate communicating the
eligibility information. If an entity is marketing the products or services
of its affiliate, the entity would not be marketing its own products or
services and, as a result, section 624 would not require notice and an
opportunity to opt out. In "constructive sharing," an entity does not market
its own products or services, and, as a result, section 624 cannot apply.
Section 624 Excepts "Constructive Sharing"
Even if one were to disregard totally these required statutory factors,
section 624 of the FCRA still would not apply to "constructive sharing"
because one or more exceptions would apply. For example, section 624
expressly excludes from the notice and opt-out requirement any person who
uses information to make marketing solicitations "to a consumer with whom
the person has a pre-existing business relationship."16 The pre-existing
business relationship exception is not limited to the institution's own products or services. A
statement by Representative Oxley, Chairman of the House Financial Services
Committee, underscores this result by clarifying that "[a]n entity that has
a pre-existing business relationship with the consumer can send a marketing
solicitation to that consumer on its own behalf or on behalf of another
affiliate."17 As a result, the notice and opt-out requirement cannot apply
when an entity makes marketing solicitations for an affiliate's products or
services to its own customers because the entity has a pre-existing business
relationship with its customers. In "constructive sharing," the pre-existing
business relationship exception applies because an entity makes
solicitations to its own customers with whom the entity has a pre-existing
business relationship. Furthermore, when the affiliate on whose behalf the
solicitations are made receives an application or inquiry from the consumer,
which includes the consumer's response to the solicitation that leads to the
so-called "constructive sharing," that affiliate would be able to receive
and use discernable information of its affiliated companies to respond to
the communication because the affiliate would then have a pre-existing
business relationship with the consumer as a result of the consumer's
inquiry.
Indeed, the literal language of the pre-existing business relationship
exception goes well beyond "constructive sharing." For example, if a
financial institution obtains a list of an affiliate's customers from a
common, shared database and applies its own criteria to this list, and then
requests the affiliate to solicit its own customers for the financial
institution's products on its behalf, section 624 should not apply, as long
as the affiliate makes its own decision whether or not to send the
solicitations, and then in fact sends the solicitations. In these
circumstances, because the affiliate making the ultimate decision on whether
or not to make the solicitation, and then sends the solicitation, has a
pre-existing business relationship with the consumer, section 624 simply
does not apply. In this regard, the affiliate with the customer relationship
that makes the decision whether or not to send the marketing solicitations
still has a strong incentive to maintain that customer relationship and
would take care not to jeopardize that relationship by over aggressively
marketing the financial institution's products or services.
In addition, as discussed below, the limitation in the servicing
exception does not prohibit the financial institution from making
solicitations on behalf of the affiliate, even though the affiliate could
not make those solicitations on its own behalf.. The servicing exception in
section 624(a)(4)(C) states that "this subparagraph shall not be
construed" to permit an entity to make a solicitation on behalf of an
affiliate that could not otherwise provide the solicitation on its own
behalf.18 Clearly,
this limitation is limited to the servicing exception only. The exceptions
in section 624 are listed in the disjunctive and, as a result, if any
exception applies, the notice and opt-out requirement does not apply. As a
result, the restricting language in the servicing exception in no way limits
the application of the pre-existing business relationship exception.
Attempts to Address "Constructive Sharing" are not Consistent with the
Purposes of Section 624
Not only does the plain language of section 624 of the FCRA not apply,
but the policy and purpose behind section 624 does not support any attempt
to apply the notice and opt-out requirement to "constructive sharing." The
use of information by an entity to market an affiliate's products to its own
customers is not the equivalent of an affiliate using the same information
to market to another entity's customers. An entity that makes marketing
solicitations to its own customers has a strong incentive to maintain those
customer relationships and will take care not to jeopardize those
relationships by over aggressively marketing its products or services. A
recent study by the Secretary of the Treasury Department highlighted this
important point in its key findings. The study noted that "[m]ost businesses
have a powerful market interest in not annoying their customers with
unwanted solicitations, particularly businesses that value customer
loyalty."19 An affiliate that lacks a current customer relationship may see
less to lose through aggressive marketing practices. The scheme established
in section 624 that limits the marketing practices of an affiliate without a
customer relationship, but does not limit the marketing practices of the
institution with a customer relationship, is based on this distinction.
Whether the section 624 notice and opt-out requirement applies depends on
who markets the product not what the product is or whose product it is.
Solicitations for the same product are treated differently depending on who
makes those solicitations. The distinguishing characteristic of the
different standards that apply to marketing solicitations depending on
whether the entity or affiliate makes the solicitation is each party's
marketing incentives.
In addition, "constructive sharing" actually promotes the privacy of
customer information. An affiliate whose products are marketed by an entity
with the customer relationship does not receive or use affiliate customer
information for marketing purposes unless the customer elects to respond to
the solicitation. Allowing an entity to market an affiliate's products or
services to the entity's own customers eliminates the need to transfer
customer information to the affiliate for marketing purposes and places the
consumer in control of whether the information will be communicated to the
affiliate through the consumer's response.
Application of Section 624 to Agencies' Example of "Constructive Sharing"
The Supplementary Information presents the following hypothetical example
of "constructive sharing": An insurance company provides an affiliated bank
with specific eligibility criteria for the purpose of having the bank make
solicitations on behalf of the insurance company to bank customers who meet
those criteria; in addition, a consumer's response provides the insurance
company with discernible eligibility information, such as a response form
that is coded to identify the consumer as meeting the eligibility
criteria.20
Section 624 does not apply to this hypothetical example because the bank
is not using eligibility information received from an affiliate in order to
make solicitations. The bank receives eligibility criteria from the
affiliated insurance company, but these criteria are not eligibility
information. Section 624 does not prohibit an entity from using its own
information to make solicitations, but only regulates the use of eligibility
information received from an affiliate.
Section 624 also would not apply to the insurance company because the
insurance company is not using eligibility information received from an
affiliate in order to make solicitations. If the bank's customer responds to
the solicitation by returning the solicitation to the insurance company, the
notice and opt-out requirement still would not apply to the use of
eligibility information at that point by the insurance company because the
inquiry to the insurance company would trigger application of the
pre-existing business relationship exception. More specifically, by
responding to the solicitation, the bank's customer also would create a
pre-existing business relationship with the insurance company, and the
insurance company could, for a period of at least three months, use
eligibility information received from any affiliate in connection with its
marketing to the consumer. In addition, if the bank's customer responds to
the solicitation, section 624 would not apply to any use of eligibility
information in response to a communication initiated by the consumer because
that use is covered by yet another exception in section 624; namely, a
communication initiated by a consumer.
"Constructive Sharing" is Beyond the Scope of Section 624 Rulemaking
Section 214(b)(1) of the FACT Act requires the Agencies to "prescribe
regulations to implement section 624 of the" FCRA. The Agencies are
authorized and directed to write rules to implement the notice and opt-out
requirement. If the Agencies prescribe rules to limit conduct that is not
addressed by section 624, such as by limiting the ability of an entity to
market its affiliate's products or services to its own customers, those
rules likely should not be viewed as implementing section 624, unless the
language of section 624 was ambiguous or would lead to an absurd result. As
discussed above, the plain language of section 624 is not ambiguous, and it
would not lead to an absurd result.
The pre-existing business relationship exception in section 624 is not
ambiguous, because the general limitation of section 624 expressly refers to
an institution making solicitations for "its products or services," while
the pre-existing business relationship exception has no such reference.21
Similarly, the definition of "solicitation" is not ambiguous on this point.
Section 624 defines a "solicitation" as "the marketing of a product or
service initiated by a person to a particular consumer that is based on an
exchange of information described in [section 624(a)), and is intended to
encourage the consumer to purchase such product or service, but does not
include communications that are directed at the general public" or provided
for in the Agencies' regulations.22 This definition is not rendered
ambiguous because it does not indicate which party's products or services
are marketed. As noted above, section 624(a)(1) specifically states that a
solicitation covered by section 624 concerns the solicitor's products or
services. Because the notice and opt-out requirement only applies with
respect to solicitations for the solicitor's own products and services, the definition does not need to restate whose
products or services are at issue. The section only applies to solicitations
regarding one entity's products or servicesthose of the solicitor.
EXCEPTIONS TO THE NOTICE AND OPT-OUT REQUIREMENT
Proposed section .20(c) includes several exceptions to the notice and
opt-out requirement that generally track the statutory exceptions provided
in section 624(a)(4) of the FCRA. These proposed exceptions provide that the
notice and opt-out requirement does not apply when an entity uses
eligibility information received from an affiliate in certain instances,
including: (1) to make or send solicitations to consumers with whom the
entity has a pre-existing business relationship; (2) to perform services on
behalf of an affiliate; (3) to respond to a communication initiated by a
consumer; and (4) to respond to an affirmative authorization or request by
the consumer. Although these exceptions appropriately are listed in the
disjunctive in the Proposed Rule, Visa believes that the Agencies
nonetheless also should state specifically that if any one exception
applies, the final rule is not applicable.
Pre-Existing Business Relationship Exception
Proposed section .20(0(l) would provide an exception for a person that
makes or sends a solicitation to a consumer with whom the person has a
pre-existing business relationship.
Proposed section .3(m) would define a "pre-existing business relationship"
as a relationship between a consumer and a person that is based on any one
of three factors. First, a relationship based on a financial contract
between the parties that is in force on the date that a solicitation is made
or sent to the consumer would qualify as a pre-existing business
relationship.23 The
Agencies should clarify that a "financial contract" includes any in-force
contract relating to a financial product or service covered by title V of
the GLBA, such as a credit card account in which charging privileges are in
effect or that has an outstanding balance.
Second, a relationship based on a consumer's purchase, rental or lease of
the person's products or services, or a financial transaction with the
person (including holding an active account or an in-force policy) during
the 18 months preceding the date that a solicitation is made or sent to the
consumer would qualify as a pre-existing business relationship.24 Although
the Agencies provide an example of an insurance policy in the Proposed Rule,
it is not clear at what point the 18-month time period begins with respect
to many purchase, rental, lease or financial transactions. The Agencies
should clarify that the 18-month period begins to run at the time that all
contractual responsibilities under the purchase, rental, lease or financial
transaction expire. In addition, it is not clear what constitutes an active
account that would qualify as a pre-existing business relationship. Any
account with outstanding contractual responsibilities on either side of an
account relationship should be considered to be an active account,
regardless of whether individual transactions occur or do not occur under
the account.
Third, a relationship based on a consumer's inquiry or application
regarding the person's products or services during the three months.
preceding the date on which a solicitation is made or sent to the consumer
would qualify as a pre-existing business relationship.25 The Agencies
indicate in the Supplementary Information that with respect to consumer
inquiries, the FCRA definition is similar to the "established business
relationship" under the amended FTC Telemarketing Sales Rule, which the
Agencies believe "suggests that it would be appropriate to consider the
reasonable expectations of the consumer in determining the scope of this
exception."26 As a result, the Agencies conclude that "an inquiry includes
any affirmative request by a consumer for information, such that the
consumer would reasonably expect to receive information from the affiliate
about its products or services."27 Additionally, the Agencies indicate in
the Supplementary Information that "[a] consumer would not reasonably expect
to receive information from the affiliate if the consumer does not request
information or does not provide contact information to the affiliate."28
Visa believes that this expectation standard requires a financial
institution receiving an inquiry to project or interpret the consumer's
state of mind. The difficulty of this standard is illustrated by the
Agencies' own description of the standard. The Agencies state that in order
for a consumer's inquiry to result in a pre-existing business relationship,
the consumer must both request information and provide contact information.
In practice, however, either of these actions necessarily reflects the
consumer's expectation that he or she will receive a solicitation. In
addition, these terms suggest that "magic words" may be required for an
inquiry to lead to a pre-existing business relationship. For example, is the
statement, "I am interested in X," a request or must the consumer say, "send
me information about X."
As proposed by the Agencies, the expectation standard would severely
limit the inquiries and applications that would establish a pre-existing
business relationship. To the contrary, section 624(d)(1)(C) of the FCRA
contains no such limitation on the types of inquiries or applications that
would comprise a pre-existing business relationship. Under the FCRA, if a
consumer has made any inquiry or application within the preceding three
months, the pre-existing business relationship exception applies, without
regard to the ability of a company to interpret the consumer's state of mind
while doing so. For example, if a consumer inquires to an entity concerning
reasonably identifiable products or services or indicates interest in
products or services offered by a reasonably identifiable type of person,
the affiliate that offers those types of products or services should be
considered to have a pre-existing business relationship with that consumer
and, thus, should be able to use affiliate information to send solicitations
to that consumer.
Proposed section .20(d)(1) provides examples of situations that qualify
and do not
qualify as pre-existing business relationships. Proposed section
.20(d)(1)(iii) states that if a consumer inquires about an affiliate's
products or services and provides contact information for receipt of this
information, the affiliate can use eligibility information to. make the
consumer a solicitation within three months. Although providing contact
information may be an indication that a consumer reasonably expects to receive solicitations, as noted
above, this exception should not hinge on providing contact information. For
example, in the context of an e-mail request, the contact information may,
be self-evident and the consumer may conclude that it is unnecessary to
resubmit this information. Similarly, the return address on an envelope or
the captured telephone number of a consumer requesting information about
products or services should be sufficient
even if the consumer neglects to more specifically include his or her
address or telephone number.
Additionally, the Agencies request comment on whether there are
additional circumstances that should be included within the definition of
pre-existing business
relationship. 29 Visa believes that the term pre-existing business
relationship should be defined to include relationships arising out of the
ownership of servicing rights, a participation interest in lending
transactions, and similar relationships.
Servicing Exception
Proposed section .20(c)(3) would provide an exception for a person that
uses eligibility information to perform services on behalf of an affiliate.
Proposed section
.20(c)(3) states that this exception is not to be "construed as permitting a
bank to make or send solicitations on its behalf or on behalf of an
affiliate if the bank or the affiliate, as applicable, would not be
permitted to make or send the solicitation as a result of the election of
the consumer to opt out." This limitation, however, does not track the
language of the FCRA. Section 624(a)(4)(C) states that the servicing
exception does not permit "a person to send solicitations on behalf of
another person, if such other person would not be permitted to send the
solicitation on its own behalf as a result" of a consumer's opt out. In
addition, as noted above, the limitation in section 624(a)(4)(C) only
applies to the servicing exception. The Agencies should clarify that this
limitation does not determine the applicability of any other exception.
Consumer-Initiated Communications Exception
Proposed section .20(c)(4) would provide an exception for a person that
uses eligibility information "[i]n response to a communication initiated by
the consumer orally, electronically, or in writing." The Supplementary
Information indicates that to be covered by the consumer-initiated
communication exception, "use of eligibility information must be responsive
to the communication initiated by the consumer."30 As an example, the
Supplementary Information indicates that if a consumer calls an affiliate to
ask about the affiliate's products or services, only "solicitations related
to those products or services would be responsive to the communication and
thus permitted under the exception."31 Visa believes that this concept of
"responsive" solicitations is subjective and encourages an overly narrow
reading of this exception. Consumers may not be familiar with the various
types of products or services that are available and may rely on the
financial institution to inform them about available options and to offer
guidance concerning the products or services that would best suit their
needs. In addition, a consumer may not be familiar with which affiliates
offer specific products or services. A financial institution should not be limited in its ability to use
eligibility information obtained from an affiliate to respond to a consumer
who initiates a communication with the financial institution about any
product or service. After all, an inquiry by a consumer would trigger an
entirely separate exception, namely the pre-existing business relationship
exception, so an overly narrow reading of the consumer-initiated
communication exception would serve no purpose whatsoever. More
specifically, if a consumer calls an affiliate to ask about its products or
services, this call would qualify as an inquiry by the consumer concerning
the affiliate's products or services. The affiliate then would not need to
rely solely on the consumer-initiated communication exception because the
affiliate would also be covered by the pre-existing business relationship
exception. The consumer-initiated communication exception is clearly
intended to be broader in scope and, therefore, to apply to less specific
communications than the inquiry prong of the pre-existing business
relationship exception, or it would be redundant.
The Proposed Rule also would provide examples of the consumer-initiated
communication exception. For example, proposed section .20(d)(2)(i)
indicates that if a consumer initiates a call to a securities affiliate
concerning its products or services and provides contact information for
receiving that information, the securities affiliate may use eligibility
information from another affiliate to make solicitations in response to the
call. Requiring that the consumer provide contact information suggests that
the affiliate could not solicit the consumer over the phone on the same
call, but would have to mail or e-mail a solicitation to the consumer. As in
the case of the pre-existing business relationship exception, nothing in
section 624 even suggests that a consumer's communication should be required
to include the consumer's contact information in order for the exception to
apply.
Proposed section .20(d)(2)(ii) would provide an additional example that
if an affiliate makes an initial marketing call without the use of affiliate
information and leaves a message for the consumer to call back, the
consumer's response is a communication initiated by the affiliate, and not
the consumer. Visa believes that any such consumer call should be viewed as
a
communication "initiated" by the consumer, whether or not the consumer is
responding to an affiliate's call or some other communication, so long as
the affiliate's message makes clear the purpose of the call. If an affiliate
has left a clear message, the consumer is in a position to decide whether he
or she wants to return the call based on the product or service or the
affiliate involved. If a consumer does not wish to receive a solicitation,
he or she simply does not have to initiate a telephone call in response to
the message. The proposed limitation may emanate from a concern by the
Agencies that affiliates may "trick" the consumer into initiating a
communication and, thereby, avoid the notice requirement. However, the
Agencies should address deceptive practices under their unfair or deceptive
acts or practices authority under the Federal Trade Commission Act, rather
than in a FACT Act rulewriting. In this regard, if the message left by the
affiliate states the purpose of the call and the consumer elects to respond,
it cannot be said that the affiliate has "tricked" the consumer into making
that call.
Consumer Affirmative Authorization or Request Exception
Proposed section .20(c)(5) would provide an exception for a person that
uses
eligibility information "[i]n response to an affirmative authorization or
request by the consumer
orally, electronically, or in writing to receive a solicitation." This
proposed exception does not track the statutory language. Section 624(a)(4)(E) of the FCRA does not
require the consumer's authorization or request to be "affirmative." The
Proposed Rule and the Supplementary Information do not indicate how an
authorization or request would be "affirmative," or the justification for
adding this language, except to say that a preselected check box does not
satisfy this requirement. Consumers are familiar with check boxes, and if a
consumer has the ability to "unselect" a pre-selected check box, the
exception should apply. More broadly, Visa believes that the exception
should not be limited artificially. A request or authorization can be
manifested in many ways. Adding the requirement that a request or
authorization be affirmative will only inject uncertainty or pedantic
reaffirmation into the process.
In addition, Visa requests that the Agencies clarify that a consumer's
authorization or request does not have to refer to a specific product or
service or to a specific provider of products or services in order for the
exception to apply. As discussed above, the exception should apply if the
consumer's authorization or request concerns a type of product or service or
a type of provider of products or services.
GRANDFATHERING OF CERTAIN ELIGIBILITY INFORMATION
Proposed section .20(e) would provide that the. notice and opt-out
requirement does not apply to the use of eligibility, information shared by
an affiliate to make or send solicitations to consumers if "such information
was received by the" affiliate prior to the mandatory compliance date. This
proposed language differs from the corresponding provision in section 624
itself. Section 624(a)(5) states that "the use of information to send a
solicitation to a consumer [is not prohibited] if such information was
received prior to the date on which persons are required to comply with
regulations implementing this subsection." Section 624 does not limit the
information that is grandfathered to eligibility information received by the
affiliate that would use this information to make solicitations. Visa
believes that the final rule should grandfather all information that is
received by the financial institution that would be shared with its
affiliates, or that has been or will be placed into a common database.
THE FINAL RULE SHOULD EXTEND THE COMPLIANCE DATE
The Supplementary Information indicates that the mandatory compliance
date will be included in the final rules.32 The Agencies specifically,
request comment on whether the mandatory compliance date "should be
different from the effective date of the final regulations."33 Section
214(b)(4)(B) of the FACT Act provides that the regulations will be effective
within six months after being issued in final form. Visa believes that the
final rule should provide at least an additional six months for compliance;
that is, financial institutions should be given at least an additional
twelve months after the rule is issued in final form to comply with the
notice and opt-out requirement. This additional compliance time would assist
financial institutions that must make significant changes to business
practices. and procedures in order to comply with the final rule. Financial
institutions cannot design comprehensive compliance programs before the rules are issued in final form because of
the uncertainty surrounding the rules until they are released in final form.
This problem is illustrated by the many issues raised in this and other
comment letters.
In addition, many institutions will attempt to coordinate and consolidate
the affiliate marketing notice with their annual GLBA privacy notice. This
coordination was contemplated by the effective date for this provision
incorporated into section 624. However, in practice the transition period in
section 624 is inadequate. Many GLBA notices are mailed after March of each
year. Further, to the extent that the Proposed Rule is finalized later than
the September date set forth in the FACT Act, even more GLBA notices for
2005 will have been mailed. Accordingly, Visa believes that the Agencies
should allow financial institutions that intend to consolidate their
affiliate marketing notice with their GLBA notice for existing customers to
begin complying with the final rule at the time that they provide their next
GLBA notice following the established effective date or December 31, 2005,
whichever is earlier. This "roll-out" would allow financial institutions to
coordinate and consolidate the affiliate marketing notice with their "next"
GLBA privacy notice, if the institutions so choose, consistent with the
statutory directive that financial institutions have the opportunity to
"coordinate" and "consolidate" their affiliate marketing notice "with any
other notice required to be issued under any other provision of law."34 In
addition, this "roll-out" would also benefit consumers who would receive the
affiliate marketing notice and the GLBA privacy notice together and,
therefore, could make all of their privacy choices at the same time.
EXCLUSIONS FROM THE DEFINITION OF "SOLICITATION"
Proposed section .3(n)(1) would define a "solicitation" as marketing
initiated to a particular person that is "[biased on eligibility
information" received from an affiliate and "[i]ntended to encourage the
consumer to purchase" a product or service. Proposed
section .3(n)(2) would exclude from the definition of "solicitation"
"communications that are directed at the general public and distributed
without the use of eligibility information."
Visa supports the Agencies' determination that communications that are
directed at the general public should not be considered solicitations.
However, the Agencies should clarify that all communications that are
directed at the general public are excluded from the definition of
solicitation, whether or not these communications may be based on
eligibility information received from an affiliate. Section 624(d)(2) of the
FCRA states that the term "solicitation" "does not include communications
that are directed at the general public." The FCRA does not limit or qualify
which communications directed at the general public are excluded. An entity
should be permitted to use information received from affiliates to develop
communications directed at the general public, such as television and radio
ads. In addition, Visa believes that the final rule should clarify that any
marketing solicitation that is distributed without the use of eligibility
information received from an affiliate would not qualify as a solicitation.
THE FINAL RULE SHOULD NOT ADDRESS "SENDING" SOLICITATIONS
Throughout the Proposed Rule, the Agencies refer to "making" or "sending"
solicitations.35 For instance, proposed section .20(b) would prohibit an
affiliate that receives
eligibility information from using this information "to make or send"
solicitations to a consumer. Visa believes that the Agencies should remove
all references to "sending" solicitations from the final rule. Section 624
of the FCRA only concerns the use of eligibility information to "make"
solicitations and does not address "sending" solicitations. By referring to
sending solicitations, the Proposed Rule could be interpreted as applying
the notice and opt-out requirement to servicers that send solicitations on
behalf of another entity. Although it is not clear what the Agencies
believes "send" refers to, reference to "send" would be redundant if it only
covered the same use as "make." If "make" and "send" are not synonymous, the
Agencies would be regulating conduct that is not addressed in section 624.
THE FINAL RULE SHOULD NOT DEFINE "CLEAR AND CONSPICUOUS"
Proposed section .20(a)(i) would require a financial institution that
shares eligibility information with an affiliate to provide the consumer
with "a clear and conspicuous notice" that the consumer's information may be
communicated to, and used by, an affiliate to make
marketing solicitations to the consumer. Proposed section .3(c) would define
"clear and conspicuous" as "reasonably understandable and designed to call
attention to the nature and significance of the information presented." Visa
believes that the Agencies should not attempt to define "clear and
conspicuous" in the final rule and that, in fact, the proposed definition of
"clear . and conspicuous" could significantly increase the risk of civil
liability to financial institutions. As noted above, section 624 of the FCRA
is covered by the private right of action provisions in sections 616 and
617. Consequently, the proposed definition could expose financial
institutions to liability, even if the opt-out notice is completely accurate
and even if the consumer is not harmed. As a result, this definition would
foster litigation without any corresponding benefit to consumers.
Recognizing the problems with attempting to specify what it means for
information to be "clear and conspicuous" the FRB recently withdrew a
proposal that would have applied such a disclosure standard to Regulations
B, E, M and Z. Visa believes that the FCRA affiliate marketing rulemaking is
not the appropriate forum to experiment further with defining "clear and
conspicuous."
THE FINAL RULE SHOULD PERMIT ORAL NOTICES
In the Supplementary Information, the Agencies indicate that proposed
section .20(a),
which would require the affiliate sharng eligibility information to provide
the consumer notice, "contemplates that the opt out notice will be provided
to the consumer in writing or, if the consumer agrees, electronically."36
The Agencies specifically request comments on whether there are
circumstances in which it is necessary and appropriate to allow an oral
notice.
Visa believes that the final rule should permit oral notices. If an
entity communicates with a consumer in person or by telephone and an
exception does not apply, section 624 would require a written or electronic
notice in order to make solicitations using eligibility information received
from an affiliate. When this occurs, an entity should be permitted to
provide the consumer with an oral notice so it can determine whether or not
it can use affiliate information to offer the consumer a product or service
at that time. However, if the final rule only permits the notice to be
provided in writing, an affiliate will not be able to use affiliate
information during the telephone call, even though the consumer
affirmatively indicates that the affiliate can do so, because there is no
opportunity to provide the notice in writing during the call.
THE FINAL RULE SHOULD PERMIT FINANCIAL INSTITUTIONS TO PROVIDE AN OPT-OUT
OPPORTUNITY AT THE TIME OF THE TRANSACTION
Proposed section .22(a) would provide that before an affiliate may use
eligibility information received from a financial institution, the financial
institution "must provide the consumer with a reasonable opportunity,
following the delivery of the opt out notice, to opt out."
For example, proposed section .22(b)(1) indicates that a financial
institution provides a consumer a reasonable opportunity to opt out if the
financial institution "mails the opt out notice to a consumer and gives the
consumer 30 days from the date the [financial institution] mailed the
notice to elect to opt out by any reasonable means." Proposed section
.22(b)(3), however, would permit a financial institution to provide a
consumer the opt-out notice at the time of an electronic transaction "and
request[] that the consumer decide, as a necessary part of proceeding with
the transaction, whether to opt out before completing the transaction."
Visa believes that the final rule should permit a financial institution
to provide the opt-out opportunity at the time of any type of transaction,
not just an on-line transaction, and cause the consumer to decide whether to
opt out as a necessary step in proceeding with the transaction. The opt-out
decision is no more important than the consumer's decision on the
transaction itself, and there is no reason why the consumer's decision
cannot be made at that time.
THE FINAL RULE SHOULD NOT ADDRESS METHODS OF OPT OUT THAT ARE NOT
REASONABLE OR SIMPLE
Proposed section .23(b) would provides examples of methods of opting out
that are not reasonable or simple. Because of the potential for private
litigation based on section 624, Visa believes that the final rule should
not include these, or any other, examples of methods of opting out that are
not reasonable or simple. The examples provided in proposed section
.23(b), including requiring the consumer to write a letter to the financial
institution, find no basis in section 624, which simply requires that the
"the method provided [for opting out must] be simple."37 These examples are
likely to be used in litigation to argue that financial institutions are not
meeting the regulatory standard.
"AFFILIATE" SHOULD BE DEFINED AS DEFINED IN THE GLBA
Proposed section .3(b) would define an "affiliate" as "any person that is
related by common ownership or common corporate control with another
person." The Supplementary Information indicates that this proposed
definition "simplifies the various FCRA and FACT ACT formulations [of the
term affiliate)."38 Visa strongly supports the Agencies' efforts to simplify
this definition. Visa believes that the most effective way to simplify this
definition would be to make it completely consistent with the definition of
the same term in the GLBA rules. The interrelationship between the GLBA and
the FCRA is difficult enough without having different definitions for
affiliate.
Visa appreciates the opportunity to comment on this important topic. If you
have any questions concerning these comments, or if we may otherwise be of
assistance in connection with this matter, please do not hesitate to contact
me, at (415) 932-2178.
Sincerely,
Russell W. Schrader
Senior Vice President and
Assistant General Counsel
VISA U.S.A. Inc.
P.O. Box 194607
San Francisco, CA 94119
1
Visa U.S.A. is a membership organization comprised of U.S. financial
institutions licensed to use the Visa service marks in connection with
payment systems.
2 FCRA § 603(d)(2)(A)(i).
3 FCRA § 603(d)(2)(A)(iii).
4 In this comment letter, the information covered by section 624 will be
referred to as "eligibility information," similar to the Proposed Rule.
5 FACT Act §§ 214(b)(1)-(2).
6 FCRA § 624(a)(1) (emphasis added).
7
69 Fed. Reg. 42,502, 42,504 (July 15, 2004) (emphasis added).
8 Id.
9 FCRA § 624(b) (emphasis added).
10 969 Fed. Reg. at 42,504.
11 69 Fed. Reg. at 42,504.
12 Id.
13 69 Fed. Reg. at 42,507.
14 FCRA § 624(a)(1).
15 FCRA § 624(a)(1).
16 FCRA § 624(a)(4)(A).
17 149 Cong. Rec. E2515 (daily ed. Dec. 8, 2003).
18 FCRA § 624(a)(4)(C)
(emphasis added).
19 Security of Personal Financial Information: Report on the Study Conducted
Pursuant to Section 508 of the Gramm-Leach-Bliley Act of 1999, Secretary of
the Treasury Department 54 (June 2004).
20 69 Fed. Reg. at 42,507.
21 FCRA §§ 624(a)(1), (a)(4)(A).
22 FCRA § 624(d)(2).
23 Proposed § .3001)
24 Proposed § .3(m)(2).
25 Proposed § .3(m)(3).
26 69 Fed. Reg. at 42,508.
27 Id.
28 Id.
29 69 Fed. Reg. at 42,505.
30 Id at 42,508.
31 Id
32 69 Fed. Reg. at 42,509.
33 Id.
34 FCRA § 624(b).
35 See, e.g., proposed §§ .20(a), .20(b), .22(a), _.26(a).
36 69 Fed. Reg. at 42,507.
37 FCRA § 624(a)(2)(B)
38 69 Fed. Reg. at 42,505.