Secretary,
Federal Trade Commission
Room H—159
600 Pennsylvania Avenue, NW
Washington, DC 20580

RE: Gramm-Leach-Bliley Act Privacy Rule, 16 CFR Part 313 - Comment

(65 FR 11173, March 1, 2000)

Dear Sir or Madam:

The Conference of State Bank Supervisors (CSBS) is pleased to have the opportunity to comment on the proposed consumer privacy regulations issued by the Federal Trade Commission (FTC). CSBS is the national organization of state officials responsible for chartering, regulating and supervising the nation’s 6,868 state-chartered commercial and savings banks and 419 state-licensed branches and agencies of foreign banks.

Background

Subtitle A of Title V of the Gramm-Leach-Bliley Act(GLBA) limits the instances in which a financial institution may disclose nonpublic personal information about a customer to nonaffiliated third parties, and requires a financial institution to disclose to all of its customers the institution’s privacy policies and practices with respect to information sharing with both affiliates and nonaffiliated third parties. Title V also requires implementing regulations to be prescribed by the Office of the Comptroller of the Currency, Federal Reserve Board, Federal Deposit Insurance Corporation, Office of Thrift Supervision, National Credit Union Administration, the Secretary of the Treasury, and the Securities and Exchange Commission.

General

The GLBA preserves the states’ authority to enact statutes, regulations, orders or interpretations that afford greater consumer protection than provided under federal law. The proposal implements this provision, and indicates that determinations of whether a state law or the GLBA provide greater protections are to be made by the FTC after consultation with the applicable government regulator or other authority.

CSBS suggests that state officials are uniquely qualified to interpret state laws, regulations and ordinances. Although not required by Title V of GLBA, the process for resolving uncertainties regarding the interplay of state and federal regulations would be facilitated by consulting with state officials. Therefore, CSBS suggests that the FTC amend the proposed rule to incorporate input from state officials if a state’s law is evaluated to determine whether it provides greater consumer protections than those provided in the proposal. This modification should streamline the process for reconciling state and federal consumer protection provisions.

This consultative approach is consistent with the spirit of Executive Order 13132 (Order), signed by President Clinton on August 4, 1999. The Order encourages all independent federal regulatory agencies, including the FTC, to recognize and respect the authority and jurisdiction of states to govern activities within their borders. The Order also directs federal agencies that propose to preempt state law to provide all affected state and local officials notice and an opportunity for appropriate participation in the proceedings.

The GLBA expressly states the FTC’s primary role in determining whether state or federal law offers greater consumer protections. However, the statute does not mandate a particular protocol for making such a determination. CSBS urges the FTC to establish a consultative protocol as soon as possible, optimally as part of the final regulations. Given the lack of precedence for the FTC to use as guidance, we welcome the opportunity to assist the FTC as appropriate.

Definitions

Several key definitions contain omissions or overlapping terms that may result in misinterpretation or confusion. Three definitions ("government regulator", "consumer", and "customer"), discussed below, are particularly unclear.

In the proposal, the term "government regulator" includes federal regulatory agencies and state insurance authorities. The term is incorporated in one of the exceptions to the proposal’s notice and opt out requirements. The exception is appropriately designed to maintain full supervisory disclosure between an institution and its regulator. CSBS is concerned that the definition excludes state banking authorities. As a result, the sharing of information by financial institutions with state banking authorities is not exempted from the proposal’s disclosure requirements. It is vital that the term government regulator be revised to include the state banking authorities that charter and supervise 70 percent of this country’s insured depository institutions.

CSBS is also concerned that the proposal does not adequately distinguish between customers and consumers. In fact, the definitions of "consumer" and "customer" contain overlapping characteristics, and financial institutions may conclude that they must provide an individual with multiple disclosures because that person is both a consumer and a customer. We recognize that regulatory modifications are precluded because the definitions originate primarily from statutory language. However, the FTC has the express authority to define when a customer relationship is established. Clearly defining the parameters for when a customer relationship is established may overcome the ambiguity of the terms customer and consumer, thus minimizing the potential for misinterpretation.

The proposal implements the GLBA’s general reference to the Fair Credit Reporting Act (FCRA). However, CSBS suggests that the proposal be modified to include a direct reference to Section 624(b)(2) of the FCRA which permits financial institutions to share customer information among affiliates and limits state laws that restrict this ability.

Specifically, Section 624(b)(2) of the FCRA provides as follows: "No requirement or prohibition may be imposed under the laws of any state … with respect to the exchange of information among persons affiliated by common ownership or common corporate control…" The effect of this section is that a state law is preempted if it attempts to impose limitations on the sharing of information including customer information, among entities under common control. This FCRA preemption provision expires after January 1, 2004. Although CSBS most certainly does not advocate preemption of state laws, clarity in this area is critical.

Section 624(b)(2) is significant in the context of determining whether a state’s consumer protection provisions are preempted by federal law. Because the GLBA preserves the operation of the FCRA, a preemption determination in this area requires a two-step statutory analysis. First, the FTC and the applicable government regulator must determine if the state law provides greater protection to consumers than the privacy provisions of GLBA. If the state regulation provides greater protection, a second analysis must be made to determine if the regulation triggers the FCRA’s preemption of state laws prohibiting consumer information sharing among affiliates. CSBS suggests that by including this interplay between the GLBA and FCRA explicitly in the proposal, the FTC would provide clarity that may minimize the occurrence of situations requiring preemption determinations.

Conclusion

CSBS recognizes that the protection of consumer financial information is paramount for maintaining the credibility and integrity of the financial services industry. While we have made several suggestions to add clarity and to promote efficient compliance, CSBS commends the FTC’s efforts in implementing the new consumer privacy protections established by the GLBA.

Thank you for your consideration and we invite you to call on us if we can provide additional information.

Best personal regards,