WILSHIRE CREDIT CORPORATION PO Box 8517 · Portland · OR · 97205 · (800) 776-0100 March 6, 2000 Secretary, Federal Trade Commission RE: Gramm-Leach-Bliley Act Privacy Rule (16 CFR Part 313 – Comment) Dear Secretary: I am writing on behalf of Wilshire Credit Corporation (“WCC”), a nationwide loan servicer for performing and non-performing residential mortgage, consumer and commercial loans. WCC is significantly affected by the proposed privacy rules and we appreciate the opportunity to submit these comments. WCC supports the intent and spirit of Section 504 of the Gramm-Leach-Bliley Act to protect the financial privacy of consumers and to give consumers the information they need to benefit from our financial system. However, WCC has a number of concerns, suggestions and specific requests regarding the proposed rules, which are detailed below according to topic. Definitions (313.3) Financial Institution 313.3(j)Does the term financial institution and the coverage of the Act apply to independent mortgage brokers, mortgage companies, loan servicers and insurance companies that are not controlled by or affiliated with a bank or bank holding company? Government Regulator 313.3(l) The definition of financial institution is inconsistent with the types of entities that are regulated by the agencies listed under Government Regulator. Further clarification of the applicability of the Act to independent, non-bank entities and their affiliates is needed. Initial Notice Requirements (313.4)When Initial Notice is Required 313.4(a) & (c)The initial notice is required prior to when a customer relationship is established, such as the execution of a loan contract. WCC requests clarification on other instances that might be a considered a triggering event for the initial notice. For example, does the execution of a modification to an existing contract, loan workout agreement or forbearance agreement represent an “execution of a contract” that would trigger the requirement to furnish an initial notice for customers that are customers before the effective date of the implementing rules? Or, does the fact that we must provide an initial notice to existing customers within 30 days of the effective date of the rule eliminate a subsequent event that would require an initial notice? In regards to the timing requirement for the initial notice, WCC believes the agencies should reconsider the “prior to establishing a customer relationship.” A less taxing requirement is before any nonpublic information is shared with a nonaffiliated third party or within a fixed period of time after establishing a relationship, such as 30 days. How to provide notice and exceptions to allow subsequent delivery of notice 313.4 (d)(2) WCC believes this section contains ambiguous language that will lead to inconsistent application of the timing requirement. Specifically, WCC requests that the agencies set a fixed time period in lieu of reasonable time after you establish a relationship for purposes of furnishing the initial notice in the event a loan is purchased from another financial institution. Also, the example should be written to include loans that are serviced transferred as well as loans that are purchased. In addition, WCC believes the notice need only be provided to one customer who is a party to the account. In most instances, the customer is either a single-account owner or is a resident of a community property state. Further, the administrative burden and expense of providing multiple disclosures to accountholders residing at the same address is an unnecessary and onerous rule placed on financial institutions. Annual Notice to Customers Required 313.5 Termination of Customer Relationship 313.5(c)(1) Other scenarios to consider in the list of examples where an annual notice should not be required include: · Loans in foreclosure. · Customers who are in bankruptcy where any communication is prohibited or strictly limited by bankruptcy laws. Information to be Included in Initial and Annual Notices 313.6WCC believes the content required in the initial and annual notice is excessive and defeats the Act’s purpose to provide clear, concise and meaningful information to the consumer. WCC also believes the proposed rules go far beyond the requirements of the Act by stipulating that financial institutions must identify by category the source and content of the information collected and shared. Exceptions To Notice and Opt Out Requirements 313.10Exceptions for Processing Transactions at Consumer’s Request 313.10(a)(1)&(2) Does the exception for processing transactions at the customer’s request apply to effect continuation of automatic payment deductions (also known as ACH or pre-authorized transfers) resulting from the transfer of a loan from one servicer to another? WCC requests clarification because in order for this service to continue, it is necessary for the current loan servicer to share the deposit account number and other information with the new servicer. (Keep in mind, the customer has specifically requested and authorized this payment service through written authorization as required by Regulation E.) WCC encourages the agencies to be more specific in their descriptions of the exceptions and to provide more specific examples of exempt activities. Necessary to effect, administer, or enforce a transaction 313.10(b) & Other Exceptions to Notice and Opt-Out Requirements 313.11 WCC is concerned about the vague language set forth in 313.10(b) & 313.11 regarding the limited number of exceptions and examples provided by the agencies in which nonpublic information may be shared with nonaffiliated third-parties performing services for the institution. For example, does the term “necessary to effect, administer or enforce a transaction” include the following scenarios: · Collateral recovery specialists contracted to perform repossession of assets resulting from default or abandonment. · Insurance companies contracted to force-place insurance coverage that was not maintained by the borrower in accordance with the loan agreement. (Force-placing insurance is vastly different than underwriting insurance at the consumer’s request. · Services performed by flood monitoring companies. · Tax service providers to monitor the status of paid and unpaid taxes. · Claims adjusters and property inspectors contracted to protect the lender or servicer’s interest in the collateral. · Western Union® and other wire service providers used to instruct payment to a customer’s account. Again, the agencies should avoid using ambiguous phrases such as “effect, administer or enforce” and provide more specific examples of exempt services and activities. Limits on Redisclosure and Reuse of Information 313.12WCC strongly objects to the suggestion that financial institutions be required to monitor the activities of third-parties by forcing nonaffiliated third parties to develop policies and procedures to ensure compliance with the limits on redisclosure. We ask the agencies to consider the following: · The financial industry should not be used by the regulatory agencies to police or enforce adherence to this or any other regulation. If third-party service providers are required to comply with certain provisions of the law then the regulation should be written to specifically include them in the scope of covered businesses. · If the rules are written to include such restrictive and intrusive business practices, specific guidance on enforcement, monitoring activities and liability should also be addressed. Specifically: § How does the financial institution monitor the activities of each vendor to ensure they are in compliance with the policies and procedures? Would we be expected to allocate resources and time to periodically audit the vendor’s records? Does the vendor have the legal obligation to open their records to such an audit? § Who decides whether the third party’s policies and procedures are adequate? Will it be the financial institution or an examiner using vague and subjective examination procedures? What kind of liability does the financial institution inherit if the third party is found to be out of compliance? § Would the financial institution be required to maintain a copy of each and every one of its vendor’s policies and procedures? Even if the vendor does maintain policies and procedures, how do we ensure that the third party will, directly or indirectly, not comply with the policy or prohibition on redisclosure? § Would the agencies expect financial institutions to stop doing business with service providers that were opposed to adopting policies and procedures? How would such a requirement affect the intent of RESPA to provide the borrower with consumer choice in settlement service providers? § Would the financial institution be required to re-negotiate current service contracts that do not include a provision for policies and procedures on customer privacy and redisclosure? · As an alternative, WCC supports the idea of the agency’s encouraging financial institutions to negotiate vendor contracts to include language addressing customer privacy. However, WCC does not believe such provisions should be mandated by law or agency rules. Effective Date; Transition Rule 313.6The initial notice requirement appears to apply retroactively to existing customers who are our customers on the effective date of the implementing regulations according to Section 216.16. The proposed rules do not set forth a specific time as to when the annual notice must be delivered – only that it be provided once during a 12-consecutive month period. Therefore, depending on when the financial institution programs the annual notice for delivery, the customer could conceivably receive two notices within a very short period of time. We believe this to be an unnecessary requirement during the transition period in addition to being an expensive and administrative burden on financial institutions. WCC suggests that during the transition period the financial institution be given the option to provide either the initial or the annual disclosure to existing customers. Examples and Definitions Provided by the RulesWCC encourages the agencies’ to provide as many detailed examples, explanations of exceptions and definitions in the final rule as possible. Model forms or samples of the initial and annual notice also would be helpful. The more concise the rules are written the easier it is for the institution to develop and implement procedures and internal controls to maintain compliance with the regulation. If you have any questions or would like to discuss our comments, please contact me at 800-776-0100 x7360. Sincerely, WILSHIRE CREDIT CORPORATION Robbie Sutton, CRCM CC: Jay Memmott, President, WCC |