| March 28, 2000 Mr. Donald S. Clark Re: Gramm-Leach-Bliley Act Privacy Rule, 16 CFR Part 313 – Comment Dear Mr. Clark: This letter is submitted on behalf of the Coalition of Higher Education Assistance Organizations (COHEAO) in response to the Notice of Proposed Rule Making (NPRM) on privacy of consumer financial information published by the Federal Trade Commission (FTC) on March 1, 2000. COHEAO thanks the FTC for the opportunity to comment on its proposed rule. COHEAO is a unique coalition comprised of over 350 colleges and universities, and commercial organizations with a shared interest in fostering improved access to postsecondary education. This comment letter focuses on the proposed rules as they affect these various entities. GENERAL COMMENTS Applicability of the Gramm-Leach-Bliley Act and the FTC’s Proposed Rule to Institutions of Higher Education and the Commercial Partners that Assist in Their Administration of Student Financial Assistance Programs COHEAO does not believe that institutions of higher education are considered to be "financial institutions " under Title V of the Gramm-Leach-Bliley Act ("G-L-B Act") (P.L. 106-102). Further, we do not believe that the commercial partners that contract with colleges and universities to administer functions related to student financial assistance programs should be covered by the requirements of the FTC’s proposed rule. The stated purpose of the G-L-B Act is "to enhance competition in the financial services industry by providing a prudential framework for the affiliation of banks, securities firms, insurance companies, and other financial service providers, and for other purposes." The terms "college", "university", or "institution of higher education" do not appear anywhere in the law; nor are they referenced anywhere in its legislative history. In contrast, the law specifically references businesses that engage in financial activities described in section 4(k) of the Bank Holding Company Act of 1956 (e.g., banking, insurance, and investing). Despite the fact that institutions of higher education are not mentioned in the legislation, the definitions in the proposed rule are so broad that they may be construed by some as being applicable to institutions of higher education and the commercial partners supporting their administration of student financial aid programs. While the term "financial institution" is very broad under the Act, we do not believe that Congress intended in Title V to impose additional regulatory requirements on our Nation's colleges, universities, and their commercial partners in helping needy families pay the costs of their children's education. The student financial aid funds awarded to eligible students by an institution of higher education are conditioned upon the students' attendance at that institution. The source of these funds may be the Federal government, state governments, private organizations, or the institution itself. These funds may be in the form of grants, scholarships, loans, employment, or tuition and fee waivers. The combination of the types of assistance and the source of that assistance is unique to each individual student. Over two-thirds of the financial aid funds awarded by college and universities are made under Federal programs with institutions acting as fiduciaries of the Federal government. These Federal funds are held in trust by an institution and awarded and disbursed to needy students. In some cases, such as the Direct loan and Federal Family Education Loan programs (FFELP), the institution determines a student's eligibility for a federally-insured loan and then delivers the loan proceeds by crediting the student's account. The source of funds and holder of the note is the Federal government (in the case of Direct loans) or a private lender in the case of the FFELP loans. However, under the Federal Perkins loan program, the institution, much like a trustee, actually manages a revolving loan fund that contains both institutional and Federal capital. As a fiduciary, an institution of higher education is not a "financial institution" as defined in Section 509(3) of the G-L-B Act because it is not an "institution the business of which is engaging in financial activities as described in section 4(k) of the Bank Holding Company Act of 1956." Rather, the business of an institution of higher education is to provide education beyond the secondary school level. Any financial activities performed by the institution is subordinate to the mission of the institution. The institution's fiduciary role in the delivery of federally-insured student loans is primarily done for the convenience of the Federal government as a cost-effective means for delivering funds to needy students under Title IV of the Higher Education Act of 1965, as amended. Many institutions of higher education utilize the services of commercial partners in administering student financial programs. These services typically involve financial data processing and transmission services, servicing institutional and Federal student loans, collection of defaulted Federal Perkins, other student loans and student debts owed to the institution. Institutions and their servicing agents are also required under the Higher Education Act to report to national credit reporting agencies information regarding Federal Perkins loan defaults. Some of these activities could be considered covered by Title V and the proposed rule by the cross-reference to the Federal Reserve Board's list of activities found to be closely relating to banking (12 CFR 225.28) which makes specific reference to them. However, in these instances, the institution of higher education is simply outsourcing part of its student financial aid functions to the commercial partner, generally to achieve cost savings. While these commercial entities may generally be subject to the Title V of the G-L-B Act and the proposed rule because of the cross-reference to 12 CFR 225.28, we do not believe that activities done solely to support student financial aid programs administered by institutions of higher education should be covered by the proposed rule. Since the financial aid programs of institutions of higher education do not appear to be a "financial activity" because the college or university is not considered to be a "financial institution", then it would logically follow that if a college or university were to outsource one or more functions related to administering these aid programs, that act should not invoke the requirements of Title V. We believe that the final rule should clarify in an example that student financial aid activities are not covered. Duplication, Overlap and Conflict with Current Federal Rules Applying to Institutions of Higher Education and the Commercial Partners that Assist in Their Administration of Student Financial Assistance Programs Subtitle A of Title V of the G-L-B Act, Disclosure of Nonpublic Personal Information, limits the disclosure of nonpublic personal information about a consumer to nonaffiliated third parties and requires consumer disclosure regarding an institution's privacy policies and practices. Application of these requirements to college and universities would duplicate, overlap, and, in some cases, conflict with the other current Federal requirements. Colleges and universities are already required to protect personally identifiable information of students and their parents by the Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. 1232g) and its implementing regulations (34 CFR Part 99). The FERPA requirements address many of the same types of issues in Title V of the G-L-B Act and the proposed rule, and in many cases provide greater protection of privacy by not allowing disclosure of information without consent. FERPA also requires that institutions provide annual notification to students and parents of their privacy rights and the privacy policy regarding educational records. Under FERPA, a student and family's financial aid-related information is considered to be an "educational record" and subject to its limitations on disclosure. FERPA regulations (34 CFR 99.31) allow limited disclosures of financial aid information of individuals who have applied for or received financial aid at the institution to non-affiliated third-parties for four specific purposes:
Many institutions utilize commercial partners. The third-party receiving this information may only use the information for these purposes. The regulations (34 CFR 99.33) prohibit the redisclosure of information. If the third party violates this requirement, the institution of higher education is barred from disclosing information to that third party for at least five years. The U.S. Department of Education is also given a number of sweeping powers to enforce the FERPA requirements. SPECIFIC COMMENTS In addition to these general comments, we are also providing the following comments on how specific sections of the proposed rule relate to these general concerns. Part 313.1 Purpose and scope. Section 313.1(b) of the proposed rule specifically includes account servicers and debt collectors as "financial institutions" for purposes of the rule. However, we do not believe that the rule applies to these organizations in their role as third-party servicers and contractors to institutions of higher education in their administration of the student financial assistance programs. The final rule should be clarified to reflect this. Part 313.2 Rule of construction. We support the "safe harbor" established in section 313.2 which considers compliance with an example to constitute compliance with the regulatory requirements. However, because the proposed rule of construction does not consider the examples to be exclusive, the broad definitions contained in the rule could be construed by some as applying to institutions of higher education with regard to their administration of student financial assistance, and to the commercial organizations that assist them in performing this activity. For this reason, we believe that the final rule needs to include examples that specifically exclude institutions of higher education and commercial organizations that assist them in administering student financial assistance from the regulations. Part 313.3 Definitions. (e) "Consumer" The proposed rule sets forth examples of what constitutes a "consumer." Section 313.3(e)(2)(v) states that "an individual who makes payments to [the financial institution] on a loan where [it] own[s] the servicing rights is a consumer. An individual is not [a] consumer, however, solely because [the financial institution] service[s] the individual’s loan on behalf of a financial institution that made the loan to the individual." Institutions of higher education typically contract with a servicer to service the loan when it reaches repayment. COHEAO would recommend that the final rule provide for an example to clarify that when an institution of higher education contracts with a servicer to service loans relating to financial assistance programs, the servicer is not deemed to "own" the loan since under the service contract the institution of higher education would retain ownership. This would clarify that a service contract between the institution of higher education and servicer does not transfer ownership rights; therefore, the servicer would not be subject to the rule within the scope of administering financial assistance programs. (i) "Customer Relationship" In the Section-by-Section analysis of the proposed rule, the discussion of the definition of "customer relationship" states that a "customer relationship" does not exist with a "debt collector that simply attempts to collect amounts owed to the creditor." This description of when a debt collector has a "customer relationship" is missing from the actual rule. COHEAO recommends that the example found in its Section-by-Section analysis concerning debt collectors be added to Section 313.3(i)(2) which provides examples of what does not constitute a "customer relationship." This would clarify the FTC’s position that debt collectors who simply collect the debt for the creditor does not have a "customer relationship" with the consumer. Therefore, since no "customer relationship" exists, the debt collector under this circumstance would not be covered under the rule. Part 313.4 Initial notice to consumers of privacy policies and practices required. Requiring institutions of higher education to provide an initial notice reflecting privacy policies and practices would be unnecessary and redundant with current Federal requirements. The Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. 1232g) and the implementing regulations (34 CFR Part 99) currently require a detailed set of consumer disclosure requirements regarding the privacy of educational records, including student financial aid information. Part 313.5 Annual notice to customers required. The requirements in 313.5 of the proposed rule duplicate the requirements of 34 CFR 99.7 of the Department of Education's FERPA regulations. Under those regulations, institutions of higher education must already provide annual notice to eligible students and their parents of their privacy rights under FERPA. Part 313.6 Information to be included in initial and annual notices. If institutions of higher education were regulated under the G-L-B Act, then as a "financial institution," their notice would be required to disclose a description of the "nonpublic personal information" it collects. The amount of information an institution of higher education collects from its students is massive. However, much of the information is not related to the financial aid a student receives. Therefore, if an institution of higher education was a "financial institution," the requirement under this part would be extremely burdensome as the school would need to describe all the "categories" of information the institution collects, even information not related to financial aid. In addition, it should be noted that FERPA has its own requirements regarding information that may not be disclosed as an "educational record;" therefore, another notice would be redundant. Part 313.8 Form and method of providing opt out notice to consumer. Section 313.8(e) states that a consumer’s opt out is effective until revoked in writing. An issue arises if the consumer opts out and then the institution was to change its policies and practices. If the institution sends an amended notice and the consumer does not opt out to the changes, it is unclear from the rule whether institutions could disclose information that is not covered by the initial opt out or if the opt out applies to any subsequent changes in policy as well. The final rule should address this concern. Part 313.10 Exception to notice and opt out requirements for processing and servicing. Section 313.10(a) states that there is an exception to both the initial notice to a consumer and the opt out requirement if the disclosure of nonpublic personal information is "as necessary to effect, administer, or enforce a transaction" or "to service or process a financial product or service requested or authorized by the consumer." The FTC should include language that makes it clear that this exception includes collection and billing services in the administration and enforcement activities. Institutions of higher education utilize the services of commercial partners to administer student financial aid programs. Since the activities of these commercial partners are to "effect, administer, or enforce a transaction" with a consumer, these commercial partners would fall under the scope of the exception. Therefore, COHEAO recommends that the FTC provide an additional example in this section that would create a "safe harbor" for these commercial partners when administering student financial aid programs. Thank you again for the opportunity to comment. If you have any questions regarding the comments or need further clarification, please contact Jacci White at (202) 289-3910.
|