March 31, 2000 Via Hand-Delivery Donald S. Clark Re: Gramm-Leach-Bliley Act Privacy Rule 16 CFR Part 313 - Comment Dear Secretary Clark: The American Land Title Association ("ALTA") is submitting these comments to assist the Federal Trade Commission ("FTC") in the consideration of the rules it has proposed to carry out its duties under the Gramm-Leach-Bliley Act ("GLBA" or "Act")(1) to prescribe regulations to implement the GLBA privacy requirements included in Subtitle A of Title 5 of that Act.(2) ALTA is a 501(c)(6) trade association that represents the interests of 2,400 title insurance companies, their agents, independent abstracters and attorneys who search, examine, and insure land titles to protect owners and mortgage lenders against losses from defects in titles. Many of these companies also provide additional real estate information services, such as tax search, flood certification, tax payment, and credit reporting services. These firms and individuals employ nearly 100,000 individuals and operate in every county in the country. ALTA members' collection of information has been related to the closing of a real estate settlement and the issuance of title insurance on real property. Because the information on liens recorded on property is publicly available when transactions are closed, as a general rule, they have not engaged in information sharing activities other than as part of their core title insurance and real estate settlement services businesses. We have therefore analyzed these provisions strictly from the perspective of the inadvertent costs that they may impose on our member's services - costs that ultimately must be borne by the consumer and that will, therefore, drive up the costs of home ownership in the United States if left unchecked. As a general matter, ALTA believes that the FTC's proposed regulations reflect the general intent of the GLBA privacy requirements. ALTA's comments are therefore limited to the portions of the proposed regulations that raise questions or concerns for ALTA's title insurance underwriting and agency and real estate settlement services functions and that may, inadvertently, impose compliance costs and burdens that were not contemplated by the drafters of the GLBA privacy requirements. Application to Title Insurance Agents and Underwriters. The proposed rules clearly state that they do not apply to entities for which the agency does not have primary supervisory authority.(3) Both the GLBA and the FTC's proposed regulations affirm that jurisdiction over insurance providers rests with the States.(4) The GLBA recognizes, however, that no State is required to enforce its privacy requirements.(5) It is unclear to us whether the FTC intends to attempt to enforce the GLBA requirements for insurance providers in any State in which the state authorities have failed to exercise their enforcement powers. Until this clarification is specifically stated, we find it necessary to comment on specific features of the proposed rules. We also believe that these rules may become a benchmark for the states. Although the GLBA grant of enforcement authority appears to forbid any such exercise of enforcement power, the FTC has not specifically made clear that its proposed rules do not apply to insurance providers. In contrast, the proposed rules of the Office of the Comptroller of the Currency - which in almost every other respect closely track the FTC's proposed rules - contain a specific statement that they do not apply to insurance providers.(6) ALTA therefore requests that the FTC clarify that it does not intend to attempt to enforce its rules against insurance providers to the extent that those providers are engaging in insurance activities properly regulated by the States. Definition of "Company." The proposed rules purport to apply to any "company" subject to the FTC's jurisdiction. The definition of "company" appears to apply only to actual business entities such as corporations or partnerships.(7) The FTC should make clear, however that a sole proprietorship is not a "company" subject to the Act's privacy requirements. Many small title insurance agencies operate as sole proprietorships for a variety of reasons.(8) The Act's requirements could pose burdens on such small agencies that they would be unable to satisfy. There is no indication, however, that Congress intended the Act's requirements to apply to such small businesses. For that reason, ALTA respectfully requests that the FTC clarify that it does not intend to impose these new burdens on sole proprietorships. Clarifying Opt-out Procedures. In the process of conducting a real estate closing, a settlement agent must co-ordinate and compile Federal and state disclosures mandated under such statutes as RESPA and Truth in Lending, and service certifications, such as inspection statements from several different providers. To the extent a consumer has used a number of different products or services from a financial institution and its affiliates, one opt-out form covering a variety of services provided may improve both the efficiency of the closing and comprehension of the consumer. In a similar vein, the FTC might consider exporting the opt-out requirements to the Fair Credit Reporting Act ("FCRA") to make clear that the same requirements that apply to the provision of opt-out notices under GLBA apply in the FCRA context. Consistent opt-out requirements would be helpful to consumer's comprehension, and the same policy rationales are applicable. Definitions of "Non-Public Personal" and "Publicly Available Information." Section 313.3 sets forth two alternative approaches to the terms "nonpublic personal information" and "public personal information."(9) Under the Alternative A approach, all personally identifiable financial information is, by definition, considered to be "non-public personal information" if it is provided to a financial institution by a consumer. The Alternative B approach to the definition of "non-public personal information", in contrast, specifically excludes "publicly available information" that is lawfully made available to the public through the specified sources. We note that Sec. 509 4(A)of the Act states that the term "nonpublic personal information" means personally identifiable financial information. ALTA members obtain the title and other property information from the public records, primarily county property records. Consequently, ALTA strongly supports the Alternative B approach, with a modification to add in the term "financial." There does not appear to be any legitimate justification for treating information that can be obtained from government or other public records as "non-public" simply because it was initially provided by a consumer. Initial Privacy Notice. The proposed rules require a financial institution to provide a "consumer" with a notice of its privacy policies and practices "prior to the time that . . . a customer relationship" is established.(10) The GLBA Section 503 notice requirement, however, dictates that the notice must be provided only "[a]t the time of establishing a customer relationship." Although this may appear to be a distinction that makes no difference, it actually could be a quite significant difference in a business like the real estate settlement services business. This is because title insurance agents and other providers of real estate settlement services typically have only a single in-person contact with their homebuyer customers - at closing. Requiring that the privacy policy be provided prior to the closing would disrupt historical business practices and impose an additional layer of costs on an already complicated and detail intensive process. Because Congress dictated that the notice must be given at the time the customer relationship is established and not before, the FTC should clarify that the providing of the initial notice can be done at the same time that the business transaction is consummated. While the rule describes the essential elements of an initial notice, the FTC may want to consider promulgating a sample initial notice to guide businesses in developing notices to meet the requirements of the statute and rule. It should be clear however, that this is a sample, and variations are acceptable. The IRS for example, has developed a sample acceptable certification that can be obtained from consumers on capital gains on home sales. The "Annual Notice" Requirement. The GLBA and the proposed rules require companies to give their "customers" notice of their privacy policies on an annual basis. The rules also stipulate that this obligation ceases when a consumer is no longer a "customer" and that one indicia of the cessation of the relationship is that the company has not communicated with the consumer for a period of at least 12 consecutive months.(11) For title insurance providers, this approach may be problematic for two reasons. First, title insurance providers generally only have contact with their customers during a closing and in the few days immediately following the closing when final closing documents are provided to the customer. Consequently, our situation may be more analogous to the one time transaction similar to customer use of an ATM. If the 12 consecutive month period begins on the date that the initial privacy notice is provided, then title insurance providers will be required to issue a subsequent notice even if they have no other subsequent contact with the consumer beyond follow-up from the closing. Providing that annual privacy notice would require title insurance providers to establish wholly new procedures for tracking and contacting consumers to whom they sell title insurance coverage, or result in numerous wasteful "addressee unknown" returns. It would therefore impose entirely new expenses that could be quite burdensome and that would, ultimately, have to be absorbed by the consumer as part of the home sale transaction. It seems unnecessary and imprudent to impose this additional new expense. To alleviate such burdens on any "financial institution" in a similar position, ALTA requests that the FTC clarify that the "12 consecutive month" period is an approximation rather than the bedrock requirement. Alternatively, the FTC could provide a special exception for title insurance in the real estate closing process, as noted below. Second, the example that states that a "financial institution" no longer has a "continuing relationship with an individual" if there has been no communication for a 12 month period presents a conundrum for ALTA members. As noted above, it is unclear whether it relieves them of the unnecessary obligation of initiating a second contact with their customers long after their home closing date. Moreover, especially by using the 12 month benchmark as an example rather than a safe harbor, it is unclear whether entities like ALTA members who have "customers" with whom they do not have regularized contact will nevertheless be required to issue subsequent privacy notices. In the title insurance context, for example, consumers who purchase title insurance coverage are customers of the underwriters from whom they purchase the coverage for as long as they own the home that is insured. Title insurance providers, however, have no contact with title insurance customers after the policy is initially sold unless a claim arises because the entire single premium is paid at closing. Title insurance providers also have no idea when the customer relationship has actually lapsed - and when their obligations under the issued policies have been alleviated - because customers do not notify them of the sale or refinancing of the insured home. To alleviate these types of concerns, the FTC should add a provision that dictates that no annual notice is required if the "financial institution's" contact with the consumer is limited to a single transaction, as in the case of title insurance.(12) Agents and the Customer Relationship. The proposed regulations generally contemplate that information can be freely shared for the purpose of completing transactions for which the information is provided for processing and servicing transactions. The regulations do not exempt an institution from the privacy notification requirement if they receive information to complete a transaction and the consumer becomes their "customer" because they provide a product or service on their behalf.(13) This could potentially mean that both an agent and an insurer would be required to provide separate privacy notifications even though only the agent has direct contact with the customer. The core question that this raises is whether the customer can be provided a master privacy notification that would apply to the privacy practices of all the entities that may be involved in a transaction? Clarifying that this option is available could greatly streamline the notification process in a number of contexts and thereby greatly reduce both the cost and potential consumer confusion that could be associated with providing multiple notifications. Effective Date. The FTC has proposed an effective date of November 13, 2000. We suggest that an extension of that date may be wise in order to allow companies time to make the operational changes necessary to implement procedures. ALTA would be happy to provide any additional comments or materials that would assist the Commission with its deliberations, and would appreciate an opportunity to discuss these issues in a meeting in order to address any questions this comment may raise. Sincerely, Ann vom Eigen 1. See P.L. 106-102 (codified at 15 U.S.C. §§ 6801 et seq.). 2. See 65 Fed. Reg. 11,174 (March 1, 2000). 3. See 65 Fed. Reg. at 11189 (§ 313.1(b)). 4. See GLBA Sec. 505(a)(6); 65 Fed. Reg. at 11190 (§ 313.3(l)(8)). 5. See GLBA Sec. 505(c) (denying any State that fails to enforce the privacy requirements certain benefits otherwise available under the Act). 6. See 65 Fed. Reg. 8770, 8789 (Feb. 22, 2000) (§ 40.1(b)). 7. See 65 Fed. Reg. at 11189 (§ 313.3(d)). 8. The peculiarities of the insurance business and of the agency relationships that are prevalent are an additional reason that the FTC should make clear that it is not attempting to regulate insurance provider practices in any way. Without such guidance and without consideration of the specific issues that arise in the insurance context, insurance providers will be forced to comply with a set of regulations that do not necessarily comport with their particular industry. 9. See 65 Fed. Reg. at 11190-91 (§§ 313.3(n), (o) and (p) Alternatives A and B). 10. See 65 Fed. Reg. at 11191 (§ 313.4(a)). 11. 65 Fed. Reg. at 11192 (§ 313.5(c)). 12. ALTA is not suggesting that this circumstance should absolve the institution from the obligation to provide the initial privacy notice. 13. See 65 Fed. Reg. at 11194 (§ 313.10(a)(1)). |