Dear Mr. Secretary:
Purdue University offers the following comments regarding the Notice of Proposed
Rulemaking (NPRM) issued March 1, 2000 to implement consumer privacy provisions mandated
by the Financial Services Act of 1999, the Gramm-Leach-Bliley Act:
Section 313.3 – Definitions
As defined in this section, the Commission views an entity as a financial institution
"the business of which is engaging in financial activities" only if it is
significantly engaged in a financial activity. No measurement or definition is provided in
the NPRM for "significantly engaged in a financial activity." The regulations
must give some measure by which an entity can determine its status as a financial
institution.
The business of a university by charter is to provide education, not to engage in
financial activities. We recommend that universities be exempt from inclusion as a
financial institution.
Section 313.1 – Purpose and Scope
Proposed paragraph (b) states "that the Rule applies only to information about
individuals who obtain a financial product or service from a financial institution to be
used for personal, family, or household purposes." Universities are engaged in a
broad spectrum of financial transactions necessary to carry out the educational mission.
However, these processes are vastly different from the nature of providing consumer
financial products for non-educational purposes. Examples of transactions conducted
include:
Billing and collecting direct educational costs, and
Processing and disbursing financial aid from internal and external sources for
educational related expenses, including electronic funds transfer, automated clearing
house, and exchange of student data with third parties.
Since these transactions do not meet the intent of "personal, family, or household
purposes," universities should be excluded from the proposed regulations.
Sections 313.4-313.6 – Required Notices
Universities are already subject to federal regulations that require reporting borrower
and financial data and payment activity to credit bureaus as participants in federal loan
programs. Referring defaulted loans to collection agencies or courts as part of due
diligence is also required. Universities are already required to notify the borrower of
these requirements and reporting actions in pre-loan entrance interviews, in their
promissory notes, and in exit interview information at the time loans are scheduled for
repayment. Federal regulations already require disclosure as part of loan conditions that
the borrower has a right to accept or reject the loan prior to receipt of funds and for a
given period after receipt of funds. Therefore, the proposed regulations are duplicative
and place an added burden on universities.
Credit bureaus, collection agencies, and the courts are "affiliates" rather
than "non-affiliated" parties, as dictated by federal regulations and internal
policy. Notification requirements in the proposed regulation appear to be duplication of
activities, since notification of disclosure is provided at various stages of the loan
cycle (from pre-disbursement through liquidation of the obligation). In addition, no other
party would be given access to borrower information, with the exception of loan co-signors
where applicable.
Nonpublic Personal Student Information Protection Under Other Federal laws
The Family Education Rights and Privacy Act already requires annual notices to students
and also prohibits the sharing of personal information. Compliance with this regulation by
universities already protects students from information disclosure to third parties
without their written consent, both while a student and after leaving student status.
Fair Credit Reporting Act. Federal regulations governing loan programs require
reporting and updating activity, and responding to disputes on a timely basis.
In closing, the proposed regulations duplicate existing federal requirements and place
an added burden on universities. Therefore, we recommend universities be exempt from the
proposed regulations.
John R. Shipley
Comptroller