40334 Federal Register / Vol. 65, No. 126 / Thursday, June 29, 2000 / Rules and Regulations

1 G–L–B Act § 504(a)(1).

2See G–L–B Act § 504(a). The Banking Agencies

published a joint release adopting rules to

implement Title V earlier this month. Privacy of

Consumer Financial Information, 65 FR 35162 (June

1, 2000) (‘‘Banking Agencies’ Release’’). The

National Credit Union Administration approved its

final rules on May 8, 2000 [Privacy of Consumer

Financial Information; Requirements for Insurance,

65 FR 31722 (May 18, 2000)]. The Federal Trade

Commission adopted its privacy rules on May 12,

2000 [Privacy of Consumer Financial Information,

65 FR 33646 (May 24, 2000)].

3Under the G–L–B Act, investment advisers

registered with the States are regulated by the

Federal Trade Commission. See G–L–B Act

§ 505(a)(7).

4Privacy of Consumer Financial Information

(Regulation S–P), Exchange Act Release No. 42484

(Mar. 2, 2000) [65 FR 12354 (Mar. 8, 2000)]

(‘‘Proposing Release’’).

5The Banking Agencies, FTC, and NCUA

received a total of 8,126, 640, and 99 comments,

respectively, in response to their proposed rules.

SECURITIES AND EXCHANGE

COMMISSION

17 CFR Part 248

[Release Nos. 34–42974, IC–24543, IA–1883;

File No. S7–6–00]

RIN 3235–AH90

Privacy of Consumer Financial

Information (Regulation S–P)

AGENCY: Securities and Exchange

Commission.

ACTION: Final rule.

SUMMARY: The Securities and Exchange

Commission is adopting Regulation S–P,

privacy rules promulgated under section

504 of the Gramm-Leach-Bliley Act.

Section 504 requires the Commission

and other federal agencies to adopt rules

implementing notice requirements and

restrictions on a financial institution’s

ability to disclose nonpublic personal

information about consumers. Under the

Gramm-Leach-Bliley Act, a financial

institution must provide its customers

with a notice of its privacy policies and

practices, and must not disclose

nonpublic personal information about a

consumer to nonaffiliated third parties

unless the institution provides certain

information to the consumer and the

consumer has not elected to opt out of

the disclosure. The Act also requires the

Commission to establish for financial

institutions appropriate standards to

protect customer information. The final

rules implement these requirements of

the Gramm-Leach-Bliley Act with

respect to investment advisers registered

with the Commission, brokers, dealers,

and investment companies, which are

the financial institutions subject to the

Commission’s jurisdiction under that

Act.

DATES: Effective Date: This regulation is

effective November 13, 2000.

Compliance Dates: Compliance will

be mandatory as of July 1, 2001. Joint

marketing and service agreements in

effect as of July 1, 2000 must be brought

into compliance with § section 248.13 of

Regulation S–P by July 1, 2002.

FOR FURTHER INFORMATION CONTACT: For

information regarding the rules as they

relate to brokers or dealers, contact

George Lavdas or Jerome Roche, Office

of Chief Counsel, Division of Market

Regulation, (202) 942–0073, or regarding

the rules as they relate to investment

companies or registered investment

advisers, Penelope W. Saltzman or Hugh

P. Lutz, Office of Regulatory Policy,

(202) 942–0690, Division of Investment

Management, Securities and Exchange

Commission, 450 5th Street, NW.,

Washington, DC 20549.

SUPPLEMENTARY INFORMATION: The

Securities and Exchange Commission

(the ‘‘Commission’’) today is adopting

new Regulation S–P, 17 CFR 248.1–

248.30, under Title V of the GrammLeach-Bliley Act [Pub. L. No. 106–102,

113 Stat. 1338 (1999), to be codified at

15 U.S.C. 6801–6831], the Securities

Exchange Act of 1934 [15 U.S.C. 78]

(‘‘Exchange Act’’), the Investment

Company Act of 1940 [15 U.S.C. 80a]

(‘‘Investment Company Act’’), and the

Investment Advisers Act of 1940 [15

U.S.C. 80b] (‘‘Investment Advisers

Act’’).

Table of Contents

I. Background

II. Overview of Comments Received

III. Section-by-section Analysis

A. Subpart A—Privacy and Opt Out

Notices

B. Subpart B—Limits on Disclosure

C. Subpart C—Exceptions

D. Subpart D—Relation to Other Laws;

Effective Date

E. Subpart E—Safeguard Procedures

IV. Appendix—Sample Clauses

V. Comparison Chart

VI. Guidance for Certain Institutions

VII. Cost-Benefit Analysis

VIII. Paperwork Reduction Act

IX. Summary of Final Regulatory Flexibility

Analysis

X. Analysis of Effects on Efficiency,

Competition, and Capital Formation

XI. Statutory Authority

I. Background

Subtitle A of Title V of the GrammLeach-Bliley Act (‘‘G–L–B Act’’ or the

‘‘Act’’), captioned Disclosure of

Nonpublic Personal Information (‘‘Title

V’’), limits the instances in which a

financial institution may disclose

nonpublic personal information about a

consumer to nonaffiliated third parties,

and requires a financial institution to

disclose to all of its customers the

institution’s privacy policies and

practices with respect to information

sharing with both affiliates and

nonaffiliated third parties. Title V also

requires the Office of the Comptroller of

the Currency, Board of Governors of the

Federal Reserve System, Federal Deposit

Insurance Corporation, Office of Thrift

Supervision (collectively, the ‘‘Banking

Agencies’’), Secretary of the Treasury,

National Credit Union Administration,

Federal Trade Commission (collectively

with the Banking Agencies, the

‘‘Agencies’’), and the Commission, after

consulting with representatives of State

insurance authorities designated by the

National Association of Insurance

Commissioners, to prescribe regulations

necessary to carry out the purposes of

Title V.1

Commission representatives

participated with representatives from

the Agencies in drafting rules to

implement Title V. As required by the

G–L–B Act, the rules we are adopting

today are, to the extent possible,

consistent with and comparable to the

rules adopted by the Agencies.2

Regulation S–P contains rules of general

applicability that are substantially

similar to the rules adopted by the

Agencies. The rules also contain

examples that illustrate the application

of the general rules. These examples

differ from those used by the Agencies

in order to provide more meaningful

guidance to the financial institutions

subject to the Commission’s

jurisdiction.

Title V also requires the Commission

(and each of the Agencies) to establish

appropriate standards for financial

institutions subject to their jurisdiction

to safeguard customer information and

records. Regulation S–P includes

requirements for investment advisers

registered with the Commission

(‘‘registered advisers’’), brokers, dealers

(collectively, ‘‘broker-dealers’’), and

investment companies (‘‘funds’’) to

adopt appropriate policies and

procedures that address safeguards to

protect this information.3

II. Overview of Comments Received

On March 2, 2000, the Commission

issued a notice of proposed rulemaking

(the ‘‘proposal’’ or ‘‘proposed rules’’).4

The Commission received a total of 115

comments in response to the proposal.5

Of these, approximately 14 were from

individuals, virtually all of whom

encouraged the Commission to provide

greater protection of individuals’

financial privacy. Many individuals

noted their concerns generally about the

Federal Register / Vol. 65, No. 126 / Thursday, June 29, 2000 / Rules and Regulations 40335

6Commenters also requested that the Commission

support legislation that the commenters believe

would provide additional protections. In addition,

the Commission received a comment letter from the

Congressional Privacy Caucus, which encouraged

the Commission to exercise its rulemaking authority

to provide more protections than were proposed.

The Chairman of the Commission also received two

letters signed by several members of Congress, and

a third letter from other commenters, which urged

the Commission not to delay the compliance date

of the final rules until July 1, 2001.

7See Standards for Individually Identifiable

Health Information, 64 FR 59918 (Nov. 3, 1999) (as

amended by 65 FR 427 (Jan. 5, 2000)).

8Representatives of a wide variety of other

interests, including the health care industry, retail

merchants, insurance companies, credit bureaus,

and higher education, also submitted comment

letters.

9We also have included a guide to assist brokerdealers, funds, and registered advisers in their

efforts to comply with the privacy rules. See infra

section VI.

10See infra discussion of sections 248.3(j), (k)

(noting that variable annuities and variable life

insurance contracts are insurance products and

securities).

11See infra section 248.3(r).

12The Regulation also applies to any unregistered

broker, dealer or fund in the United States. See

section 248.1. In accordance with the G–L–B Act,

however, Regulation S–P does not apply to any

investment adviser that is not registered with the

Commission. See G–L–B Act §§ 505(a)(5)

(Commission has jurisdiction over broker-dealers,

funds, and registered advisers); 505(a)(7) (Federal

Trade Commission has jurisdiction over financial

institutions not subject to the specific jurisdiction

of the federal functional regulators). We also note

that the privacy rules of Banking Agencies do not

apply to foreign offices of financial institutions.

See, e.g., Banking Agencies’ Release, sections 40.1,

216.1, 332.1, 573.1.

13See, e.g., Alfadda v. Fenn, 935 F.2d 475 (2d

Cir.), cert. denied, 502 U.S. 1005 (1991); see also

Steele v. Bulova Watch Co., 344 U.S. 280 (1952).

loss of privacy and the receipt of

unwanted solicitations by marketers.6

Other commenters advocated that we

extend privacy protections in a number

of ways. These suggestions included

requiring (i) financial institutions to

provide consumers with access to

information about them maintained by

the institutions and the opportunity to

correct errors, (ii) more detailed

disclosures of the information collected

and disclosed, and (iii) disclosures of a

financial institution’s privacy policies

and practices earlier in the process of

establishing a customer relationship.

The National Association of Insurance

Commissioners (‘‘NAIC’’) submitted a

comment on behalf of the State

insurance authorities that generally

supported the Commission’s proposed

rules. The NAIC also proposed various

measures to provide certain protections

for consumers, such as specifying means

to exercise the right to opt out of the

disclosure of information. The NAIC

further advised the Commission to

clarify the boundary of federal and State

jurisdiction over privacy regulations

and ensure that the financial privacy

rules under the Act are compatible with

the privacy rules relating to medical

information that are to be issued by the

Secretary of the Department of Health

and Human Services (‘‘HHS’’) under the

Health Insurance Portability and

Accountability Act (‘‘HIPAA’’) of 1996.7

We received approximately 20 letters

from broker-dealers, funds, registered

advisers, insured depository

institutions, bank holding companies,

and their representatives.8 These

commenters suggested many changes to

the proposed rules. The most common

suggestions included: (i) Extending the

effective date of the rules; (ii) amending

the definition of ‘‘nonpublic personal

information’’ to focus more clearly on

what they believe is ‘‘financial’’

information; (iii) streamlining

information required in the initial and

annual disclosures; (iv) clarifying how

one or more of the statutory exceptions

operate; (v) revising or clarifying the

definitions of ‘‘consumer’’ and

‘‘customer’’; and (vi) adding flexibility

to provide initial notices at some point

other than ‘‘prior to’’ the time a

customer relationship is established.

We have modified the proposed rules

in light of the comments received.9

These comments, and our responses to

them, are discussed in the following

section-by-section analysis.

III. Section-by-Section Analysis

The final Regulation presents the

various sections in five subparts that

consist of related sections. Related

concepts are grouped together to make

the rules easier to follow. A comparison

table is included in section V to assist

readers in locating provisions that

appeared in the proposal. We also have

added an Appendix to the final rules,

setting out sample disclosures for

broker-dealers, funds, and registered

advisers to consider.

Section 248.1 Purpose and Scope

We are revising section 248.1, which

identifies the purposes and scope of the

rules. As stated in the proposal, the rule

is intended to require a broker-dealer,

fund, or registered adviser to provide

notice to customers about its privacy

policies and practices; to describe the

conditions under which the institution

may disclose nonpublic personal

information about consumers to

nonaffiliated third parties; and to

provide a method for consumers to

prevent the financial institution from

disclosing that information to certain

nonaffiliated third parties by ‘‘opting

out’’ of that disclosure, subject to

various exceptions as stated in the rules.

Most of the comments received on

this section focused on the scope of the

rules. Several commenters suggested

that the Commission clarify how the

rules apply to insurance companies.

Section 505 of the G–L–B Act sets out

the Commission’s enforcement authority

with respect to broker-dealers, funds,

and registered advisers. The section

explicitly excludes ‘‘persons providing

insurance’’ from the Commission’s (and

the Agencies’) enforcement authority

(and, by operation of section 504(a)(1) of

the G–L–B Act, from the Commission’s

and the Agencies’ rulemaking

authority). We believe that the G–L–B

Act relies on the States to enforce Title

V with respect to any insurance

activities conducted by broker-dealers,

funds, or registered advisers. Consistent

with this reading of the statute, the final

rule excludes the provision of insurance

by a broker-dealer, fund, or registered

adviser from the scope of Regulation S–

P. If the insurance product also is a

security, however, any broker-dealer or

fund that provides that security, or

registered adviser that provides advice

with respect to that security is subject

to Regulation S–P.10 In addition,

insurance company separate accounts

that are ‘‘investment companies’’ under

the Investment Company Act are subject

to this part.11

Several commenters stated that

Regulation S–P should apply to foreign

financial institutions that solicit

business from individuals in the United

States. As adopted, the requirements of

Regulation S–P apply to any brokerdealer, fund, or investment adviser that

is registered with the Commission,

regardless of whether its consumers are

U.S. persons or non-U.S. persons, and

regardless of whether it conducts its

activities through U.S. or non-U.S.

offices or branches.12 We also have

decided not to apply Regulation S–P to

any foreign (or ‘‘non-resident’’) brokerdealer or fund that is not registered with

the Commission. Despite the broad

reach of the U.S. federal securities

laws,13 we believe it would be

impractical to apply Regulation S–P to

those foreign unregistered entities. If a

foreign broker-dealer or fund conducts

activities through U.S. interstate

commerce in a manner that subjects it

to the registration requirements of the

U.S. securities laws, it is subject to those

requirements and any other applicable

protections to investors, such as antifraud protections. We do not believe

that subjecting these unregistered

entities to the obligation to provide the

privacy and opt out notices under

Regulation S–P would add to the

protections provided to investors under

the G–L–B Act. As noted above,

40336 Federal Register / Vol. 65, No. 126 / Thursday, June 29, 2000 / Rules and Regulations

14We note that a foreign broker-dealer, fund, or

investment adviser that registers with the

Commission also must comply with regulatory

requirements concerning service of process in the

United States. See Exchange Act rule 15b1–5(a) [17

CFR 240.15b1–5(a)] (requiring foreign broker-dealer

that registers with the Commission to consent to

service of process in the United States). See also

Investment Company Act rule 7d–1(b)(7) [17 CFR

7d–1(b)(7)]; Investment Advisers Act rule 0–2 [17

CFR 275.0–2].

15See supra note 7.

16See Proposing Release, supra note 4, at

discussion of section 248.2.

17The sample disclosures address solely the level

of detail required and do not attempt to provide

guidance on issues such as type size, margin width,

or other characteristics that affect whether a notice

is clear and conspicuous.

18Cf. Banking Agencies’ Release, supra note 2, at

sections 40.2, 216.2, 332.2, 573.2 (‘‘Compliance

with an example or use of a sample clause, to the

extent applicable, constitutes compliance with this

part.’’).

19Compare Banking Agencies’ Release, supra

note 2, sections 40.2, 216.2, 332.2, 573.2.

20 G–L–B Act § 509(6).

21See supra discussion of section 248.2. We are

unaware of any savings institution that is registered

as a broker and would be subject to Regulation S–

P.

22See also supra discussion of section 248.1

(privacy rules apply to the foreign offices of

registered broker-dealers, funds, and advisers, in

addition to the U.S. offices of all broker-dealers,

funds, and registered advisers).

23Banking Agencies’ Release, supra note 2,

sections 40.1(b), 216.1(b), 332.1(b), 573.1(b).

24See Proposing Release, supra note 4, at

discussion of proposed section 248.3(c).

however, if a foreign broker-dealer,

fund, or investment adviser decides to

register with the Commission, it would

be required to comply fully with

Regulation S–P.14

Several commenters suggested that

the rule should not apply to entities that

must comply with regulations proposed

by HHS to implement the HIPAA.15 We

do not believe that broker-dealers,

funds, or registered advisers would be

subject to any rules HHS has proposed

under HIPAA regarding protected health

information. We recognize, however,

that there could be areas of overlap

between the rules adopted by HHS

under HIPAA and the privacy rules.

After HHS publishes its final rules, we

will consult with HHS to avoid the

imposition of duplicative or

inconsistent requirements.

Section 248.2 Rule of Construction

We are revising section 248.2, which

sets out a rule of construction intended

to clarify the effect of the examples used

in the rules, to include the sample

clauses in the Appendix to the rules. As

noted in the Proposing Release, the

examples (and the sample clauses) are

not intended to be exhaustive; rather,

they are intended to provide guidance

about how the rules would apply in

specific situations.16

Commenters generally agreed that

examples are helpful in clarifying how

the rules will work in specific

circumstances. Some commenters also

suggested that we include more

examples, and provide examples of

model disclosures. A few commenters

suggested that the regulation state that

a financial institution is not obligated to

comply with an example but has the

latitude to comply with the general

rules in other ways. Other commenters

also requested that we treat the

examples as safe harbors or establish a

presumption that compliance with the

examples constitutes compliance with

the rules. Others stated that the

examples ought to be identical in each

privacy regulation adopted by the

Commission and the Agencies.

We agree that more examples would

be helpful, and have included

additional examples in appropriate

places throughout the rules. We also

have provided sample clauses in the

Appendix to assist broker-dealers,

funds, and registered advisers in

drafting privacy notices. The sample

clauses are provided to illustrate the

level of detail we believe is appropriate.

We caution financial institutions against

relying on the sample disclosures

without determining the relevance or

appropriateness of the disclosure for

their operations. We have used statutory

terms, such as ‘‘nonpublic personal

information’’ and ‘‘nonaffiliated third

parties,’’ in the sample clauses to

convey generally the subject of the

clauses. However, a financial institution

that uses these terms must provide

sufficient information to enable

consumers to understand what these

terms mean in the context of the

institution’s notices.17

We have not added a statement in the

final rule regarding a financial

institution’s ability to comply with the

rules in ways other than as suggested in

the examples. The rule states that the

facts and circumstances of each

individual situation will determine

whether compliance with an example

constitutes compliance with the

applicable rule.18 The examples and the

sample clauses do not provide a safe

harbor.19 Nevertheless, we believe that,

when read together, the rule of

construction, examples, and sample

clauses provide broker-dealers, funds,

and registered advisers sufficient

guidance on ways to comply with the

rules as well as sufficient flexibility to

comply with the regulation in ways

appropriate for the institution.

Section 248.3 Definitions

(a) Affiliate. We are adopting the

definition of ‘‘affiliate’’ as proposed.

The rule incorporates the definition of

‘‘affiliate’’ in the G–L–B Act.20 An

affiliation exists when one company

‘‘controls’’ (as defined in section

248.3(g) below), is controlled by, or is

under common control with another

company. The definition includes both

financial institutions and entities that

are not financial institutions. The

proposed rule also provided that a

broker-dealer, fund, or registered

adviser would be considered an affiliate

of another company if the other

company is regulated under Title V by

one of the Agencies, and under that

Agency’s rules, the other entity would

be affiliated with the broker-dealer,

fund, or registered adviser. Few

commenters addressed this definition,

and none disagreed with it.

(b) Broker. We are adopting the

definition of ‘‘broker’’ as proposed. The

definition incorporates the meaning of

‘‘broker’’ in the Exchange Act. One

commenter suggested that the definition

exclude foreign banks and savings

institutions because they will be subject

to the privacy rules of the Banking

Agencies.21 We disagree, and the rule

does not include this exception.22

Brokers registered with the Commission

include foreign entities that may not be

subject to the Banking Agencies’ privacy

rules, which do not extend to foreign

entities that do not have offices within

the United States.23

(c) Clear and conspicuous. We are

revising the definition of ‘‘clear and

conspicuous’’ in response to issues

raised by commenters. The proposed

rules required various notices to be

‘‘clear and conspicuous,’’ and defined

the term to mean that the notice must

be reasonably understandable and

designed to call attention to the nature

and significance of the information

contained in the notice. The proposal

did not mandate the use of any

particular technique for making the

notices clear and conspicuous, but

provided examples of how a notice may

be made clear and conspicuous. As

noted in the Proposing Release, each

financial institution would retain the

flexibility to decide for itself how best

to comply with this requirement.24

We received a large number of

comments on the proposed definition.

Several commenters favored adopting

the definition as proposed, with some

advocating that the final rule include a

requirement that disclosures be on a

separate piece of paper in order to

ensure that they will be conspicuous.

Others stated that the definition was

unnecessary, given the experience

financial institutions have in complying

Federal Register / Vol. 65, No. 126 / Thursday, June 29, 2000 / Rules and Regulations 40337

25 12 CFR part 226.

26Regulation DD, 12 CFR part 230.

27Many of these commenters expressed concern

that the examples would invite litigation because of

ambiguities inherent in terms used in the examples

in the proposed rule such as ‘‘ample line spacing,’’

‘‘wide margins,’’ and ‘‘explanations * * * subject

to different interpretations.’’

28See section 248.3(c)(2).

29See 17 CFR 230.421(b).

30See section 248.3(c)(2)(ii)(E). Because we

believe that privacy disclosures may be clear and

conspicuous when combined with other

disclosures, the rule does not mandate that privacy

disclosures be provided on a separate piece of

paper. The requirement is not necessary and would

significantly increase the burden on financial

institutions.

31Section 248.3(c)(2)(iii).

32See section 248.3(d).

33 5 U.S.C. 552a.

34See section 248.3(f).

with requirements that disclosures

mandated by other laws be clear and

conspicuous. Several commenters stated

that the definition is inconsistent with

requirements in other consumer

protection regulations such as

Regulation Z25 and the Truth in Savings

regulation,26 which require only that a

disclosure be reasonably

understandable.27 A few commenters

questioned how the requirement would

work in a document that contains

several disclosures that are required to

be clear and conspicuous, while others

raised questions about how a disclosure

may be clear and conspicuous on an

Internet web site.

New standard for ‘‘clear and

conspicuous.’’ The proposed definition

developed the concept of ‘‘clear and

conspicuous.’’ The phrase ‘‘designed to

call attention to the nature and

significance of the information

contained’’ was intended to provide

meaning to the term ‘‘conspicuous.’’ We

believe that this standard will result in

notices to consumers that communicate

effectively the information consumers

need in order to make an informed

choice about the privacy of their

information, including whether to open

a brokerage account, purchase fund

shares, or enter into an advisory

contract with an adviser.

Examples of ‘‘clear and conspicuous.’’

We recognize that many of the examples

are imprecise. We believe, however, that

more prescriptive examples, while

perhaps easier to conform to, likely

would result in requirements that would

be inappropriate in a given

circumstance. To avoid this result, the

examples provide generally applicable

guidance about ways in which a brokerdealer, fund, or registered adviser may

make a disclosure clear and

conspicuous. We note that the examples

do not mandate how to make a

disclosure clear and conspicuous. A

financial institution must decide for

itself how best to comply with the

general rule, and may use techniques

not listed in the examples. To address

concerns about the imprecision of the

examples, we have incorporated several

of the commenters’ suggestions in the

final rule for ways to make the guidance

more helpful.28

Combination of several notices.

Commenters stated that a document

may combine different types of

disclosures that are subject to specific

disclosure requirements under different

regulations. For example, a fund that

includes a privacy notice in its

prospectus would have to make the

privacy notice clear and conspicuous,

and would have to prepare the

prospectus according to certain

standards under the Securities Act of

1933.29 The final rule provides an

example of how a financial institution

may make privacy disclosures

conspicuous, including privacy

disclosures that are combined in a

document with other information.30 In

order to avoid the potential conflicts

between two different rules requiring

different sets of disclosures that are

subject to different standards, the final

rule does not mandate precise

specifications for presenting various

disclosures.

Disclosures on Internet web pages.

Several commenters requested guidance

on how they may clearly and

conspicuously disclose privacy-related

information on their Internet sites.

Disclosures over the Internet may

present some issues that will not arise

in paper-based disclosures. Consumers

may view various web pages within a

financial institution’s web site in a

different order each time they access the

site, aided by hypertext links.

Depending on the hardware and

software used to access the Internet,

some web pages may require consumers

to scroll down to view the entire page.

To address these issues, the example

concerning Internet disclosures states

that broker-dealers, funds, and

registered advisers may comply with the

rule if they use text or visual cues to

encourage scrolling down the page if

necessary to view the entire notice and

ensure that other elements on the web

site (such as text, graphics, hypertext

links, or sound) do not distract attention

from the notice.31 The examples also

note that the institution should place a

notice or a conspicuous link on a screen

that consumers frequently access, such

as a page on which consumers conduct

transactions.

There is a range of approaches a

broker-dealer, fund, or registered

adviser could use based on current

technology. For example, a brokerdealer could use a dialog box that pops

up to provide the disclosure before a

consumer provides information to a

financial institution. Another approach

would be a simple, clearly labeled

graphic located near the top of the page

or in close proximity to the financial

institution’s logo, directing the

customer, through a hypertext link or

hotlink, to the privacy disclosures on a

separate web page.

(d) Collect. We are revising the

definition of ‘‘collect’’ to clarify the

scope of the term.32 The G–L–B Act

requires a financial institution to

disclose in its initial and annual notices

the categories of nonpublic personal

information that the institution collects.

The proposal defined ‘‘collect’’ to mean

obtaining any information that is

organized or retrievable on a personally

identifiable basis, irrespective of the

source of the underlying information.

This definition was included to provide

guidance about the information that a

broker-dealer, fund, or registered

adviser must include in its notices and

to clarify that the obligations arise

regardless of whether the institution

obtains the information from a

consumer or from some other source.

Commenters suggested that the final

rule treat information that is not

organized and retrievable in an

automated fashion as not ‘‘collected.’’

We disagree that information should not

be deemed to be collected simply

because it is not retrievable in an

automated fashion. We believe that the

method of retrieval is irrelevant to

whether information should be

protected under the rule. We agree,

however, that the scope of the

regulation should be refined, and have

changed the definition of ‘‘collect’’ by

using language from the Privacy Act of

1974.33

Other commenters requested that the

rule clarify that information that a

broker-dealer, fund, or registered

adviser receives but then immediately

passes along without retaining a copy, is

not ‘‘collected.’’ We believe that merely

receiving information without retaining

it would not be ‘‘collecting’’ the

information. The final rule reflects this

by stating that the information must be

organized or retrievable by the financial

institution.

(f) Company. We received no

substantive comments on the proposed

definition of ‘‘company’’ and are

adopting it as proposed.34

(g) Consumer. We are adopting as

proposed the definition of ‘‘consumer,’’

40338 Federal Register / Vol. 65, No. 126 / Thursday, June 29, 2000 / Rules and Regulations

35See G–L–B Act § 502(a). See also sections

248.14 and 248.15. By contrast, the broker-dealer,

fund, or registered adviser must give all

‘‘customers’’ a notice of the institution’s privacy

policy at the time of establishing a customer

relationship and annually thereafter during the

continuation of the customer relationship. G–L–B

Act § 503(a).

36See proposed section 248.3(g)(1).

37See discussion of section 248.3(o) below.

38See section 248.3(g)(2)(i). 39Those consumers may not be customers,

however. See infra discussion of section 248.3

(explaining how the definition of ‘‘customer’’ will

be applied in the loan context). See section

248.4(c)(2).

40See proposed section 248.3(g)(2)(iii).

41See section 248.3(g)(2)(iii), (v).

42Section 248.3(g)(1).

and are revising the examples under the

definition in response to issues raised

by commenters. The G–L–B Act

distinguishes ‘‘consumers’’ from

‘‘customers’’ for purposes of the

statute’s notice requirements. A brokerdealer, fund, or registered adviser is

required to give a ‘‘consumer’’ the

notices required under Title V only if

the institution intends to disclose

nonpublic personal information about

the consumer to a nonaffiliated third

party for purposes other than as

permitted by section 502(e) of the

statute.35 We received a large number of

comments on this proposed definition

that raised questions about how the

definition would apply in a variety of

situations.

Evaluation of a request for a financial

product or service. The proposal

defined ‘‘consumer’’ to mean an

individual (and his or her legal

representative) who obtains, from a

financial institution, financial products

or services that are to be used primarily

for personal, family, or household

purposes.36 Because ‘‘financial product

or service’’ includes a financial

institution’s evaluation of an

application or request to obtain a

financial product or service, a person

becomes a consumer even if the

application or request is denied or

withdrawn.37 The examples for the

definition of ‘‘consumer’’ clarify that a

consumer includes an individual who

provides nonpublic personal

information when seeking to obtain

brokerage or investment advisory

services. For example, an investor who

provides nonpublic personal

information to several registered

advisers (whether orally or in writing)

in seeking financial advisory services

would be a consumer of each registered

adviser, even if the investor does not

enter into an advisory contract with any

of the advisers.

Many commenters disagreed that

someone should be deemed a consumer

of a financial institution by virtue of the

institution evaluating nonpublic

personal information provided by the

individual in an application or

otherwise. These commenters

maintained that the individual has not

obtained a financial product or service,

as is required by the G–L–B Act. We

believe, however, that a ‘‘financial

product or service’’ includes the

evaluation of information an individual

provides to the financial institution in

order to obtain some other financial

product or service. Broker-dealers,

funds, and registered advisers

frequently provide a range of services in

connection with the delivery of a

financial product, including the

evaluation of information provided by

an individual. The evaluation may be

the sole financial product or service

delivered, or one of several services

provided in connection with

establishing a customer relationship.

For example, an investor who seeks to

invest in certain investment products,

such as stock options, must provide a

broker-dealer or registered adviser with

nonpublic personal information in

connection with the request. Based on

this nonpublic personal information, the

broker-dealer or registered adviser may

open an account for the investor, but

deny his or her request to invest in

options. Whether the evaluation is the

sole product or service or one of several,

the institution’s evaluation of the

individual’s information is a separate

financial product or service.

The proposed definition of

‘‘consumer’’ also is consistent with one

of the primary purposes of Title V: To

enable an individual to restrict a

financial institution from sharing

nonpublic personal information about

the individual with a nonaffiliated third

party. The information an individual

provides to a financial institution before

a customer relationship is established is

likely to contain precisely the types of

information that the statute is designed

to protect. This information is no less

deserving of protection simply because

an application is denied or withdrawn.

For these reasons, we have retained in

the examples in the definition of

‘‘consumer’’ an individual who provides

nonpublic personal information to a

broker-dealer or investment adviser in

connection with obtaining brokerage or

investment advisory services.38

Loan sales. Several commenters

requested clarification of circumstances

in which a borrower becomes a

consumer. The final rule provides that

a person will be a consumer of any

entity that holds ownership or servicing

rights to an individual’s loan.39 We

believe that financial institutions that

own or service a loan provide a

financial product or service to the

individual borrower in question. In

some cases, the product or service is the

funding of the loan, directly or

indirectly. In other cases, the product or

service is the processing of payments,

sending account-related notices,

responding to consumer questions, and

complaints about the handling of the

account. The final rule defines

‘‘consumer’’ in a way that covers

individuals receiving financial products

or services in each of these situations.

Agents of financial institutions.

Several commenters maintained that an

individual should not be considered to

be a consumer of an entity that is acting

as agent for a financial institution.40

These commenters noted that the

financial institution that hires the agent

is responsible for that agent’s conduct in

carrying out the agency responsibilities.

We agree and continue to believe that

the broker-dealer, fund, or registered

adviser has a consumer relationship,

even if the institution uses agents to

help it deliver its products or services.

For example, fund consumers would not

become consumers of the fund’s transfer

agent that services the fund’s customer

accounts. The final rule retains the

examples addressing clearing agents and

provides a more general example to

illustrate this principle.41

Legal representative. We also agree

with the suggestion by several

commenters that the definition of

‘‘consumer’’ should clarify that a

financial institution may satisfy the

obligations stemming from a consumer

relationship by dealing either with the

individual who obtains a financial

product or service from a financial

institution or that individual’s legal

representative. We do not intend that

the rule require a financial institution to

send opt out and initial notices to both

the individual and his or her legal

representatives, and have amended the

final rule accordingly.42

Trusts. We received several comments

concerning whether an individual who

obtains financial services in connection

with trusts is a consumer or customer of

a financial institution. Several

commenters urged the Commission

generally to exempt a financial

institution from the requirements of the

rules when it acts as a fiduciary or, in

the alternative, to clarify the categories

of individuals who are considered to be

customers. Commenters proposed, for

example, that individuals who are

beneficiaries with current interests

should be identified as customers,

whereas individuals who are only

Federal Register / Vol. 65, No. 126 / Thursday, June 29, 2000 / Rules and Regulations 40339

43Similarly, a trust, partnership, or personal

corporation that has an account with a brokerdealer, fund, or registered adviser would not be a

customer for purposes of the privacy rules because

these entities are not individuals.

44See section 248.3(g)(2)(vii)–(viii),

248.3(k)(2)(i)(D). Three commenters also requested

clarification in the examples on whether an

individual who uses a financial tool that a financial

institution makes available on the Internet is the

institution’s consumer. The commenters noted that

individuals generally use these tools on a one-time

or sporadic basis, and the tool typically does not

require the user to enter his or her name or address.

Thus, the information provided through the Internet

tool is not personally identifiable. We agree that

under these circumstances the individual would

not be the institution’s ‘‘consumer’’ and that these

circumstances are covered in the examples under

the definition of ‘‘consumer’’ and personally

identifiable financial information. See section

248.3(g)(2)(ii), 248.3(u)(2)(ii)(B).

45See section 248.3(h). The definition is used in

sections 248.6(c)(1)(iv), 248.12(a), and 248.15(a)(5)

of the final rules.

46 15 U.S.C. 1681a(f).

47See discussion of section 248.3(a) above.

48See Form BD, Uniform Application for BrokerDealer Registration, Explanation of Terms, ¶ 1.

Form BD defines ‘‘control’’ to mean the power,

directly or indirectly, to direct the management or

policies of a company, whether through ownership

of securities, by contract, or otherwise. In addition,

there is a presumption of control for any person that

(i) is a director, general partner, or officer exercising

executive responsibility (or having similar status or

functions); (ii) has the right to vote 25 percent or

more of a class of voting securities or the power to

sell or direct the sale of 25 percent or more of a

class of voting securities; or (iii) in the case of a

partnership, has the right to receive upon

dissolution, or has contributed, 25 percent or more

of the capital.

contingent beneficiaries should not be

customers. Other commenters stated

that when the financial institution

serves as trustee of a trust, neither the

grantor nor beneficiary is a consumer or

customer under the rules. In these

commenters’ view, the trust itself is the

institution’s ‘‘customer,’’ and therefore

the rules should not apply to a financial

institution when it acts as trustee. These

commenters also stated that when a

financial institution is a trustee, it

serves as a fiduciary and is subject to

other obligations to protect the

confidentiality of the beneficiaries’

information that are more stringent than

those under the provisions in the G–L–

B Act. Similarly, these and other

commenters claimed that an individual

who is a participant in an employee

benefit plan administered or advised by

a financial institution does not qualify

as a consumer or customer. They

contended that plan participants have

no direct relationship with the financial

institution and, in any event, the

financial institution is authorized to use

information that would be covered

under the G–L–B Act only in

accordance with the directions of the

plan sponsor. The commenters

concluded, therefore, that the

regulations should specifically exclude

individuals who are participants in an

employee benefit plan from the

definition of customer.

We believe that the definition of

‘‘consumer’’ in the G–L–B Act does not

squarely resolve whether the beneficiary

of a trust is a consumer of the financial

institution that is the trustee. We agree

with the commenters who concluded

that, when the financial institution

serves as trustee of a trust, neither the

grantor nor beneficiary is a consumer or

customer under the rules. Instead, the

trust itself is the entity that obtains the

financial services, and the rules do not

apply because the trust is not an

individual.43 We note that a financial

institution that is a trustee assumes

obligations as a fiduciary, including the

duty to protect the confidentiality of the

beneficiaries’ information, that are

consistent with the purposes of the G–

L–B Act and enforceable under State

law. Accordingly, we have excluded an

individual who is a beneficiary of a trust

or a plan participant in an employee

benefit plan, from the definitions of

‘‘consumer’’ and ‘‘customer.’’

Nevertheless, we believe that an

individual who selects a financial

institution to be a custodian of

securities or assets in an individual

retirement account or individual

retirement arrangement (‘‘IRA’’) is a

‘‘consumer’’ under the G–L–B Act. We

have included examples in the rule that

appropriately illustrate this

interpretation of the G–L–B Act.43

Requirements arising from consumer

relationship. While the proposed and

final rules define ‘‘consumer’’ broadly,

we note that this definition will not

result in any additional burden to a

broker-dealer, fund, or registered

adviser if (i) no customer relationship is

established and (ii) the institution does

not intend to disclose nonpublic

personal information about the

consumer to nonaffiliated third parties.

Under the approach taken in the final

rule, a broker-dealer, fund, or registered

adviser is under no obligation to

provide a consumer who is not a

customer with any privacy disclosures

unless it intends to disclose the

consumer’s nonpublic personal

information to nonaffiliated third

parties outside the exceptions in

sections 248.14 and 248.15. The

institution may disclose a consumer’s

nonpublic personal information to

nonaffiliated third parties under the

final rule, if it delivers the requisite

notices and the consumer does not opt

out. Thus, the rule allows a financial

institution to avoid all of the rule’s

requirements for consumers who are not

customers if the institution chooses not

to share information about the

consumers with nonaffiliated third

parties. Conversely, if a broker-dealer,

fund, or registered adviser chooses to

share consumers’ nonpublic personal

information with nonaffiliated third

parties, the financial institution is free

to do so, provided it notifies consumers

about the sharing and affords them a

reasonable opportunity to opt out. In

this way, the rule attempts to strike a

balance between protecting an

individual’s nonpublic personal

information and minimizing the burden

on a financial institution.

(h) Consumer reporting agency. We

received no comments on the proposed

definition of ‘‘consumer reporting

agency,’’ and we are adopting it as

proposed.45 The definition incorporates

the definition of ‘‘consumer reporting

agency’’ in the Fair Credit Reporting

Act.46

(i) Control. We are adopting the

definition of ‘‘control’’ as proposed.

‘‘Control’’ means the power to exercise

a controlling influence over the

management or policies of a company

whether through ownership of

securities, by contract, or otherwise. In

addition, ownership of more than 25

percent of a company’s voting securities

creates a presumption of control of the

company. This definition is used to

determine when companies are

affiliated.47 Under the definition,

companies are considered to be affiliates

regardless of whether the control is by

a company or individual.

Some commenters suggested that the

rule adopt the definition of control used

in Form BD to determine when an entity

is a ‘‘control affiliate.’’ 48 Another

commenter suggested a test that focuses

solely on percent of stock owned in a

company in order to avoid the

uncertainties from a ‘‘control-in-fact’’

test. One commenter suggested

alternative definitions based on (i) the

ability to control the use of information

in a company in which an ownership

interest exists or (ii) a bright line 10

percent ownership test that also

provided for aggregating the interests of

credit unions and their wholly owned

subsidiaries.

We believe that a test based only on

stock ownership is unlikely to be

flexible enough to address all situations

in which companies should be

considered to be affiliated. In addition,

the proposed definition of control is

consistent with the definition in Form

BD, except that the definition in Form

BD creates a presumption of control in

40340 Federal Register / Vol. 65, No. 126 / Thursday, June 29, 2000 / Rules and Regulations

49 Id. See also section 248.3(i).

50See 15 U.S.C. 80a–2(a)(9).

51See section 248.3(k)(2)(ii).

52See e.g., SEC v. Variable Annuity Life Ins. Co.,

359 U.S. 65 (1959) (variable annuities); Exemption

of Certain Variable Life Insurance Contracts and

Their Issuers from Federal Securities Laws,

Investment Company Act Release No. 7644 (Jan. 31,

1973) [38 FR 4315 (Feb. 13, 1973)] (variable life

contracts).

53See section 248.3(k)(2)(i)(E).

54These individuals could include a contract

owner and could also include any other individual

who has the rights of a contract owner, such as the

ability to direct underlying investments.

55See section 248.3(k)(2)(i)(A) (consumer who

has a brokerage account (including a margin

account) has a continuing relationship with a

broker-dealer).

56The originating lender will then have a

consumer relationship with the borrower.

57 In those circumstances, the borrower will be

entitled to receive initial and annual notices from

the loan servicer.

58A broker-dealer who purchases loans for

securitization would have to provide notice and opt

out to borrowers before sharing nonpublic personal

information about the borrowers with nonaffiliated

third parties, unless the sharing was necessary to

effect or administer the securitization. See section

248.14(a)(3).

broader circumstances.49 The rule limits

the presumption of control to ownership

of more than 25 percent of the voting

securities, consistent with the definition

of control in the Investment Company

Act.50 This definition does not prevent

a finding of control-in-fact in the

circumstances that create a presumption

of control under the definition in Form

BD.

(j), (k) Customer, Customer

relationship. We received a large

number of comments on the definition

of ‘‘customer’’ and ‘‘customer

relationship.’’ A ‘‘customer’’ is a

consumer who has a ‘‘customer

relationship’’ with a financial

institution, and a ‘‘customer

relationship’’ is a continuing

relationship between a consumer and a

broker-dealer, fund, or registered

adviser under which the institution

provides a financial product or service

that is to be used by the consumer

primarily for personal, family, or

household purposes. As noted in the

proposal, a one-time transaction may be

sufficient to establish a customer

relationship, depending on the nature of

the transaction. A consumer would not

become a customer simply by engaging

in an isolated transaction that by itself

would be insufficient to establish a

customer relationship, such as when an

individual opens a brokerage account

solely for the purpose of liquidating or

purchasing securities as an

accommodation, i.e., on a one-time

basis, without the expectation of

engaging in other transactions.

Point at which a consumer becomes a

customer. Commenters criticized the

vagueness of the standard for

differentiating consumers from

customers. Several suggested that the

distinction should be based on when a

consumer and financial institution enter

into a written contract for a financial

product or service.

We recognize that the distinction

between consumers and customers will,

in some instances, require a financial

institution to make a judgment about

whether a customer relationship is

established. When an individual

engages in a transaction and is not likely

to expect further communication about

that transaction from the financial

institution (such as brokerage services

as an accommodation to buy or

liquidate securities), the individual will

not have established a customer

relationship as a result of that

transaction. In other situations when a

consumer typically would receive some

measure of continued service following,

or in connection with, a transaction

(such as when a consumer opens a

brokerage account, is the record owner

of fund shares, or obtains investment

advice), a customer relationship is

established. We believe that the

distinction set out in the proposed rule,

as further clarified by the examples in

the final rule of when a customer

relationship is and is not established,

provides a sufficiently clear line while

retaining flexibility to address less clearcut situations on a case-by-case basis.

Use of ‘‘isolated transaction’’ test. The

final rule does not define the distinction

between consumer and customer based

solely on whether the transaction is an

isolated event. We used this concept in

an example in the proposed rule to

illustrate one of the factors that may

determine whether a relationship is of a

continuing nature. Several commenters

suggested that this approach was

insufficiently precise to serve as a

workable distinction between

consumers and customers. We agree that

the test may not be useful in all

situations, but believe that it will help

clarify the status of relationships in

certain circumstances. Accordingly, the

final rule retains the following example

of an ‘‘isolated transaction’’: providing

brokerage services as an accommodation

to buy or liquidate securities without

the expectation of engaging in further

transactions does not establish a

customer relationship.51

Purchase of insurance. Some

commenters suggested that, in the

context of financial institutions that

engage in the sale of insurance and that

are regulated by the Commission, the

customer should be the policyholder

and not the beneficiary. As discussed

above, Regulation S–P does not apply to

the provision of insurance by brokerdealers, funds, or registered advisers. A

variable annuity or variable life

insurance contract, however, is both an

insurance product and a security.52 We

agree with the commenters, and the

final rule includes an example of

purchasing a variable annuity as one

situation in which a customer

relationship is formed.53 In this case,

the person obtaining a financial product

or service from the financial institution

is the person purchasing the annuity.54

Sales of loans. As noted above, several

commenters raised questions about loan

sales. They stated that when a financial

institution sells the servicing rights for

a loan to another financial institution,

the borrower should not be considered

a customer of both institutions.

Commenters suggested that the entity

with which the borrower communicates

about the loan (i.e., the servicer) could

have the customer relationship with the

borrower, and that the other institutions

could have a consumer relationship

with the borrower.

We believe that it is appropriate to

consider that a loan transaction gives

rise to only one customer relationship

and that this customer relationship may

be transferred in connection with a sale

of part or all of the loan. In this way,

the borrower will not be inundated by

privacy notices, many of which might

be from secondary market purchasers

that the borrower did not know had any

connection to his or her loan. We note,

however, that a borrower will remain a

consumer of the institution that

transfers the servicing rights, as well as

a consumer of any other institution that

holds an interest in the loan.

Under the final rules, therefore, a

financial institution will be considered

to have established a customer

relationship with any individual to

whom it makes a loan.55 If the

institution transfers the servicing rights

of that loan to another institution, the

second institution will establish a

customer relationship with the

individual, and the first institution’s

customer relationship will end (if the

relationship is based solely on the

loan).56 If the originating lender sells the

loan but continues to service the loan,

it will continue to have a customer

relationship with the borrower, and the

purchaser will have a consumer

relationship with the borrower.57 For

example, a broker-dealer who purchases

a loan, but not the servicing rights to the

loan, will have a consumer relationship,

but not a customer relationship, with

the borrower.58

Federal Register / Vol. 65, No. 126 / Thursday, June 29, 2000 / Rules and Regulations 40341

59One commenter also requested that the

Commission except from the notice requirements

closed-end funds whose information about record

owners is limited to name, address, and number of

shares held and who neither have affiliates nor

share nonpublic personal information with third

parties. The G–L–B Act does not exempt closed-end

funds from privacy provisions of Title V. Although

closed-end funds may bear the costs of mailing

initial privacy notices to new customers, they can

reduce the burden of annual notices by including

them with a shareholder report. See discussion of

section 248.3(c) (definition of ‘‘clear and

conspicuous’’).

60See Proposing Release, supra note 4, at text

following n.37.

61See G–L–B Act § 509(6). 62The investment adviser may receive nonpublic

personal information about the fund’s shareholders

in connection with performing services on behalf of

the fund or servicing the shareholders’ accounts.

The G–L–B Act permits a fund to share this

information with the adviser if the adviser is an

affiliate or if the adviser is a nonaffiliated third

party. See G–L–B Act §§ 502(b)(2), (e). See also

sections 248.13, 248.14.

63Section 248.3(k)(2)(i)(A).

64Section 248.3(k)(2)(i)(D).

65See supra discussion of section 248.3(g).

66 15 U.S.C. 78c(a)(5).

67The term also is used in the definition of

‘‘affiliate.’’ See section 248.3(a).

68See G–L–B Act § 502(e)(5).

69 69 12 U.S.C. 1843(k).

70 G–L–B Act § 509(3); proposed section

248.3(m)(2). Two commenters requested that the

rule clarify that an independent contractor

registered representative of a broker-dealer is not a

separate financial institution when acting in the

capacity of a registered representative. We believe

that the rules address this situation and need no

further revision. An independent contractor

Continued

Fund shares purchased through an

intermediary. Several commenters

suggested that an individual who is the

record owner of fund shares should not

be a fund’s ‘‘customer’’ if the fund is

limited, under its contract with the

intermediary who sold the shares, to

servicing the investor’s account. The

commenters argue that these investors

would be confused by receiving privacy

notices from the fund. We proposed a

‘‘bright line’’ example of record

ownership to establish the customer

relationship because the fund clearly

has nonpublic personal information

about its record owners that is

personally identifiable. We do not

believe that an investor who receives

account statements and other

information from a fund that services

the investor’s account will be confused

by receiving notices regarding the fund’s

privacy policies and practices.

Moreover, an investor is unlikely to

know whether a fund is contractually

limited in its use of the investor’s

nonpublic personal information or

whether those contract terms may

change. For these reasons, we are

adopting the proposed example that

record owners of fund shares are the

fund’s customers.59

Fund complex. One commenter

suggested that a customer of a fund

should be considered a customer of the

fund complex, which may include the

fund’s primary investment adviser, or

that a fund customer, at least in some

cases, should also be considered a

customer of the fund’s primary

investment adviser. We noted in the

Proposing Release that the record owner

of fund shares has a customer

relationship with both the fund and the

principal underwriter (which is a

broker-dealer) that sells the shares.60

The customer relationship with the

broker-dealer arises because the investor

has an account with the broker-dealer,

who provides financial services directly

to the investor. By contrast, an

investment adviser to a fund does not

generally have an ongoing account

relationship with each fund

shareholder. Instead, it serves the fund

shareholders indirectly through the

portfolio management services it

provides to the fund.

We recognize that the definition of

‘‘customer’’ may have disparate effects

on the ability of some investment

advisers to receive nonpublic personal

information about fund investors. For

example, if the underwriter of a fund is

affiliated with the fund’s investment

adviser, the underwriter can share

nonpublic personal information about

its customers with the adviser. By

contrast, if the underwriter is not

affiliated with the fund’s investment

adviser, the underwriter can share this

type of information only under an

exception in section 248.13, 248.14, or

248.15, and the adviser’s ability to reuse

the information would be limited to the

purpose for which it received the

information. These limitations result

from the language of the G–L–B Act,

which defines affiliation in terms of

‘‘control,’’ and we are unwilling to

modify the definition of ‘‘customer

relationship’’ to alter the effect of that

definition.61 For these reasons, we

believe that, in the absence of an

advisory contract with the investor, a

fund’s primary investment adviser does

not have a customer relationship with

the fund’s customers.62

Transferred accounts. One commenter

requested clarification about whether an

investor becomes a consumer of a

broker-dealer when the consumer’s

account is transferred to the brokerdealer. An individual who has an

account with a broker-dealer or a

contract with a registered adviser has

established a customer relationship with

that broker-dealer or adviser. Thus, the

investor is a customer of that brokerdealer or registered adviser, regardless

of whether the account was transferred

at the customer’s request or as the result

of a merger, acquisition, or assignment.

Accordingly, the final rule includes an

example that an individual is a

customer of a broker-dealer or registered

adviser if the individual’s account is

transferred to the broker-dealer or

adviser.63

Trusts. The final rule adds an

example to clarify that an individual

will be deemed to establish a customer

relationship when a broker-dealer, fund,

or registered adviser acts as a custodian

for securities or assets in an IRA.64 This

example is consistent with the

explanation set out above in the

discussion of ‘‘consumer’’ concerning

trusts.65

(l) Dealer. We received no comments

on the proposed definition of ‘‘dealer’’

and are adopting it as proposed. The

definition incorporates the definition of

dealer in the Exchange Act.66

(m) Federal functional regulator. We

are defining the term ‘‘federal functional

regulator’’ in place of ‘‘government

regulator.’’ The proposal sought

comment on a definition of

‘‘government regulator’’ which included

each of the Agencies, the Commission,

and State insurance authorities under

the circumstances identified in the

definition. This term was used in the

exception in proposed section

248.15(a)(4) for disclosures to law

enforcement agencies, ‘‘including

government regulators.’’

For purposes of the privacy rules, this

term is relevant in determining when an

entity is an affiliate and when a brokerdealer, fund, or registered adviser may

disclose information to a law

enforcement agency.67 The exception

for disclosure as stated in the G–L–B

Act uses the term ‘‘Federal functional

regulator,’’ 68 which is defined in the

statute at section 509(2) and includes

the Secretary of the Treasury for

purposes of the exception permitting

disclosures to law enforcement

agencies. We have decided that it is

appropriate to use the term ‘‘federal

functional regulator’’ instead of

‘‘government regulator.’’

(n) Financial institution. We are

adopting the definition of ‘‘financial

institution’’ as proposed. The proposal

defined ‘‘financial institution’’ as any

institution the business of which is

engaging in activities that are financial

in nature, or incidental to such financial

activities, as described in section 4(k) of

the Bank Holding Company Act of

1956.69 The G–L–B Act also defines

‘‘financial institution,’’ and the proposal

excepted from the definition those

entities the G–L–B Act also excepts.70

40342 Federal Register / Vol. 65, No. 126 / Thursday, June 29, 2000 / Rules and Regulations

registered representative is considered an

‘‘associated person’’ of a broker-dealer under the

Exchange Act if the representative’s activities are

subject to control by the broker-dealer, such as

when there is a principal and agent relationship.

See Letter to Gordon S. Macklin, President,

National Association of Securities Dealers, Inc. from

Douglas Scarff, Director, Division of Market

Regulation, Commission (June 18, 1982) (on file

with the Commission). As discussed above, a

broker-dealer’s consumer is not considered a

consumer of the broker-dealer’s agent. See section

248.3(g)(2)(v). An independent contractor, however,

also may be a registered adviser who as such, acts

in a different capacity than as agent for the brokerdealer. In these circumstances, the registered

representative is a different financial institution.

Therefore, an investor who obtains investment

advisory services from that registered representative

acting as an investment adviser would be a

consumer of the investment adviser.

71These entities will, however, be subject to the

limits on reuse and redisclosure under section

248.11 with respect to any nonpublic personal

information they receive from a nonaffiliated

financial institution that has disclosure obligations

under these rules.

72But see section 248.3(g)(2)(ii) (an individual is

not a consumer of a broker-dealer, fund, or

registered adviser if the individual provides the

institution only with name, address, and general

areas of interest in connection with a request for a

prospectus, investment adviser brochure, or other

information about financial products or services).

73 15 U.S.C. 80b–2(a)(11).

74 15 U.S.C. 80a–3. As noted in the Proposing

Release, a business development company, which

is an investment company but is not required to

register with the Commission, is subject to

Regulation S–P. See Proposing Release, supra note

4, at n.30. See also 15 U.S.C. 80a–2(a)(48). An entity

that is not an ‘‘investment company’’ under the

Investment Company Act, is not subject to

Regulation S–P. See 15 U.S.C. 80a–3(c).

75The Banking Agencies (other than the Board of

Governors of the Federal Reserve) and the Federal

Trade Commission proposed alternative rule text

for this approach. See Privacy of Consumer

Financial Information, 65 FR 8770, 8790–91, 8804–

05, 8811–12 (Feb. 22, 2000); Privacy of Consumer

Financial Information, 65 FR 11174, 11189–90

(Mar. 1, 2000) (Federal Trade Commission

proposal).

Commenters suggested that the final

rule include additional exceptions from

the definition, such as for securitization

trusts, debt buyers, and credit bureaus.

We have not included these exceptions

in the final rule. We believe it is

inappropriate to exclude many of the

activities suggested by commenters

because the objective of the suggested

exclusions can be achieved in other

ways. Even if an entity is a financial

institution as that term is used in the G–

L–B Act, it will not have any disclosure

responsibilities under the Act or this

rule if it does not provide a financial

product or service to a consumer. In

most of the situations posited by the

commenters, the entity in question will

not meet that test and therefore will fall

outside the scope of the rules with

respect to privacy disclosures.71

(o) Financial product or service. We

are adopting the definition of ‘‘financial

product or service’’ as proposed. The

proposal defined the term as a product

or service that a broker-dealer, fund, or

registered adviser could offer by

engaging in an activity that is financial

in nature, or incidental to such a

financial activity, under section 4(k) of

the Bank Holding Company Act. An

activity that is complementary to a

financial activity, as described in

section 4(k), was not included in the

proposed definition of ‘‘financial

product or service.’’ The proposal’s

definition included the broker-dealer,

fund, or registered adviser’s evaluation

of nonpublic personal information

collected in connection with a request

by a consumer for a financial product or

service even if the request ultimately is

rejected or withdrawn.72 It also

included the distribution of information

about a consumer for the purpose of

assisting the consumer in obtaining a

financial product or service.

Several commenters criticized the

proposed definition and suggested that

the evaluation of application

information should not be considered a

financial product or service. For the

reasons discussed above regarding the

definition of ‘‘consumer,’’ we continue

to believe that it is appropriate to retain

evaluation or brokerage of information

as within the scope of financial

products or services covered by the

rules.

(q) Investment adviser. We received

no comments on the proposed

definition of ‘‘investment adviser’’ and

are adopting it as proposed. The

definition incorporates the definition of

‘‘investment adviser’’ under the

Investment Advisers Act.73

(r) Investment company. We received

no substantive comments on the

proposed definition of ‘‘investment

company’’ and are adopting it as

proposed. The definition incorporates

the definition of ‘‘investment company’’

under the Investment Company Act,

whether or not the company is

registered with the Commission.74

(s) Nonaffiliated third party. We are

adopting the definition of nonaffiliated

third party as proposed. The proposal

defined the term as any ‘‘person’’

(including natural persons as well as

corporate entities) except (i) an affiliate

of a financial institution and (ii) a joint

employee of a financial institution and

a third party. The proposal clarified the

circumstances under which a company

that is controlled by a broker-dealer,

fund, or registered adviser through that

institution’s merchant banking activities

or insurance company activities would

be a ‘‘nonaffiliated third party’’ of the

broker-dealer, fund, or registered

adviser.

We received very few comments in

response to the proposed definition.

One commenter requested that the final

rule state that a disclosure of

information to someone who is serving

as a joint employee of two financial

institutions should be deemed to have

been disclosed to both financial

institutions. We disagree with this

result. Instead, we believe it is

appropriate to deem the information to

have been given to the financial

institution that is providing the

financial product or service in question.

Thus, for example, if an employee of a

bank is also an employee of a brokerage

firm, information that employee

receives in connection with a securities

transaction conducted with the

brokerage firm would be considered as

received by the brokerage firm.

(t) Nonpublic personal information.

We are revising the definition of

‘‘nonpublic personal information.’’

Section 509(4) of the G–L–B Act defines

the term to mean ‘‘personally

identifiable financial information’’ that

is provided by a consumer to a financial

institution, results from any transaction

with the consumer or any service

performed for the consumer, or is

otherwise obtained by the financial

institution. The term also includes any

‘‘list, description, or other grouping of

consumers (and publicly available

information pertaining to them) that is

derived using any nonpublic personal

information that is not publicly

available information.’’ The G–L–B Act

excludes publicly available information

(unless provided as part of the list,

description, or other grouping described

above), as well as any list, description,

or other grouping of consumers (and

publicly available information

pertaining to them) that is derived

without using nonpublic personal

information. The statute does not define

either ‘‘personally identifiable financial

information’’ or ‘‘publicly available

information.’’

The proposed rules implemented the

definition of ‘‘nonpublic personal

information’’ under the G–L–B Act by

restating the categories of information

described above. The proposed rules

treated information as publicly available

if a broker-dealer, fund, or registered

adviser could obtain it from a public

source. We also asked for comment on

an approach that would have deemed

information as ‘‘publicly available’’ only

if a financial institution actually

obtained it from a public source

(‘‘alternative approach’’).75 Most

commenters supported the proposed

approach to publicly available

Federal Register / Vol. 65, No. 126 / Thursday, June 29, 2000 / Rules and Regulations 40343

76See section 248.3(v)(1). See also 17 CFR

230.144A(d)(1), .903(b)(1)(i).

77Section 248.3(v)(2).

78See section 248.3(v)(3)(iii)(2).

79Compare Banking Agencies’ Release, supra

note 2, sections 40.3(p), 216.3(p), 332.3(p), 573.3(p)

(definition of ‘‘publicly available information’’).

80See sections 248.3(t)(2).

81See section 248.3(t)(3).

82See Proposing Release, supra note 4, at

discussion of proposed section 248.3(v).

information. They noted that the

proposed rule was consistent with the

Act and would be far less burdensome

on financial institutions. They also

stated that any requirement that the

information actually be obtained from a

public source would impose a needless

burden on financial institutions (by

requiring, for instance, that a financial

institution ‘‘tag’’ information it obtained

from public records) and is not required

by the Act. Other commenters

advocated the alternative approach.

They argued that the alternative

approach would provide the greatest

protection for consumers by treating any

information the consumer gives to a

financial institution to obtain a financial

product or service as nonpublic

personal information. This protection

would be lost only if a financial

institution actually obtained the

information from a public source. These

commenters also preferred the brightline distinction drawn by the alternative

approach.

The final rule adopts an approach that

we believe incorporates the benefits of

both alternatives. As under the

proposed rule, in the final rule

information will be deemed to be

‘‘publicly available’’ and therefore

excluded from the definition of

‘‘nonpublic personal information’’ if a

broker-dealer, fund, or registered

adviser reasonably believes that the

information is lawfully made available

to the general public from one of the

three categories of sources listed in the

rule.76 The examples provided in the

rule clarify when a broker-dealer, fund,

or registered adviser has a reasonable

belief that information is lawfully made

available to the general public. For

example, an institution would have a

reasonable belief if (i) the institution has

confirmed, or the consumer has

represented, that the information is

publicly available from a public source,

or (ii) the institution has taken steps to

submit the information, in accordance

with its internal procedures and policies

and with applicable law, to a keeper of

federal, State, or local government

records who is required by law to make

the information publicly available.77

The examples also state that a brokerdealer, fund, or registered adviser would

have a reasonable belief that a telephone

number is publicly available if the

institution located the number in a

telephone book or if the consumer told

the institution that the number is not

unlisted.78 Moreover, the examples

make clear that an institution may not

assume information about a particular

consumer is publicly available simply

because that type of information is

normally provided to a government

record keeper and made available to the

public by the record keeper, because the

consumer may have the ability to keep

that information non public or to screen

his or her identity.

The approach of the final rule is based

on the underlying principle that a

consumer in many circumstances can

control the public availability or

identification of his or her information

and that a financial institution therefore

should not assume that the information

about that customer is in fact publicly

available. Thus, even though a lender

typically enters a mortgage in public

records in order to protect its security

interest, when a borrower can maintain

the privacy of his or her personal

information by owning the property and

obtaining the loan through a separate

legal entity, the customer’s name would

not appear in the public record. In the

case of a telephone number, a person

may request that his or her number be

unlisted. Thus, in evaluating whether it

is reasonable to believe that information

is publicly available, a financial

institution must determine whether the

consumer has kept the information or

his or her identity from being a matter

of public record.79

To implement the complex definition

of ‘‘nonpublic personal information’’

that is provided in the statute, the final

rule adopts a definition that consists,

generally speaking, of (i) personally

identifiable financial information, plus

(ii) a consumer list or description or

grouping of consumers (and publicly

available information pertaining to the

consumers) that is derived using any

personally identifiable financial

information that is not publicly

available information. From that body of

information, the final rule excludes

publicly available information (except

as noted above or if the information is

disclosed in a manner that indicates that

the individual is the institution’s

consumer) and any consumer list that is

derived without using personally

identifiable financial information that is

not publicly available information.80

Examples illustrate how this definition

applies in the context of consumer

lists.81

(u) Personally identifiable financial

information. We are adopting the

definition of ‘‘personally identifiable

financial information’’ substantially as

proposed. The proposed rule defined

the term to include (i) information that

a consumer provides a broker-dealer,

fund, or registered adviser in order to

obtain a financial product or service, (ii)

information resulting from any

transaction between the consumer and a

broker-dealer, fund, or registered

adviser involving a financial product or

service, and (iii) information about a

consumer that a broker-dealer, fund, or

registered adviser otherwise obtains in

connection with providing a financial

product or service to the consumer. The

proposed rule also treated the fact that

someone is a consumer of a brokerdealer, fund, or registered adviser as

personally identifiable financial

information. In essence, the proposed

rules treated any personally identifiable

information as ‘‘financial’’ if a brokerdealer, fund, or registered adviser

obtained the information in connection

with providing a financial product or

service to a consumer. We noted in the

Proposing Release that this

interpretation may result in certain

information being covered by the rules

that may not commonly be considered

intrinsically financial, such as health

status.82

We received a large number of

comments in response to the definition

of ‘‘personally identifiable financial

information.’’ Many commenters

objected to including in the term certain

identifying information that they did

not view as ‘‘financial,’’ such as name,

address, and telephone number. Many

commenters argued that ‘‘personally

identifiable financial information’’

should not include the fact that

someone is a customer of a financial

institution. These commenters noted

that many customer relationships are

matters of public record (such as would

be the case, for instance, any time a

transaction results in the recording of a

security interest) while other customer

relationships are matters of public

knowledge (because consumers

frequently disclose the relationships by

writing checks, using credit cards, and

so on). Many commenters stated that

aggregate data about a financial

institution’s customers that lack

personal identifiers should not be

considered personally identifiable

financial information.

Treatment of identifying information

as financial. We continue to believe that

it is appropriate to treat any information

as ‘‘financial’’ information if a financial

institution obtains it in order to provide

40344 Federal Register / Vol. 65, No. 126 / Thursday, June 29, 2000 / Rules and Regulations

83We note that names, addresses, and telephone

numbers, if publicly available, will not be subject

to the opt out provisions of the statute unless that

information is ‘‘derivative information’’ (i.e.,

information that is part of a list, description, or

other grouping of consumers that is derived from

personally identifiable financial information that is

not publicly available information). An investment

adviser’s client list is an example of this type of

information, even if the list includes clients’ names,

addresses, and telephone numbers that are

otherwise publicly available. In circumstances in

which a consumer does not opt out, a financial

institution may disclose nonpublic personal

information about a consumer to a nonaffiliated

third party if the disclosure is consistent with the

institution’s opt out and privacy notices.

84See section 248.3(u)(2)(i)(F).

85See section 248.3(u)(2)(ii)(B).

a financial product or service. We also

believe this approach is consistent with

the G–L–B Act. Although the statute

does not define the term ‘‘financial,’’ it

does include a broad definition of

‘‘financial institution’’ used in the G–L–

B Act, which encompasses a large

number of entities (such as travel

agencies, insurance companies, and data

processors) that engage in activities not

traditionally considered financial. As a

consequence of that definition, the

range of information that has a bearing

on the terms and availability of a

financial product or service or that a

financial institution uses in connection

with providing a financial product or

service is extremely broad and may

include, for instance, medical

information and other types of

information that might not commonly

be thought of as financial. It includes

information a broker-dealer, fund, or

registered adviser requests from the

consumer, obtains from a transaction

involving a financial product or service

with the consumer, or otherwise obtains

in connection with providing a financial

product or service to a consumer. Thus,

the information included in the

definition of ‘‘financial’’ is information

the broker-dealer, fund, or registered

adviser has determined is relevant to

providing a financial product or service.

We are sensitive to the concern

expressed by several commenters about

the need for ready access to identifying

information to locate individuals who

are attempting to evade their financial

obligations. These commenters

suggested that names, addresses, and

telephone numbers should not be

treated as financial information. We

believe, however, that this information

is financial, and is covered by the G–L–

B Act. Broker-dealers, funds, and

registered advisers rely on a broad range

of information, including information

such as addresses and telephone

numbers, when providing financial

products or services. Broker-dealers,

funds, and registered advisers use

location information to provide a wide

variety of financial services, such as

sending account statements and

disbursing funds to a consumer. We

concluded that it would be

inappropriate to exclude certain items

of information from the definition of

personally identifiable financial

information simply because a particular

broker-dealer, fund, or registered

adviser might not rely on those items

when providing a particular financial

product or service.83

Customer relationship as ‘‘personally

identifiable financial information.’’ We

disagree with those commenters who

maintain that customer relationships

should not be considered to be

personally identifiable financial

information. This information is

‘‘personally identifiable’’ because it

identifies the individual as a customer

of the institution. The information is

financial because it reveals a financial

relationship with the institution and the

receipt of financial products or services

from the institution.

Changes made to the definition. We

have revised the definition of

‘‘personally identifiable financial

information’’ to make it easier to read

and understand. In addition, the final

rule adds to the examples of information

covered by the rule any information that

the institution collects through an

information-collecting device from a

web server, often referred to as a

‘‘cookie.’’ 84 This example illustrates

one of the many ways that a financial

institution may obtain information

about a consumer in connection with

providing a financial product or service

to that consumer.

In addition, in response to many

comments from the securities industry,

the final rule also includes an example

that clarifies that aggregate information

(or ‘‘blind data’’) lacking personal

identifiers is not covered by the

definition of ‘‘personally identifiable

financial information.’’ 85 We agree with

the commenters who argued that this

type of data does not ‘‘identify’’ any

individual.

(v) Publicly available information. We

are adopting the definition of ‘‘publicly

available information’’ substantially as

proposed. The proposal defined the

term to include information that is

lawfully available to the general public

from official public records (such as real

estate recordations or security interest

filings), information from widely

distributed media (such as a telephone

book, television or radio program, or

newspaper), and information that is

required to be disclosed to the general

public by federal, State, or local law

(such as prospectuses and periodic

shareholder reports). The proposed rule

stated that publicly available

information from widely distributed

media would include information from

an Internet site that is available to the

general public without requiring a

password or similar restriction. As

previously explained in the discussion

of ‘‘nonpublic personal information,’’

we have adopted the proposed approach

in the final rule, but with additional

clarifying provisions.

Many commenters questioned the

appropriateness of excluding from the

definition of ‘‘publicly available

information’’ information that a person

obtains over the Internet by using a

password or complying with a similar

restriction. These commenters noted

that many Internet sites are available to

a large number of people, each of whom

needs a user name and identification

number to access the sites. Several of

these commenters suggested that it

would be more appropriate to focus on

whether the information was lawfully

placed on the Internet.

We agree with these comments, and

have revised the final rule to remove the

reference to passwords or similar

restrictions from the example of the

Internet as a ‘‘widely distributed’’

medium of communication. In its place,

we have substituted a standard that

requires the information, whether from

the Internet or otherwise, to be available

on an unrestricted basis. Information

that an individual specifically requests

be compiled, such as information that a

locator or ‘‘look up’’ service provides

with respect to a particular individual

that may combine confidential

information in addition to publicly

available information, will not be

considered available to the general

public on an unrestricted basis,

regardless of whether the information is

provided over the Internet or otherwise.

The rule also states that an Internet site

is not restricted merely because an

Internet service provider or a site

operator requires a fee or password, as

long as access is otherwise available to

the general public. One common use of

passwords is to confine the access of

web site users to specific, individual

information. However, web site

operators also may require user

identifications and passwords as a

method of tracking access rather than

restricting access to the information

available through the website. Internet

service providers may charge fees to

users to access the site rather than to

restrict access to particular information.

Other sites available to the general

public, such as daily newspapers, also

may charge a fee to access archived

Federal Register / Vol. 65, No. 126 / Thursday, June 29, 2000 / Rules and Regulations 40345

86See section 248.3(v)(1).

87As noted above, however, broker-dealers and

funds that provide insurance products that also are

securities and registered advisers who provide

advice with respect to those products will be

subject to this part with respect to their provision

of those securities and advice about those

securities. See supra discussion of section 248.1.

88 G–L–B Act § 503(a).

89 G–L–B Act § 502(a).

90See proposed section 248.4.

91Section 248.4(a)(1).

92 17 CFR 240.10b–16. See Proposing Release,

supra note 4, at text accompanying n.35.

93 17 CFR 275.204–3(b) (requiring delivery of the

brochure (i) not less than 48 hours before entering

into an investment advisory contract with the client

or (ii) at the time of entering into the contract as

long as the client has at least 5 business days to

cancel the contract without penalty).

94See section 248.4(e)(1)(i).

95See 15 U.S.C. 78eee–78fff–1.

information. Therefore, we believe that

the definition of ‘‘widely distributed

media’’ should properly focus on

whether the information is lawfully

available to the general public, rather

than on the type of medium from which

information is obtained.

We note that the concept of

information being lawfully obtained was

included in the proposal, and is

retained in the final rule.86 Thus,

information unlawfully obtained will

not be deemed to be publicly available

notwithstanding that it may be available

to the general public through widely

distributed media.

(w) You. We are adopting the

definition of ‘‘you’’ largely as proposed.

The proposed definition of ‘‘you’’

referred to broker-dealers, funds, and

registered advisers, which are the

entities within the Commission’s

jurisdiction under Title V. We are,

however, revising the definition to

clarify that the provision of insurance

by financial institutions under the

Commission’s primary jurisdiction is

not covered under these rules.87

A. Subpart A—Privacy and Opt Out

Notices

Sections 248.4 through 248.9 of

Regulation S–P include requirements

concerning the delivery of initial and

annual notices about the privacy

policies and practices of a financial

institution, and about the opportunity

and methods for consumers to opt out

of their institution’s sharing of their

nonpublic personal information with

nonaffiliated third parties.

Section 248.4 Initial Privacy Notice to

Consumers Required

We are revising the requirements

relating to initial privacy notices to

consumers, in response to issues raised

by commenters. The G-L-B Act requires

a financial institution to provide an

initial notice of its privacy policies and

practices in two circumstances. For

customers, the notice must be provided

at the time of establishing a customer

relationship.88 For consumers who are

not customers, the notice must be

provided before disclosing nonpublic

personal information about the

consumer to a nonaffiliated third

party.89

The proposed rules implemented

these requirements by mandating that a

financial institution provide the initial

notice to an individual prior to the time

a customer relationship is established

and the opt out notice prior to

disclosing nonpublic personal

information to nonaffiliated third

parties. The rule required these

disclosures to be clear and conspicuous

and to accurately reflect the institution’s

privacy policies and practices. The

proposal also set out rules governing

when a customer relationship is

established and how a financial

institution is to provide notice.90

We received many comments raising

concerns about proposed section 248.4.

Most commenters from the securities

industry raised questions about the time

when initial notices must be provided,

the point at which a customer

relationship is established, and how

initial notices may be provided.

Providing initial notices ‘‘prior to’’

time customer relationship is

established. Almost all the commenters

from the securities industry stated that,

because the statute requires only that

the initial notice be provided ‘‘at the

time of establishing a customer

relationship,’’ the regulation should not

require that the notice be provided

‘‘prior to’’ the point when a customer

relationship is established. Some of

these commenters were concerned that

the rule could be interpreted as

requiring a financial institution to

provide disclosures at a point different

from when they must provide other

federally mandated consumer

disclosures during the process of

establishing a customer relationship.

Although we believe many

commenters misinterpreted the

proposed language concerning the

timing for providing initial notices, we

have revised the rule to clarify the

requirement. The final rule states that,

as a general rule, the initial notice must

be given not later than the time when a

financial institution establishes a

customer relationship.91 As stated in the

Proposing Release, the initial notices

may be provided at the same time a

broker-dealer, fund, or registered

adviser is required to give other notices,

such as the requirement that credit

terms in margin transactions be

disclosed,92 or that a registered adviser

provide each client with a written

disclosure statement (‘‘brochure’’) not

later than the time of entering an

investment advisory contract with the

client.93 This approach, like the

approach taken in the proposed rule,

strikes a balance between (i) ensuring

that consumers will receive privacy

notices at a meaningful point during the

process of ‘‘establishing a customer

relationship’’ and (ii) minimizing

unnecessary burden on broker-dealers,

funds, and registered advisers that may

otherwise result if the final rule were to

require financial institutions to provide

consumers with a series of notices at

various times in a transaction.

Providing notices after customer

relationship is established. Several

commenters stated that the rule should

provide financial institutions with the

flexibility to deliver the initial notice

after the customer relationship is

established under certain

circumstances. These commenters

offered several situations in which a

customer relationship is established

without direct contact between the

consumer and the financial institution.

The commenters stated that delivery of

the initial notice before the customer

relationship is established in these

situations would be impractical.

Commenters also indicated that in many

circumstances requiring delivery at this

time would have a significant adverse

effect on the ability to provide a

financial product or service to a

consumer as quickly as the consumer

desires.

To accommodate the wide range of

situations presented by the commenters,

we have modified the examples of when

subsequent delivery of the initial notice

is appropriate, so that they now are

more broadly applicable. As stated in

the final rule in section 248.4(e), a

broker-dealer, fund, or registered

adviser may satisfy the delivery

requirement by providing the initial

notice within a reasonable time after

establishing a customer relationship, in

three instances. First, the institution

may provide notice after the fact if the

customer has not elected to establish the

customer relationship.94 This might

occur, for example, when a brokerage

account is transferred to another broker

by a trustee selected by the Securities

Investor Protection Corporation

(‘‘SIPC’’) and appointed by a United

States Court.95 Second, a broker-dealer,

fund, or registered adviser may send a

notice after establishing a customer

relationship when to do otherwise

40346 Federal Register / Vol. 65, No. 126 / Thursday, June 29, 2000 / Rules and Regulations

96See section 248.4(e)(1)(ii).

97See section 248.4(e)(1)(iii).

98See, e.g, section 248.9(b)(1)(iii) (example of

reasonable expectation that consumer will receive

actual notice of initial privacy notice on Internet

web site provides that consumer acknowledges

receipt of notice as a necessary step to obtaining a

particular financial product or service).

99See section 248.4(e)(1).

100See Proposing Release, supra note 4, at

discussion of proposed section 248.4.

101See section 248.4(d).

102A few commenters noted that disclosure

obligations arising from joint accounts are well

settled under other rules, such as the regulations

implementing the Equal Credit Opportunity Act,

see 12 CFR part 202, and the Truth in Lending Act,

15 U.S.C. 1601. Commenters noted that under both

Regulation B and Regulation Z, a financial

institution is permitted to give one notice. The

authorities cited include requirements that the

financial institution give disclosures as appropriate

to the ‘‘primary applicant’’ if readily apparent, see

12 CFR 202.9(f), or to a person ‘‘primarily liable on

the account.’’ See 12 CFR 226.5(b).

103See section 248.9(g).

104See discussion of section 248.9 below on how

to provide opt out notices.

105 If the surviving or acquiring institution does

not deliver new notices, it must honor any opt outs

the predecessor or acquired institution received

from consumers.

106Proposing Release, supra note 4, at section

discussing proposed section 248.4.

107See section 248.5(a).

108Proposed section 248.5(c)(1).

would substantially delay the

consumer’s transaction and the

consumer agrees to receive the notice at

a later time.96 An example of this is

when an investor requests over the

telephone that a broker-dealer execute a

securities trade. The final example

states that delayed delivery is

permissible when a nonaffiliated brokerdealer or registered adviser purchases

fund shares or establishes a brokerage

account on behalf of a customer.97

We note that in most situations, a

broker-dealer, fund, or registered

adviser should give the initial notice at

a point when the consumer still has a

meaningful choice about whether to

enter into the customer relationship.98

The exceptions listed in the examples,

while not exhaustive, are intended to

illustrate the less frequent situations

when delivery either would pose a

significant impediment to the conduct

of a routine business practice or the

consumer agrees to receive the notice

later in order to obtain a financial

product or service immediately.

In circumstances when it is

appropriate to deliver an initial notice

after the customer relationship is

established, a broker-dealer, fund, or

registered adviser should deliver the

notice within a reasonable time

thereafter. Several commenters

requested that the final rule specify how

many days a financial institution has in

which to deliver the notice under these

circumstances. However, we believe

that a rule prescribing the maximum

number of days would be inappropriate

because (i) the circumstances of when

an after-the-fact notice is appropriate are

likely to vary significantly, and (ii) a

rule that attempts to accommodate every

circumstance is likely to provide more

time than is appropriate in many

instances. Therefore, we have retained

the more general rule as set out in the

proposal.99

As we noted in the Proposing Release,

nothing in the rule is intended to

discourage a financial institution from

providing an individual with a privacy

notice at an earlier point in the

relationship in order to make it easier

for the individual to compare its privacy

policies and practices with those of

other institutions in advance of

conducting transactions.100

New notices not required for each

new financial product or service.

Several commenters asked whether a

new initial notice is required every time

a consumer obtains a financial product

or service from that broker-dealer, fund,

or registered adviser. These commenters

suggested that a consumer would not

materially benefit from repeated

disclosures of the same information, and

that requiring additional initial notices

to be provided to the same consumer

would be burdensome on financial

institutions.

We agree that it would be

burdensome, with little corresponding

benefit to the consumer, to require a

financial institution to provide the same

consumer with additional copies of its

initial notice every time the consumer

obtains a financial product or service.

Accordingly, the final rule states that a

broker-dealer, fund, or registered

adviser will satisfy the notice

requirements when an existing customer

obtains a new financial product or

service if the institution’s initial,

revised, or annual notice (as

appropriate) is accurate with respect to

the new financial product or service.101

Joint accountholders. We agreed with

several commenters who recommended

that the final rule state that a financial

institution is not obligated to provide

more than one notice to joint

accountholders.102 Accordingly, the

final rule clarifies that one notice may

be sent in connection with a joint

account.103 A broker-dealer, fund, or

registered adviser may, in its discretion,

provide notices to each party to the

account. This situation might arise, for

example, when a financial institution

does not want one opt out election to

apply automatically to all joint

accountholders.104

Mergers. A few commenters requested

guidance on what notices are required

in the event of a merger of two financial

institutions or an acquisition of one

financial institution by another. In such

a situation, the need to provide new

initial (and opt out) notices to the

customers of the entity that ceases to

exist will depend on whether the

notices previously given to those

customers accurately reflect the policies

and practices of the surviving entity. If

they do, the surviving entity will not be

required under the rule to provide new

notices.105

As was stated in the Proposing

Release, a financial institution may not

fail to maintain the protections that it

represents in the notice that it will

provide.106 We expect that brokerdealers, funds, and registered advisers

will take appropriate measures to

adhere to their stated policies and

practices.

Section 248.5 Annual Privacy Notice

to Customers Required

We are adopting largely as proposed

the requirements relating to annual

privacy notices to consumers. Section

503 of the G–L–B Act requires a

financial institution to provide notices

of its privacy policies and practices at

least annually to its customers ‘‘during

the continuation’’ of a customer

relationship. The proposed rules

implemented this requirement by

requiring a clear and conspicuous notice

that accurately reflects the privacy

policies and practices then in effect to

be provided at least once during any

period of twelve consecutive months.107

The proposed rule noted that the rule

governing how to provide an initial

notice also would apply to annual

notices, and stated that a financial

institution would not be required to

provide annual notices to a customer

with whom it no longer has a

continuing relationship.108

Many commenters from the securities

industry requested that the final rule

permit annual notices to be given each

calendar year, instead of every 12

months. A few commenters

recommended that the rule require

notices each calendar year, with no

more than 15 months elapsing between

mailings. To clarify the extent of

financial institutions’ flexibility, the

final rule retains the general rule

requiring annual notices but then

provides an example, stating that a

broker-dealer, fund, or registered

adviser may select a calendar year as the

Federal Register / Vol. 65, No. 126 / Thursday, June 29, 2000 / Rules and Regulations 40347

109See section 248.5(a)(2).

110The G–L–B Act states that ‘‘not less than

annually during the continuation of [a customer]

relationship, a financial institution shall provide a

clear and conspicuous disclosure to such consumer

[i.e., one with whom a customer relationship has

been formed], * * * of such financial institution’s

policies and practices with respect to’’ the

information enumerated in the Act. G–L–B Act

§ 503.

111See also discussion of section 248.9 below.

112Members of the banking industry also

commented on the paragraph in this section

regarding termination of a customer relationship

and examples set forth in the Banking Agencies’

proposing release. See section 248.5(b). We have

made a technical revision to one of the examples

in response to the only comment that specifically

addressed the Commission’s proposed examples.

See section 248.5(b)(2)(iii). 113See section 248.6(e).

12-month period within which notices

will be provided, and deliver the first

annual notice at any point in the

calendar year following the year in

which the customer relationship was

established.109 The final rule also

requires that a broker-dealer, fund, or

registered adviser apply the 12-

consecutive-month period to its

customers consistently.

Several commenters suggested that a

financial institution be permitted to

make the annual notice available upon

request only, particularly if there have

been no material changes to the notice

since it was last delivered. These

commenters argued that little value is

added by providing customers with

additional copies each year of the same

information. Some suggested that

financial institutions be permitted to

provide a ‘‘short-form’’ annual notice, in

which the institution informs its

customers that there has been no change

to its privacy policies and practices and

that the customers may obtain a copy

upon request.

We have not amended the final rule

to permit this approach, for two reasons.

First, we believe that the G–L–B Act

requires a full set of disclosures to each

customer once a year.110 Second, the

revisions to the disclosure provisions

reflected in the final rule clarify that a

broker-dealer, fund, or registered

adviser is not required to provide a

lengthy and detailed privacy notice.

Small institutions that do not share

information with third parties beyond

the statutory exceptions should be able

to provide a short, streamlined notice.

The rule also permits a broker-dealer,

fund, or registered adviser to provide

annual notices to customers over the

institution’s web site if the customer

conducts transactions electronically and

agrees to the electronic disclosures.111

As a result, the final rule achieves much

of the burden reduction sought by those

requesting a short-form annual notice

option.112

Section 248.6 Information To Be

Included in Initial and Annual Privacy

Notices

We are revising the requirements for

information to be included in initial and

annual privacy notices. The revisions

clarify the level of detail required in

these notices, and permit a ‘‘short-form’’

initial notice in certain circumstances.

Section 503 of the G–L–B Act

identifies the items of information that

a broker-dealer, fund, or registered

adviser must include in its initial and

annual notices. Section 503(a) of the GL-B Act sets out the general requirement

that a financial institution must provide

customers with a notice describing the

institution’s policies and practices with

respect to, among other things,

disclosing nonpublic personal

information to affiliates and

nonaffiliated third parties. Section

503(b) of the Act identifies certain

elements that must be addressed in that

notice.

The proposed rule implemented

section 503 by requiring a financial

institution to provide information

concerning:

• The categories of nonpublic

personal information that a brokerdealer, fund, or registered adviser may

collect;

• The categories of nonpublic

personal information that a brokerdealer, fund, or registered adviser may

disclose;

• The categories of affiliates and

nonaffiliated third parties to whom a

broker-dealer, fund, or registered

adviser discloses nonpublic personal

information, other than those to whom

information is disclosed under an

exception in section 502(e) of the G–L–

B Act;

• The broker-dealer, fund, or

registered adviser’s policies with respect

to sharing information about former

customers;

• The categories of information that

are disclosed under agreements with

third party service providers and joint

marketers and the categories of third

parties providing the services;

• A consumer’s right to opt out of the

disclosure of nonpublic personal

information to nonaffiliated third

parties;

• Any disclosures regarding affiliate

information sharing opt outs a financial

institution is providing under the Fair

Credit Reporting Act; and

• The institution’s policies and

practices with respect to protecting the

confidentiality, security, and integrity of

nonpublic personal information.

We received a large number of

comments concerning these

requirements, and most made the points

summarized below.

Level of detail required. Many

commenters observed that the level of

detail required by the proposed rule

would result in lengthy, complicated,

and confusing disclosures. These

comments have led us to revise the rule

to clarify the level of detail required in

a financial institution’s initial and

annual disclosures.

We do not intend to require a brokerdealer, fund, or registered adviser to

publish lengthy disclosures that

precisely identify every type of

information collected or shared, the

name of every entity with which the

institution shares information, and a

complete description of the technical

specifications of how the institution

protects its customers’ records or the

identity of each employee who has

access to those records. Instead, the rule

is intended to require notices that

provide consumers with the types of

third parties with which a financial

institution shares nonpublic personal

information, the types of information it

shares, and the other information about

the institution’s privacy policies and

practices listed above. The final rule,

like the proposal, permits a brokerdealer, fund, or registered adviser to

comply with these notice requirements

by describing its privacy policies and

practices.113 We believe that in most

cases the initial and annual disclosure

requirements can be satisfied by

disclosures contained in a tri-fold

brochure.

In response to commenters’ concerns

that consumers will not read long,

detailed disclosures, we have revised

the examples of the disclosures to

clarify the level of detail that we think

is appropriate. We have provided

sample clauses in the Appendix to the

rules, and have set out a compliance

guide below in this release. Because the

examples are not exclusive, the final

rule permits a financial institution to

use different categories than those

provided in the examples, thereby

providing additional flexibility for

financial institutions in complying with

the disclosure requirements. In

addition, we have revised the language

that precedes the items of information to

be addressed in the initial notice, to

clarify that a broker-dealer, fund, or

registered adviser is required only to

address those items that apply to the

institution. Thus, for instance, if an

investment adviser does not disclose

nonpublic personal information to third

parties, it may simply omit any

reference to the categories of affiliates

40348 Federal Register / Vol. 65, No. 126 / Thursday, June 29, 2000 / Rules and Regulations

114Proposing Release, supra note 4, at discussion

of proposed section 248.6.

115See 15 U.S.C. 1681a(d)(2)(A)(iii). Section

603(d)(2)(A)(iii) of the FCRA excludes from the

definition of ‘‘consumer report’’ the communication

of certain consumer information among affiliated

entities if the consumer is notified about the

disclosure of such information and given an

opportunity to opt out of the disclosure of that

information. The information that can be disclosed

to affiliates under this provision includes, for

instance, information from consumer reports and

applications for financial products or services. In

general, this information includes personal

information provided directly by the consumer to

the institution, such as income and assets, in

addition to information contained within consumer

reports.

116See, e.g., remarks of Sen. Gramm (noting that

the privacy bill contains ‘‘for the first time a full

disclosure requirement. It requires every bank in

America, when you open your account to tell you

precisely what their policy is: Do they share

personal financial information within the bank? Do

they share it outside the bank?’’), 145 Cong. Rec.

S13786 (daily ed. Nov. 3, 1999); remarks of Sen.

Hagel, id. at S13876 (‘‘Financial institutions would

be required to disclose their privacy policies to

their customers on a timely basis. If customers do

not believe adequate protections exist at their

institution, they can take their business

elsewhere.’’).

117Commenters from other industries who

addressed the issue argued that a financial

institution should not be required to include FCRA

disclosures in its annual notices. To the extent that

broker-dealers share information about margin

loans, they may be subject to the FCRA. As

previously discussed, section 503(b)(4) of the G–L–

B Act requires a financial institution’s initial and

annual notice to include the disclosures required,

if any, under section 603(d)(2)(A)(iii) of the FCRA.

The proposed rules implemented section 503(b)(4)

of the G–L–B Act by requiring that a broker-dealer,

fund, or registered adviser’s initial and annual

notice include any disclosures a financial

institution makes under section 603(d)(2)(A)(iii) of

the FCRA. Proposed section 248.6(a)(7). Several

commenters noted that the FCRA requires

disclosures of a consumer’s right to opt out of

affiliate sharing only once, and that the G–L–B Act

states, in section 506(c), that nothing in the

G–L–B Act is to be construed to modify, limit, or

supersede the operation of the FCRA. These

commenters maintain that the ‘‘if any’’ language of

section 503(b)(4), read in the context of section 506,

suggests that, because at most only one notice must

be provided under the FCRA, section 503 should

require only one FCRA disclosure under the privacy

rules.

As discussed above, we believe that in order to

comply with the requirement that it disclose its

policies and practices with respect to sharing

information with affiliated and nonaffiliated third

parties, a financial institution must describe the

circumstances under which it will share

information with affiliates. The ability of consumers

to opt out of affiliate information sharing under the

FCRA affects a financial institution’s policies and

practices with respect to disclosing information to

its affiliates. Failing to include this information and

an explanation of how the opt out right may be

exercised would make the disclosures incomplete.

In addition, section 503 does not distinguish

between the disclosures to be provided in the initial

notice from those to be provided in the annual

notice. Thus, section 503 suggests that any

disclosures that are required under the FCRA must

be included in both the initial and annual notices.

We interpret the ‘‘if any’’ language as an

acknowledgment that not all institutions provide

FCRA notices because not all institutions engage in

the type of affiliate sharing covered by the FCRA.

We do not believe that requiring the FCRA notice

to appear as part of the annual notice under the

privacy rules, modifies, limits, or supersedes the

and nonaffiliated third parties to whom

the institution discloses nonpublic

personal information.

As noted in the Proposing Release, the

required content is the same for both the

initial and annual notices of privacy

policies and practices.114 While the

information contained in the notices

must be accurate as of the time the

notices are provided, a financial

institution may prepare its notices based

on current and anticipated policies and

practices.

Short-form initial notice. We have

reconsidered the need to give

consumers a copy of a financial

institution’s complete initial notice

when there is no customer relationship.

In these circumstances, we believe that

the objectives of the statute can be

accomplished in a less burdensome way

than was proposed. Accordingly, we

have exercised our exemptive authority

under section 504(b) to create an

exception to the general rule that a

financial institution must provide both

the initial and opt out notices to a

consumer before disclosing nonpublic

personal information about that

consumer to nonaffiliated third parties.

Section 248.6(d) provides that a

financial institution may provide a

‘‘short-form’’ initial privacy policy

notice along with the opt out notice to

a consumer with whom the institution

does not have a customer relationship.

The short-form notice must clearly and

conspicuously state that the disclosure

containing information about the

institution’s privacy policies and

practices is available on request, and

must provide one or more reasonable

means by which the consumer may

obtain a copy of the notice. We believe

that the short-form is appropriate

because a consumer who does not

become a customer of a broker-dealer,

fund, or registered adviser may have

less interest in certain elements of the

institution’s privacy policies. Thus, the

consumer may receive greater benefit

from obtaining a short-form notice with

the opt out notice, which informs the

consumer about the categories of his or

her information the institution may

share and the categories of nonaffiliated

third parties that may receive the

information. The rule also requires a

broker-dealer, fund, or registered

adviser to provide a consumer who is

interested in the more complete privacy

disclosures with a reasonable means to

obtain them.

Information about affiliate sharing.

Several commenters suggested that the

rule should not require that initial and

annual notices include categories of

affiliates with whom a financial

institution shares information. These

commenters noted that the Act

specifically requires disclosures of

categories of nonaffiliated third parties

only, and that the only statutorily

mandated disclosures concerning

affiliate sharing are disclosures

required, if any, concerning affiliate

sharing under the Fair Credit Reporting

Act (‘‘FCRA’’).115 These commenters

concluded that the Commission and the

Agencies, by expanding the disclosure

requirements in the manner prescribed

in the proposed rule, would be

exceeding their rulemaking authority

and imposing an unnecessary burden on

financial institutions.

We believe that the language and

legislative history of section 503 support

requiring disclosures of affiliate sharing

beyond what may be required by the

FCRA. First, section 503(b) does not

state that the items listed in the section

are to be the only items set out in a

financial institution’s initial and annual

disclosures. Instead, it uses the

nonrestrictive phrase ‘‘shall include’’

when discussing the contents of the

disclosures, thereby preserving

flexibility for the Commission (which

was expressly granted authority under

section 503(a) to prescribe rules

governing these notices) to require that

additional items be addressed in the

disclosures consistent with those

specifically enumerated.

Second, section 503(a) states that the

financial institution shall provide in its

initial and annual notices ‘‘a clear and

conspicuous disclosure * * * of such

financial institution’s policies and

practices with respect to—(1) disclosing

nonpublic personal information to

affiliates and nonaffiliated third parties,

consistent with section 502, including

the categories of information that may

be disclosed; * * *’’ While the FCRA

disclosures would be a subset of the

disclosures required by section

503(a)(1), they may not be sufficient to

fully satisfy that requirement.

Third, the legislative history of the G–

L–B Act suggests that Congress intended

the disclosures to provide more

information about affiliate sharing than

what may be required under the

FCRA.116 That history underscores the

Congressional intent of ensuring that

individuals are given the opportunity to

make informed decisions about the

privacy policies and practices of

financial institutions. We believe that

limiting the disclosures about affiliate

sharing just to those disclosures that

may be required under the FCRA would

frustrate that purpose.117

Federal Register / Vol. 65, No. 126 / Thursday, June 29, 2000 / Rules and Regulations 40349

operation of the FCRA; financial institutions will

have exactly the same FCRA obligations following

the effective date of the privacy rules as they had

before. The only difference will be that, as required

by the G–L–B Act, a financial institution’s initial

and annual disclosures about its privacy policy and

practices will need to reflect how the institution

complies with the affiliate sharing provisions of the

FCRA.

118See section 248.8(a).

119See section 248.7(d).

120See section 248.7(a)(2)(iv).

121See section 248.7(a)(2)(iii)(A).

122See section 248.7(a)(2)(ii)(D).

123See proposed section 248.8(e).

124See section 248.7(g)(1).

125See section 248.7(g)(2).

126See section 248.7(a)(1).

127See proposed section 248.8(a)(2)(i) (a financial

institution ‘‘provides adequate notice * * * if [the

institution] identifies all of the categories of

nonpublic personal information that [the

institution] discloses or reserves the right to

disclose to nonaffiliated third parties as described

in [section 248.6]’’).

Disclosures of the right to opt out.

Other commenters suggested that the

final rule eliminate the requirement that

the initial and annual notices contain

disclosures about a consumer’s right to

opt out. These commenters pointed out

that the statute does not specifically

require these disclosures.

As previously discussed, section

503(a) of the statute requires a financial

institution to disclose its policies and

practices with respect to sharing

information, both with affiliated and

nonaffiliated third parties. Given that a

financial institution’s practices with

respect to sharing nonpublic personal

information with nonaffiliated third

parties will be affected by the opt out

rights created by the statute, an

institution will need to describe these

opt out rights in order to provide a

complete disclosure that satisfies the

statute.

Other comments. We received many

comments expressing support for a

number of the provisions in proposed

section 248.6. For example, several

commenters agreed with the approach

of permitting a financial institution to

state generally that it makes disclosures

to nonaffiliated third parties ‘‘as

permitted by law’’ to describe

disclosures made under one of the

exceptions. Others agreed with the

proposed flexibility to allow a

disclosure to be based on current and

contemplated information sharing. In

light of these comments, we have

adopted proposed section 248.6 with

changes as discussed above. The final

rule makes several other stylistic

changes to the material in section 248.6

that are intended to make the rule easier

to read.

Section 248.7 Form of Opt Out Notice

to Consumers; Opt Out Methods

We are adopting as proposed the

requirement that any opt out notice

provided by a broker-dealer, fund, or

registered adviser be clear and

conspicuous and accurately explain the

right to opt out.118 The final rule also

requires, as proposed, that a financial

institution provide the consumer with a

reasonable means by which to opt out,

and honor an opt out election as soon

as reasonably practicable. The rule also

states that an opt out election survives

until revoked by the consumer. In

addition, we have adopted provisions to

address the application of these rules to

joint accounts, the means by which an

opt out right may be exercised, duration

of an opt out, the level of detail required

in the opt out notice, and the time by

which an opt out election must be

honored. The final rule also includes

stylistic changes to make it easier to

read.

Joint accounts. We agree with the

commenters who stated that a financial

institution should have the option of

providing one notice per account,

regardless of the number of persons on

the account, and the final rule includes

a new section to address this issue.119

Under the final rule, a financial

institution may provide one initial,

annual, and opt out notice per account.

However, each of the accountholders

must have the right to opt out. The final

rule also requires a broker-dealer, fund,

and registered adviser to state in the opt

out notice provided to a joint

accountholder whether the institution

will consider an opt out by a joint

accountholder as an opt out by all of the

accountholders or whether each

accountholder is permitted to opt out

separately.

Means of opting out. At the suggestion

of many commenters, the final rule

includes a provision that permits a

broker-dealer, fund, or registered

adviser to require that a consumer opt

out through a specific means, if the

means is reasonable for the

consumer.120 We recognize that a

financial institution may not have

systems in place or trained personnel to

handle opt out elections at each point of

contact between a consumer and

financial institution and therefore may

choose not to honor opt out elections

communicated to the institution

through means other than those

specified for the consumer.

As was proposed, the examples

provide that a broker-dealer, fund, or

registered adviser may not require a

consumer to write his or her own letter

in order to opt out.121 The final rule

adds an example of a toll-free telephone

number as another way by which

financial institutions may allow

consumers to opt out.122

Duration of opt out. Several

commenters requested changes to the

proposed provision concerning duration

of an opt out.123 They noted that a

financial institution would be required

to keep track of opt out elections if, for

example, a person opts out during the

course of establishing a customer

relationship with a financial institution,

terminates that relationship, and then

establishes another customer

relationship several years later, perhaps

under a different name or with someone

on a joint account. The commenters

suggested that it would be more

appropriate in these circumstances to

treat the opt out election made in

connection with the first relationship as

applying solely to that relationship.

We agree with the commenters’

suggestions. Under the final rule, a

broker-dealer, fund, or registered

adviser is to treat an opt out election

made by a customer in connection with

a prior customer relationship as

applying solely to the nonpublic

personal information that the institution

collected during, or related to, that

relationship. That opt out will continue

until the customer revokes it.124

However, if the customer relationship

terminates and a new one is established

at a later point, the institution must then

provide a new opt out notice to the

customer in connection with the new

relationship, and any prior opt out

election does not apply to the new

relationship.125

Level of detail required in opt out

notice. We are adopting as proposed the

rule requirements for the form of the opt

out notice.126 A few commenters

interpreted the proposal as requiring a

more detailed disclosure of categories of

nonpublic personal information and

nonaffiliated third parties in the opt out

notice than is required in the initial and

annual notices.127 We did not intend

this result, and specifically referred to

section 248.6 in the proposed opt out

provision to address precisely this

concern. The disclosures in the initial

and annual notices of the categories of

nonpublic personal information being

disclosed and the categories of

nonaffiliated third parties to whom the

information is disclosed will suffice for

the opt out notices as well. If the opt out

notice is a part of the same document

that contains the disclosures that must

be included in the initial notice, then

the financial institution is not required

to restate those disclosures in the opt

out notice. In these circumstances, the

rule requires only that when the opt out

40350 Federal Register / Vol. 65, No. 126 / Thursday, June 29, 2000 / Rules and Regulations

128See section 248.7(e).

129See section 248.8. The final rule is in a

separate section for emphasis. 130See section 248.8(a)(1). 131See section 248.8(b). 132See proposed sections 248.4(d) (initial notice),

248.5(b) (annual notice), and 248.8(b) (opt out

notice). 133See section 248.9. 134Section 248.9(a). 135See section 248.9(b)(1)(iii). 136Nevertheless, there may be circumstances in

which an Internet web site notice might be

delivered in a way that will enable the brokerdealer, fund, or registered adviser to reasonably

expect that the consumer will receive it.

137See section 248.9(c)(i).

138See Delivery of Disclosure Documents to

Households, Investment Company Act Release No.

24123 (Nov. 4, 1999) [64 FR 62540 (Nov. 16, 1999)].

The Commission also has proposed rule

amendments to permit householding of proxy or

information statements. See Delivery of Proxy and

Information Statements to Households, Investment

Company Act Release No. 24124 (Nov. 4, 1999) [64

FR 62548 (Nov. 16, 1999)]. The comment period on

this proposal ended January 18, 2000.

139See section 248.9(c)(2).

and privacy notices are read together,

they clearly disclose the categories of

nonpublic personal information the

institution intends to share and the

categories of nonaffiliated third parties

with whom it will share.

One commenter suggested that, while

a broker-dealer, fund, or registered

adviser should have the option of

providing an opt out notice that is

sufficiently broad to cover anticipated

disclosures, the institution also should

be permitted to provide a customer who

already has opted out with a new opt

out notice in connection with a new

financial product or service. If the

consumer does not opt out a second

time, the institution would be free to

disclose nonpublic personal information

obtained in connection with that

financial product or service.

We agree that a broker-dealer, fund, or

registered adviser should have the

flexibility to provide opt out notices that

are either narrowly tailored to specific

types of nonpublic personal information

and types of nonaffiliated third parties

or that are more broadly worded to

anticipate future disclosure plans. We

note, however, that when a consumer

has elected to opt out of sharing certain

nonpublic personal information, the opt

out remains in effect until the consumer

affirmatively revokes the opt out.

Similarly, when a consumer opts out

after receiving an opt out notice that is

broad enough to cover the new type of

information the institution intends to

share, the consumer does not have to

opt out again.

Time by which opt out must be

honored. We are adopting in the final

rule the proposed requirement that a

financial institution comply with an opt

out election ‘‘as soon as reasonably

practicable.’’ 128 Many commenters

asked us to clarify in the final rule when

a financial institution must stop

disclosing nonpublic personal

information to nonaffiliated third

parties after it receives an opt out.

Suggestions for a more precise standard

ranged from immediate to several

months after receiving the opt out. We

believe that a more general rule is

appropriate in light of the wide range of

practices among financial institutions. A

broker-dealer, fund, or registered

adviser might view a specific standard

as a safe harbor in all circumstances and

thus fail to implement an opt out as

early as it could. In addition, a standard

that reflects existing industry practices

and capabilities is likely to become

outmoded quickly as advances in

technology increase efficiency. We

therefore decline to adopt a more rigid

standard.

Section 248.8 Revised Privacy Notices

We are adopting as proposed the rule

regarding revised privacy notices.129

The rule prohibits a financial

institution, directly or through its

affiliates, from disclosing nonpublic

personal information about its

consumers to nonaffiliated third parties

unless the institution first provided a

copy of its privacy notice and opt out

notice. The rule also requires that these

notices be accurate when given.130

Thus, if a broker-dealer, fund, or

registered adviser wants to disclose

nonpublic personal information in a

way that is not accurately described in

its notices, the institution must provide

new notices before disclosing that

information. The rule also provides

examples of when a new notice is

required.131

Section 248.9 Delivering Privacy and

Opt Out Notices

The requirements for delivery of

initial, annual, and opt out notices were

set out in three different sections of the

proposed rules.132 The final rules

combine in one section the

requirements for delivery of each type of

notice.133 The general provision

requires that an institution provide a

notice to a consumer in a manner such

that the consumer can reasonably be

expected to receive actual notice in

writing, or, if the consumer agrees,

electronically.134

Posting initial notices on an Internet

web site. The final rule retains the

proposed example of posting a notice on

an Internet web site and requiring a

consumer to acknowledge receipt of the

notice as a step in the process of

obtaining a financial product or service,

as one way to comply with the rule.135

A few commenters suggested that a

financial institution be allowed to

deliver initial notices simply by posting

the institution’s notice on its Internet

web site. We believe that posting the

notice on a web site alone would not be

sufficient in all cases for a broker-dealer,

fund, or registered adviser reasonably to

expect that its consumers will receive

the notice.136 Accordingly, we have not

expanded the rule beyond the

circumstances described in the

proposed example.

Posting annual notices on an Internet

web site. At the suggestion of several

commenters, the final rule clarifies that

a broker-dealer, fund, or registered

adviser may reasonably expect a

customer who uses the institution’s

Internet web site to obtain financial

products or services will receive actual

notice if the customer has agreed to

accept notices at the institution’s web

site, and if the institution continuously

posts a current notice of its privacy

policies and practices in a clear and

conspicuous manner on the web site.137

We agree that it is appropriate to

provide annual notices in this way for

customers who conduct transactions

electronically and agree to accept

notices on a web site. We also believe

that this revision will reduce the burden

on broker-dealers, funds, and registered

advisers while ensuring that customers

who transact business electronically

will have continuous access to

institutions’ privacy policies and

practices.

Householding. Two commenters

requested that the Commission permit

broker-dealers and funds to deliver a

single privacy notice to consumers who

share the same address

(‘‘householding’’). The Commission

currently permits householding of

prospectuses and fund shareholder

reports, and the commenters argue that

the same justifications that support the

existing householding rules, such as

reducing the number of duplicate

documents investors receive, would

apply with respect to privacy notices.138

We agree that householding is

appropriate in certain circumstances,

and the final rule adds an example that

allows a broker-dealer or fund to

consider that customers have actually

received an annual privacy notice if the

institution includes the notice with or

in a prospectus or shareholder report

delivered under conditions set forth in

rules permitting householding of those

documents.139

Federal Register / Vol. 65, No. 126 / Thursday, June 29, 2000 / Rules and Regulations 40351

140See section 248.9(c)(1)(ii). A customer may

request no communication or that the institution

refrain from sending the annual notices. We note,

however, that broker-dealers, funds, and registered

advisers must provide customers with any

communications (such as shareholder reports or

confirmation statements) required under the federal

securities laws. See, e.g., 15 U.S.C. 80a–29(e). These

institutions also must provide customers with

initial, opt out, and revised privacy notices. See

sections 248.4, 248.7, 248.8.

141See section 248.9(e)(2)(iii).

142See section 248.9(f). See also Proposing

Release, supra note 4, at paragraph following n.34

(‘‘[t]he proposed rules do not prohibit two or more

institutions from providing a joint initial, annual,

or opt out notice * * *’’).

143Records concerning privacy notices delivered

to consumers and consumer opt outs must be

maintained in accordance with the recordkeeping

requirements of 17 CFR 240.17a–4 (broker-dealers);

270.31a–2 (funds); 275.204–2 (registered advisers).

See also section 248.30 (requiring broker-dealers,

funds, and registered advisers to establish

procedures and policies to safeguard customer

information and records).

144Section 248.10.

145Proposed section 248.7 implemented these

provisions by requiring a broker-dealer, fund, or

registered adviser to give the consumer the initial

notice required by section 248.4, the opt out notice

required by section 248.8, and a reasonable

opportunity to opt out.

146See section 248.10(a)(3)(iii). 147See section 248.10(a)(3)(i). 148See section 248.10(a)(3)(ii). 149Some commenters stated that the proposal

inappropriately implied that the opportunity to opt

out by mail is available only when a consumer has

a customer relationship with the financial

institution. See proposed section 248.7(a)(3)(i). The

final rule deletes the reference to a customer

relationship in that section to avoid creating that

implication. See section 248.10(a)(3)(i).

The example requires that the annual

privacy notice be delivered with or in a

prospectus or shareholder report that is

householded because we believe that

customers whose disclosure documents

are householded also would consent to

having their annual privacy notices

householded. We cannot assume that

the same would be true for other

customers. The example also limits

householding to annual privacy notices

because we believe that any reduction

in the number of initial notices

consumers might receive due to

householding would be minimal.

Individuals who share the same address

may not become consumers of a brokerdealer, fund, or registered adviser at the

same time.

Disclosures to customers requesting

no communication. We received

comment that the final rule clarify that

a financial institution may honor a

customer’s request not to receive

information from the institution about

his or her relationship with the

institution. The final rule clarifies that

a broker-dealer, fund, or registered

adviser need not send an annual

privacy notice to a customer who

affirmatively requests no

communication from the institution,

provided that the notice is available

upon request.140

Reaccessing a notice. The final rule

provides an example that permits a

broker-dealer, fund, or registered

adviser to provide only the current

privacy notice on a web site to someone

seeking to obtain the privacy notice after

having received the initial notice.141

This example responds to a request for

clarification in the rule concerning

potential confusion and burden that

might result if the rule required a

financial institution to make available

every version of its privacy policies.

Joint notices. The final rule affirms

that two or more financial institutions

may provide a joint notice as long as the

notice is accurate with respect to each

institution.142 This provision reflects

requests by many commenters from the

securities industry that the rule permit

this flexibility. We believe that brokerdealers, funds, and registered advisers

should be able to combine initial,

annual, or revised disclosures in one

document and to give, on a collective

basis, a consumer only one copy of the

notice. For example, a clearing broker

could provide a joint notice with an

introducing broker for which it clears

transactions on a fully disclosed basis,

or a fund complex could provide a joint

notice for all the funds in the complex.

We emphasize that the notice must be

accurate for each institution that uses

the notice, and must identify each

institution by name.143

B. Subpart B—Limits on Disclosure

Sections 248.10 through 248.12 of

Regulation S–P contain limitations

concerning (i) disclosure of nonpublic

personal information to nonaffiliated

third parties, (ii) redisclosure or reuse of

information that a financial institution

discloses to other parties, and (iii)

sharing of account number information

for marketing purposes.

Section 248.10 Limits on Disclosure of

Nonpublic Personal Information to

Nonaffiliated Third Parties

We are adopting the limits on

disclosure of nonpublic personal

information to nonaffiliated third

parties, substantially as proposed.144

Section 502(a) of the G–L–B Act

generally prohibits a financial

institution, directly or through its

affiliates, from sharing nonpublic

personal information about a consumer

with a nonaffiliated third party unless

the institution (i) provides the consumer

with a notice of the institution’s privacy

policies and practices, (ii) provides the

consumer with a clear and conspicuous

notice that the consumer’s nonpublic

personal information may be disclosed

to nonaffiliated third parties, (iii) gives

the consumer an opportunity to opt out

of that disclosure, and (iv) informs the

consumer how to opt out.145

Most commenters on this section

focused on the question of what is a

reasonable opportunity to opt out. Some

suggested that the rule permit a

financial institution to begin sharing

information immediately after it

provides the opt out and initial notice

in connection with an electronic

transaction, such as an ATM

transaction. Others advocated a

mandatory delay of 120 days after the

notices are provided.

We believe that the wide variety of

suggestions underscores the

appropriateness of a more general test

rather than a mandatory waiting period

in all cases. If a broker-dealer intends to

disclose nonpublic personal information

that it obtains through an isolated

transaction and the consumer is

provided a convenient means of opting

out as part of the transaction, it would

be reasonable not to force the brokerdealer to wait before sharing the

information.146 For notices that are

provided by mail, however, we believe

the consumer should have additional

time. In these latter circumstances, we

consider it reasonable to permit the

consumer to opt out by mailing back a

form, by calling a toll-free number, or by

any other reasonable means within 30

days after the date the opt out notice

was mailed.147 The final rule also

provides an example of a reasonable

opportunity for opting out in connection

with accounts opened electronically.148

However, we have not tried to anticipate

every scenario and establish a specific

period for each. Instead, the rule

provides that the consumer must be

given a reasonable opportunity to opt

out and then includes some illustrative

examples of what would be reasonable

in different contexts.149

Section 248.11 Limits on Redisclosure

and Reuse of Information

We are revising the limits on

redisclosure and reuse to clarify their

scope. The limits on redisclosure and

reuse that apply to recipients of

nonpublic personal information and

their affiliates will depend on whether

the information was provided under an

exception in section 502(e) of the G–L–

B Act.

Section 502(c) of the G–L–B Act

provides that a nonaffiliated third party

that receives nonpublic personal

information from a financial institution

must not, directly or indirectly through

an affiliate, disclose that information to

40352 Federal Register / Vol. 65, No. 126 / Thursday, June 29, 2000 / Rules and Regulations

150For example, as discussed further below in

this section, permitted use for an enumerated

exception would not include use for marketing

purposes.

151See proposed section 248.12(a)(1),

248.12(b)(1).

152See proposed section 248.12(a)(2),

248.12(b)(2).

153See G–L–B Act § 504(a)(1) (authorizing the

Commission to prescribe regulations necessary to

carry out the purposes of Title V).

154See sections 248.14, 248.15.

155See section 248.11(a).

156The examples also provide that a brokerdealer, fund, or registered adviser may redisclose

information according to the privacy notices of the

institution making the initial disclosures, as limited

by any opt out elections received by that institution.

Section 248.11(b)(2).

any person that is not affiliated with the

financial institution or the third party,

unless the disclosure would be lawful if

made directly by the financial

institution. A broker-dealer, fund, or

registered adviser generally may

disclose nonpublic personal information

to a nonaffiliated third party (i) for any

purpose if the consumer has received a

privacy and opt out notice and has not

exercised the right to opt out, (ii) under

section 502(b), and (iii) in accordance

with specific enumerated exceptions

under section 502(e).

The limits on redisclosure and reuse

in the proposed rule reflected our belief

that implicit in the joint marketing and

enumerated exceptions is the idea that

information may be used only for the

purposes for which the third party

received it.150 The proposed rules

implemented section 502(c) by

imposing limits on redisclosure for a

broker-dealer, fund, or registered

adviser that receives information from a

nonaffiliated financial institution, and

for any nonaffiliated third party that

receives nonpublic personal information

from a broker-dealer, fund, or registered

adviser.151 The proposed rules also

implemented the implicit limitations on

reuse by imposing limits on the ability

of broker-dealers, funds, and registered

advisers and nonaffiliated third parties

to reuse nonpublic personal information

they receive.152

We sought comment on the correct

interpretation of ‘‘lawful’’ in the context

of section 502(c), and whether a

recipient of nonpublic personal

information could ‘‘lawfully’’ disclose

information if the disclosure complied

with a notice provided by the institution

that initially made the disclosure.

Finally, we invited comment on

whether the rules should require a

financial institution that discloses

nonpublic personal information to a

nonaffiliated third party to develop

policies and procedures to ensure that

the third party complies with the limits

on redisclosure of that information.

Limits on reuse and redisclosure.

Commenters who disagreed with the

proposal to impose limits on reuse

argued that Congress, by addressing

limits on redisclosures in section 502(c),

provided the only limits that may be

imposed on what a recipient of

nonpublic personal information can do

with that information. We disagree.

Although section 502(c) does not

expressly address reuse, reuse

limitations are, as indicated, implicit in

the provisions authorizing or permitting

disclosures. For example, it would be

inconsistent with the purposes of the

Act to permit information disclosed in

accordance with section 502(e)(1)

(which permits disclosures as necessary

to effect, administer, or enforce a

transaction with a consumer or in

connection with certain routine

activities related to such a transaction)

to be used for the third party recipient’s

marketing purposes. Moreover,

permitting reuse without limits would

undermine the protections afforded to a

consumer who does not establish a

customer relationship. Such a person

does not receive notice that the

disclosures under section 502(e) are

even made because these disclosures do

not entitle the consumer to any privacy

or opt out notice. Thus, the limits on

reuse are the only protection under the

statute for a consumer who is not a

customer. Accordingly, consistent with

the purposes of the G–L–B Act, the rule

limits the reuse of information received

under an exception of the Act.153

By contrast, when a consumer decides

not to opt out after receiving adequate

notices and the opportunity to do so,

that consumer has decided to permit the

broker-dealer, fund, or registered

adviser to share his or her nonpublic

personal information with the categories

of entities identified in the institution’s

notices. The consumer’s primary

protection in the case of a disclosure

falling outside the section 502(e)

exceptions comes from receiving the

mandatory disclosures and the right to

opt out. The G–L–B Act provides

additional protection in section 502(c)

by restricting a recipient’s ability to

redisclose information to entities not

affiliated with either the recipient or the

financial institution making the initial

disclosure. Thus, if a consumer permits

a broker-dealer, fund, or registered

adviser to disclose nonpublic personal

information to the categories of

nonaffiliated third parties that are

described in the institution’s notices,

recipients of that nonpublic personal

information appear authorized under

the statute to make disclosures

consistent with those notices.

Limits on redisclosure and reuse

when information is received under

section 502(e). If a broker-dealer, fund,

or registered adviser receives nonpublic

personal information provided under

section 502(e), it may disclose the

information to its affiliates or to the

affiliates of the financial institution

from which it received the information.

The broker-dealer, fund, or registered

adviser also may disclose and use the

information under the same type of

exceptions in the ordinary course of

business to carry out the activity

covered by the exception under which

the institution received the

information.154 The affiliates of the

broker-dealer, fund, or registered

adviser may disclose and use the

information, but only to the extent

permissible for the broker-dealer, fund,

or registered adviser.155

These same general rules apply to a

third party other than a broker-dealer,

fund, or registered adviser that receives

nonpublic personal information from a

broker-dealer, fund, or registered

adviser. Thus, the third party receiving

the information under one of the section

502(e) exceptions may disclose the

information to its affiliates or to the

affiliates of the broker-dealer, fund, or

registered adviser that made the

disclosure. The third party also may

disclose and use the information under

one of the section 502(e) exceptions as

noted in the rule. The affiliates of the

third party may disclose and use the

information only to the extent

permissible for the third party.

Limits on redisclosure and reuse

when information is not received under

section 502(e). If a broker-dealer, fund,

or registered adviser receives nonpublic

personal information outside one of the

section 502(e) exceptions, it may

disclose the information to (i) its

affiliates, (ii) the affiliates of the

financial institution that made the

initial disclosure, or (iii) any other

person if the disclosure would be lawful

if made directly by the financial

institution from which the information

was received.156 Thus, the receiving

broker-dealer, fund, or registered

adviser may disclose under one of the

section 502(e) exceptions.

If a third party receives information

from a broker-dealer, fund, or registered

adviser outside one of the section 502(e)

exceptions, the third party may disclose

to its affiliates or to the affiliates of the

broker-dealer, fund, or registered

adviser. The third party also may

disclose to any other person if the

disclosure would be lawful if made by

the broker-dealer, fund, or registered

Federal Register / Vol. 65, No. 126 / Thursday, June 29, 2000 / Rules and Regulations 40353

157See section 248.11(c).

158See proposed section 248.13.

159See section 248.12.

160See section 248.12(b)(1).

161See section 248.12(c).

adviser. The third party’s affiliates may

disclose and use the information to the

same extent permissible for the third

party.

If an entity receives information

outside of one of the section 502(e)

exceptions, that entity will in essence

‘‘step into the shoes’’ of the brokerdealer, fund, or registered adviser that

made the initial disclosures. Thus, if the

broker-dealer, fund, or registered

adviser made the initial disclosures after

representing to its consumers that it had

carefully screened the entities to whom

it intended to disclose the information,

the receiving entity must comply with

those representations. Otherwise, the

subsequent disclosure by the receiving

entity would not comply with the

notices given to consumers and would

not, therefore, be lawful. Even if these

representations do not prevent the

recipient from redisclosing the

information, the recipient’s ability to

redisclose will be limited by whatever

opt out instructions the consumer gave

to the broker-dealer, fund, or registered

adviser making the initial disclosures

and by any new opt out instructions the

consumer gives after the initial

disclosure. The receiving entity,

therefore, must have procedures in

place to monitor continually the status

of who opts out and to what extent.

Given these practical limitations on the

ability of a recipient to disclose under

another institution’s privacy and opt out

notices, entities are most likely to

redisclose under one of the section

502(e) exceptions (as implemented by

sections 248.14 and 248.15 of the final

rule).

Monitoring third parties. Most

commenters stated that financial

institutions should not have to monitor

compliance with the redisclosure and

reuse provisions of the rule, and we

have decided not to revise the rule to

impose a specific duty on brokerdealers, funds, and registered advisers

to monitor third parties’ use of

nonpublic personal information they

provide. The rule does not, however,

address whether obligations to monitor

reuse and redisclosure may arise in

other contexts. Most of the commenters

who requested that we not impose such

a duty stated that they have contracts in

place that limit the recipient’s use of the

information. In addition, the limits on

reuse as stated in the final rule provide

a basis for an enforcement action to be

brought against an entity that violates

those limits.157

Section 248.12 Limits on Sharing

Account Number Information for

Marketing Purposes

We are revising the proposed rule

regarding limits on sharing account

number information for marketing

purposes158 by (i) adding two

exceptions that we believe are necessary

to enable broker-dealers, funds, and

registered advisers to engage in

legitimate, routine business practices

and that are unlikely to pose a

significant potential for abuse, and (ii)

clarifying that the prohibition does not

apply in two circumstances frequently

mentioned in the comments.159 Section

502(d) of the G–L–B Act prohibits a

financial institution from disclosing,

‘‘other than to a consumer reporting

agency, an account number or similar

form of access number or access code

for a credit card account, deposit

account, or transaction account of a

consumer to any nonaffiliated third

party for use in telemarketing, direct

mail marketing, or other marketing

through electronic mail to the

consumer.’’ The proposal applied this

statutory prohibition to disclosures

made directly or indirectly by a brokerdealer, fund, or registered adviser, and

sought comment on whether the rule

should include any exceptions to the

prohibition. Some commenters

suggested various exceptions while

other commenters supported a flat

prohibition in order to protect

consumers from unscrupulous practices.

Disclosures to a financial institution’s

agent or service provider. Several

financial institutions stated that they

use agents or service providers to

conduct marketing on the institution’s

behalf. This might occur, for example,

when a broker-dealer instructs a service

provider that assists in the delivery of

required regulatory notices to include a

‘‘statement stuffer’’ about the brokerdealer’s products and services. We

recognize the need to disclose account

numbers in this instance, and believe

that this kind of disclosure poses little

risk to the consumer.

Several commenters argued that the

final rule should exclude disclosures to

agents because they effectively act as the

financial institution in marketing the

financial products and services of the

broker-dealer, fund, or registered

adviser. We are concerned, however,

that the agent of these financial

institutions may engage in practices

contrary to the institution’s instructions.

While a broker-dealer, fund, or

registered adviser frequently will use

agents to assist it in marketing its

products, providing agents access to a

consumer’s account number may erode

a consumer’s protections. Accordingly,

we have added an exception to permit

a broker-dealer, fund, or registered

adviser to disclose account numbers to

an agent for the purpose of marketing

the institution’s financial product or

services as long as the agent has no

authority to initiate charges to the

account.160

Encrypted numbers. Many

commenters urged us to exercise our

exemptive authority to permit the

transmission of account numbers in

encrypted form or to clarify that the

prohibition applies only to disclosure to

nonaffiliated third parties who are not

subject to one of the exceptions under

sections 248.13, 248.14, or 148.15.

Several commenters noted that financial

institutions frequently use encrypted

account numbers and other internal

identifiers of an account to ensure that

a consumer’s instructions are properly

executed. The inability to continue

using these internal identifiers would

increase the likelihood of errors in

processing a consumer’s instructions.

These commenters also noted that if

internal identifiers are not used, a

consumer would have to provide an

account number in order to ensure

proper handling of a request. This

procedure could expose the consumer to

a greater risk than would the use of an

internal tracking system that preserves

the confidentiality of a number that may

be used to access the account. One

commenter also noted that customer

account numbers are protected by strict

contractual confidentiality provisions.

We believe an encrypted account

number without the key is not the same

as the number itself and thus falls

outside the prohibition in section

502(d). The G–L–B Act focuses on

numbers that provide access to an

account. The encrypted number,

however, operates as an identifier

attached to an account for internal

tracking purposes only, and without the

key does not permit someone to access

an account. For this reason the final rule

clarifies that an account number, or

similar form of access number or access

code, does not include a number or code

in an encrypted number form, as long as

the financial institution does not

provide the recipient with the means to

decrypt the number.161

C. Subpart C—Exceptions

Sections 248.13 through 248.15 of

Regulation S–P include exceptions from

40354 Federal Register / Vol. 65, No. 126 / Thursday, June 29, 2000 / Rules and Regulations

162See proposed section 248.9, section 248.13. 163See proposed section 248.9, (a)(2). The

exceptions were set forth in proposed sections

248.10 and 248.11. 164See section 248.13.

165The statute states, in relevant part, that section

502(b)— shall not prevent a financial institution

from providing nonpublic personal information to

a nonaffiliated third party to perform services for

or functions on behalf of the financial institution,

including the marketing of the financial

institution’s own products or services, or financial

products or services offered pursuant to joint

agreements between two or more financial

institutions that comply with the requirements

imposed by the regulations prescribed under

section 504, if the financial institution fully

discloses the providing of such information and

enters into a contractual agreement with the third

party that requires the third party to maintain the

confidentiality of such information.

166Section 248.18(c). 167See proposed section 248.10. 168Section 248.14.

the provisions requiring financial

institutions to provide privacy notices

and opt out notices to consumers. These

exceptions permit broker-dealers, funds,

and registered advisers to disclose

information to nonaffiliated third

parties in circumstances such as

maintaining or servicing a customer’s

account, or complying with federal,

State, or local laws.

Section 248.13 Exception to Opt Out

Requirements for Service Providers and

Joint Marketing

We are adopting substantially as

proposed an exception to the opt out

requirements for service providers and

joint marketing, with revisions to clarify

the rule’s scope.162 Section 502(b) of the

G–L–B Act permits financial institutions

to share information with a nonaffiliated

third party without providing the

consumer a right to opt out if the third

party is to perform services for (or

functions on behalf of) the financial

institution, including marketing the

institution’s own products or services,

or financial products or services offered

under a joint agreement between two or

more financial institutions. Section

502(b)(2) requires the financial

institution to ‘‘fully disclose’’ to the

consumer that it will provide this

information to the nonaffiliated third

party before sharing the information and

to enter into a contract with the third

party that requires the third party to

maintain the confidentiality of the

information. As noted in the proposed

rule, this contract should be designed to

ensure that the third party (i) will

maintain the confidentiality of the

information at least to the same extent

as is required for the financial

institution that discloses it, and (ii) will

use the information solely for the

purposes for which the information is

disclosed or as otherwise permitted

under the proposed rules.163

Commenters expressed concern that

routine servicing agreements between a

financial institution and, for instance, a

customer account servicer would be

subject to the requirements of the

proposed rules.164 These commenters

noted that section 502(e) of the G–L–B

Act contains several exceptions that

permit broker-dealers, funds, and

registered advisers to share information

necessary to allow a third party to

perform services for the institution. The

commenters requested clarification that

sharing information with a service

provider under one of the section 502(e)

exceptions is not subject to the

requirements imposed under section

502(b)(2) of the G–L–B Act. We agree

that when a broker-dealer, fund, or

registered adviser is permitted to share

nonpublic personal information with a

nonaffiliated third party under section

502(e), the institution does not have to

comply first with the requirements

imposed by section 502(b)(2). A few commenters also argued that it

is illogical to impose requirements on

service providers that receive

information under section 502(b)(2)

when no requirements are imposed on

service providers that receive

information under section 502(e). We

believe, however, that a plain reading of

section 502(b)(2) leads to that result.165

We read the phrase ‘‘if the financial

institution fully discloses * * *’’ as

used in section 502(b)(2) to modify the

phrase ‘‘This subsection shall not

prevent a financial institution from

providing nonpublic personal

information to a nonaffiliated third

party to perform services for or

functions on behalf of the financial

institution, * * *.’’ We therefore

conclude that any disclosure to a service

provider not covered by section 502(e)

must satisfy the disclosure and written

contract requirements of section

502(b)(2).

The Proposing Release requested

comment on whether the rule should

include safeguards beyond those

provided by the G–L–B Act to protect a

financial institution from the risks that

can arise from agreements with third

parties. The majority of commenters

who addressed the issue argued that the

rule should not. We agree that the

protections set out in the statute, as

implemented by section 248.13(a)(1),

are adequate for purposes of the privacy

rules. Those protections require a

financial institution to provide the

initial notice required by section 248.4

as well as to enter into a contractual

agreement with a third party that

prohibits the third party from disclosing

or using the information other than to

carry out the purposes for which the

institution disclosed the information,

including use under an exception in

sections 248.14 or 248.15 in the

ordinary course of business to carry out

those purposes. These limitations will

preclude recipients from sharing a

consumer’s nonpublic personal

information through a chain of third

party joint marketing agreements.

Many commenters recommended that

the Commission permit broker-dealers,

funds, and registered advisers to

grandfather prior joint marketing and

servicing agreements, or permit

institutions to comply with the

requirements by notifying existing

service providers about the privacy

rules’ requirements. One commenter

stated that without a grandfather

provision, institutions would need more

than six months to review prior

agreements and negotiate amendments

with third parties. We believe that a

balance must be struck that minimizes

interference with existing contracts

while preventing evasions of the

regulation. To achieve these goals, the

final rule provides that contracts

entered into on or before July 1, 2000

must be brought into compliance with

the provisions of section 248.13 by July

1, 2002.166

Section 248.14 Exceptions to Notice

and Opt Out Requirements for

Processing and Servicing Transactions

We have revised the proposed

exceptions to notice and opt out

requirements for processing and

servicing transactions 167 to include

disclosures made in connection with (i)

servicing or processing financial

products or services requested by the

consumer or (ii) maintaining or

servicing a customer account.168 As

previously discussed, section 502(e) of

the G–L–B Act creates exceptions to the

requirements that apply to the

disclosure of nonpublic personal

information to nonaffiliated third

parties. Paragraph (1) of that section sets

out certain exceptions for disclosures

made in connection with the

administration, processing, servicing,

and sale of a consumer’s account.

Proposed section 248.10 implemented

those exceptions by restating them with

only stylistic changes that were

intended to make the exceptions easier

to read. The Proposing Release noted

that the exceptions set out in proposed

sections 248.10 and 248.11 do not affect

a financial institution’s obligation to

provide initial and annual notices of its

privacy policies and practices.

We received many comments from

broker-dealers, funds, and registered

Federal Register / Vol. 65, No. 126 / Thursday, June 29, 2000 / Rules and Regulations 40355

169See section 248.14(a). 170Proposed section 248.11.

171See section 248.14(a) (excepting from initial

and opt out notice requirements disclosures to

nonaffiliated third parties as necessary to effect a

transaction that a consumer requests or in

connection with servicing or processing a financial

product that a consumer requests or authorizes).

172One commenter, for example, suggested that

the rule completely exempt a financial institution

from all of the requirements under Title V if the

institution makes no disclosures other than those

permitted by section 502(e).

173See section 248.15.

174Section 248.16.

advisers noting that, by deleting the

statutory phrase ‘‘in connection with’’

from the exceptions for information

shared (i) to service or process a

financial product or service requested

by the consumer or (ii) to maintain or

service a customer account, we

narrowed the application of the

exception. We did not intend this result,

and have changed the final rule

accordingly.169

Several other commenters requested

that the final rule provide specific

examples of situations that would fall

within the exception for processing and

servicing customer accounts (such as

transfers from a broker-dealer to its

registered representatives, or as

necessary to arbitrate a dispute, with the

consent of the consumer’s fiduciary or

representative). Others stated that

certain services, such as those provided

by attorneys, are ‘‘necessary’’ to effect,

administer, or enforce a transaction. We

believe that disclosures to these types of

professionals and under the

circumstances posited by the

commenters may be necessary to effect,

administer, or enforce a transaction in a

given situation. However, we have not

listed specific types of disclosures in the

regulation as necessarily falling within

the scope of the exception because we

are concerned that a general statement

could be applied inappropriately to

shelter disclosures that, in fact, are not

necessary to effect, administer, or

enforce a transaction.

Other commenters suggested that the

final rule clarify, in situations in which

a financial institution uses an agent to

provide services to a consumer, that the

consumer does not have to request

directly or authorize the service

provider to provide the financial

product or service but may request it

from the financial institution instead.

For example, a consumer may ask the

fund or its transfer agent for additional

account information that the transfer

agent provides as a service for the fund.

We agree that the communication may

be between the consumer and the

service provider, and note that the rule

governing agents as set out in the

definition of ‘‘consumer’’ above

provides the flexibility sought by the

commenters. An individual will not be

a consumer of an entity that is acting as

agent for a broker-dealer, fund, or

registered adviser in connection with

that institution’s providing a financial

product or service to the consumer.

Section 248.15 Other Exceptions to

Notice and Opt Out Requirements

We are adopting as proposed the

section that includes ‘‘other’’ exceptions

to the notice and opt out requirements.

As noted above, section 502(e) of the G–

L–B Act contains several exceptions to

the requirements that otherwise would

apply to the disclosures of nonpublic

personal information to nonaffiliated

third parties. The proposed rule set out

those exceptions for disclosures that are

not made in connection with the

administration, processing, servicing, or

sale of a consumer’s account, and made

stylistic changes to the statutory

language that were intended to clarify

the exceptions.170 The proposal also

provided an example of the consent

exception in the context of a consumer

who consents to having a broker or

investment adviser confirm the amount

of assets in the customer’s account to a

nonaffiliated mortgage lender so that the

lender can evaluate the customer’s

application for a loan. We invited

comment on whether we should add

safeguards to the exception for consent

in order to minimize the potential for

consumer confusion.

Several commenters responded to the

request for comment on whether the

consent exception should include

consumer safeguards, such as a

requirement that the consent be written,

be indicated by a signature on a separate

line, or automatically terminate after a

certain period of time. Some

commenters favored the additional

safeguards discussed in the proposal,

while others maintained that safeguards

are unnecessary. Several suggested that

the consent exception include a

provision noting that participation in a

program where a consumer receives

‘‘bundled’’ products and services

necessarily implies consent to the

disclosure of information between the

entities that provide the bundled

products or services. Others suggested

that certain terms and conditions be

imposed on any consent agreement,

such as a time by which the financial

institution must stop disclosing

nonpublic personal information once a

consent is revoked.

We have declined to elaborate on the

requirements for obtaining consent or

the consumer safeguards that should be

in place when a consumer consents. We

believe that the resolution of this issue

is appropriately left to the particular

circumstances of a given transaction.

We note that any broker-dealer, fund, or

registered adviser that obtains the

consent of a consumer to disclose

nonpublic personal information should

take steps to ensure that the limits of the

consent are well understood by both the

institution and the consumer. We also

note that a consumer may always revoke

his or her consent. In light of the

safeguards already in place, we have

decided not to adopt additional

safeguards in the consent exception.

Many commenters offered specific

suggestions for additional exceptions or

revisions to the proposed exceptions. In

some cases, the suggestions are

accommodated elsewhere in the

regulation (such as exceptions to permit

disclosures to independent contractor

registered representatives or attorneys to

effect a transaction).171 In other cases,

the suggestions are inconsistent with the

statute.172 Accordingly, we have

retained the statement of the exceptions

as proposed.173

D. Subpart D—Relation to Other Laws;

Effective Date

Sections 248.16 through 248.18 of

Regulation S–P include provisions that

explain the interaction between the

regulation and certain other laws, and

that provide an effective date and

compliance date for the regulation.

Section 248.16 Protection of Fair

Credit Reporting Act

We are adopting as proposed the

section that explains the interaction

between Regulation S–P and the Fair

Credit Reporting Act.174 Section 506 of

the G–L–B Act makes several

amendments to the FCRA to vest

rulemaking authority in various

agencies and to restore the Banking

Agencies’ regular examination

authority. Paragraph (c) of section 506

states that, except for these amendments

to the FCRA, nothing in Title V of the

G–L–B Act is to be construed to modify,

limit, or supersede the operation of the

FCRA, and no inference is to be drawn

on the basis of the provisions of Title V

whether information is transaction or

experience information under section

603 of the FCRA. Proposed section

248.14 implemented section 506(c) of

the G–L–B Act by restating the statute,

40356 Federal Register / Vol. 65, No. 126 / Thursday, June 29, 2000 / Rules and Regulations

175Section 248.17.

176Section 248.18(a).

177Section 248.18(b), (c).

178Because Nobvember 12, 2000 is a Sunday, the

proposed rule provided an effective date of

Monday, November 13, 2000. See proposed rule

248.16(a).

179See Proposing Release, supra note 4, at

discussion of proposed section 248.16.

180See supra note 6.

making only minor stylistic changes

intended to make the rule clearer.

Comments about this provision

focused on whether the Commission, by

requiring annual notice of a consumer’s

right to opt out under the FCRA, was

modifying, limiting, or superseding the

operation of the FCRA. For the reasons

explained in the discussion of section

248.6, above, we do not believe that the

annual disclosure mandated by the G–

L–B Act affects in any way the

obligations imposed by the FCRA.

Section 248.17 Relation to State laws.

We are adopting as proposed the

section that explains the interaction

between Regulation S–P and State

laws.175 Section 507 of the G–L–B Act

provides that Title V does not preempt

any State law that provides greater

protections than are provided by Title

V. Determinations of whether a State

law or Title V provides greater

protections are to be made by the

Federal Trade Commission (‘‘FTC’’)

after consultation with the agency that

regulates either the party filing a

complaint or the financial institution

about whom the complaint was filed,

and may be initiated by any interested

party or on the FTC’s own motion. The

proposed rule essentially restated

section 507, stating that the proposed

rules (as opposed to the statute) do not

preempt State laws that provide greater

protection for consumers than do the

rules.

Commenters on this section expressed

concern about the potential differences

between federal and State privacy laws.

Several supported coordination and

cooperation among federal and State

regulators to ensure consistency in

privacy policies. Some commenters

requested clarification of whether a

particular State law would be

considered more restrictive, while

others suggested that the final rules

establish a choice of law principle for

financial institutions operating in more

than one State. These and other

suggestions made by the commenters

appear to exceed the scope of this

rulemaking.

Section 248.18 Effective Date;

Transition Rule

We are adopting as proposed the

effective date for Regulation S–P of

November 13, 2000, and are providing

a compliance date of July 1, 2001.176 We

also are adding a provision that clarifies

the requirement that financial

institutions provide initial privacy and

opt out notices to customers by July 1,

2001, and a provision that phases in

compliance with respect to existing

service agreements.177

Section 510 of the G–L–B Act states

that, as a general rule, the relevant

provisions of Title V take effect six

months after the date on which rules are

required to be adopted, i.e., November

12, 2000. However, section 510(1)

authorizes us to prescribe a later date in

the rules adopted under section 504.

The Proposing Release sought comment

on the effective date prescribed by the

statute.178 It also would have required

that financial institutions provide initial

notices, within 30 days of the effective

date of the final rule, to people who

were customers as of the effective date.

The Proposing Release noted that a

financial institution would have to

provide opt out notices before the rule’s

effective date if the institution wanted

to continue sharing nonpublic personal

information with nonaffiliated third

parties without interruption.179

The Congressional Privacy Caucus,

several members of Congress, and other

commenters have urged the Commission

and the Agencies not to delay the

effective date past the date set forth in

the G–L–B Act.180 By contrast, the

overwhelming majority of commenters

from the securities industry who

addressed this provision requested

additional time to comply with the final

rule. Commenters stated that six months

would not be sufficient to take the steps

needed to comply with the regulation,

including preparing new disclosure

forms, developing software needed to

track opt outs, training employees, and

creating management oversight systems.

Several commenters suggested that it

would be less effective and potentially

more confusing for consumers to receive

several notices around the end of the

year 2000 than it would be for the

notices to be delivered during a ‘‘rolling

phase-in.’’ Others noted that the

proposed effective date would place a

severe strain on financial institutions at

a time when other year-end notices need

to be prepared and delivered. Several

commenters noted that financial

institutions have not budgeted for the

expenses in the current year that likely

will be incurred. Requests for

extensions of the effective date typically

ranged from six to 24 months from the

proposed effective date of the rule (i.e.,

from November 13, 2000).

Many commenters also stated that a

30-day phase-in for initial notices to

existing customers is not feasible, given

the large number of notices, the short

period of time allowed, and the

competing demands on financial

institutions at the time when the initial

notices must be sent. A few suggested

that the rule require initial notices to be

sent only to people who establish

customer relationships after the

effective date of the rule, and allow a

financial institution to send annual

notices to existing customers at some

point during the next 12 months and

annually thereafter.

We agree that six months may be

insufficient in certain instances for a

financial institution to have ensured

that its forms, systems, and procedures

comply with the rule. In order to

accommodate situations requiring

additional time, we will give financial

institutions until July 1, 2001 to be in

full compliance with the regulation.

Financial institutions are expected,

however, to begin compliance efforts

promptly, to use the period prior to June

30, 2001 to implement and test their

systems, and to be in full compliance by

July 1, 2001. Given that this provides

financial institutions more than 12

months in which to comply with the

rules, we have determined that there no

longer is any need for a separate phasein for providing initial notices. Thus, a

financial institution will need to deliver

all required opt out notices and initial

notices before July 1, 2001. We believe

that this extension represents a fair

balance between those seeking prompt

implementation of the protections

afforded by the statute and those

concerned about the reliability of the

systems that are put in place.

We encourage financial institutions to

provide disclosures as soon as

practicable. Broker-dealers, funds, and

registered agents that do not disclose

nonpublic personal information to third

parties have fewer burdens under the

regulation (both in terms of the notice

requirements and opt out mechanism)

and should therefore be able to provide

privacy notices to their consumers

sooner. Depending on the readiness of

an institution to process opt out

elections, institutions might wish to

consider including the privacy and opt

out notices in the same mailing as is

used to provide tax information or

account statements to consumers in the

first quarter of 2001 to increase the

likelihood that a consumer will not

mistake the notices for an unwanted

solicitation.

Federal Register / Vol. 65, No. 126 / Thursday, June 29, 2000 / Rules and Regulations 40357

The extension of the compliance date

should provide much of the relief

sought by those who suggested that

initial notices should not be required for

existing customers. By allowing

financial institutions to deliver notices

over a significantly longer period of

time than was proposed, the

concentrated burden that would have

been imposed by the proposed rules is

avoided. Accordingly, we have not

adopted the suggestion that initial

notices be required only for new

customers after the effective date of the

rule.

Broker-dealers, funds, and registered

advisers need not give initial notices to

customers whose relationships have

terminated before the date by which

institutions must be in compliance with

the rules. Thus, if an account is inactive

according to a financial institution’s

policies before July 1, 2001, then no

initial notice would be required in

connection with that account. However,

because these former customers would

remain consumers, a broker-dealer,

fund, or registered adviser would have

to provide a privacy and opt out notice

to them if the institution intended to

disclose their nonpublic personal

information to nonaffiliated third

parties beyond the exceptions in

sections 248.14 and 248.15.

Full compliance with the rules’

restrictions on disclosures is required

on July 1, 2001. To be in full

compliance, broker-dealers, funds, and

registered advisers must have provided

their existing customers with a privacy

notice, an opt out notice, and a

reasonable amount of time to opt out

before that date. If these have not been

provided, the disclosure restrictions

will apply. This means that a brokerdealer, fund, or registered adviser would

have to cease sharing customers’

nonpublic personal information with

nonaffiliated third parties on that date,

unless it may share the information

under an exception under sections

248.14 or 248.15. Broker-dealers, funds,

and registered advisers that both

provide the required notices and allow

a reasonable period of time to opt out

before July 1, 2001, may continue to

share nonpublic personal information

after that date for customers who do not

opt out.

E. Subpart E—Safeguard Procedures

Section 248.30 Procedures To

Safeguard Customer Information and

Records

Commenters on this section

supported the proposal, and we are

adopting this section as proposed.

Section 501 of the G–L–B Act directs the

Commission (and the Agencies) to

establish appropriate standards for

financial institutions relating to

administrative, technical, and physical

safeguards to protect customer records

and information. The rules implement

this section by requiring every brokerdealer, fund, and registered adviser to

adopt policies and procedures to

address the safeguards described above.

Consistent with the Act, the proposed

rule further requires that the policies

and procedures be reasonably designed

to: (i) insure the security and

confidentiality of customer records and

information; (ii) protect against any

anticipated threats or hazards to the

security or integrity of customer records

and information; and (iii) protect against

unauthorized access to or use of

customer records or information that

could result in substantial harm or

inconvenience to any customer.

Some commenters recommended that

the Commission add an example to

clarify that various financial institutions

in a fund complex could satisfy the rule

by adopting a single set of policies and

procedures for the fund complex. We

believe that a single set of policies and

procedures for a fund complex could

satisfy the rule’s requirements, as long

as those policies and procedures have

been determined to be appropriate for

each institution to which they apply.

IV. Appendix—Sample Clauses

In order to provide additional

guidance to broker-dealers, funds, and

registered advisers concerning the level

of detail we believe is appropriate under

the Act, we have prepared a variety of

sample clauses for institutions to

consider. We urge broker-dealers, funds,

and registered advisers to carefully

review whether these clauses accurately

reflect a given institution’s policies and

practices before using the clauses.

Broker-dealers, funds, and registered

advisers are free to use different

language and to include additional

detail as they think is appropriate in

their notices.

V. Comparison Chart

Below is a chart showing the

comparison of the sections in the final

privacy rules and the proposal. Only

changes are noted.

Proposal Content of provision Final

rule

4(d) ....... How to provide initial

notice.

9(a)

N/A ....... New product for existing customer.4(d)

4(d)(3) .. Oral delivery ................. 9(d)

4(d)(4) .. Retainable notice ......... 9(e)

Proposal Content of provision Final

rule

N/A ....... Joint relationships (privacy notice).9(g)

5(b) ....... How to provide annual

notice.

9(a)

5(b) ....... Actual notice of annual

notice.

9(c)

5(c) ....... Terminated customer

relationships.

5(b)

N/A ....... Delivering short-form

initial notices.

6(d)

7 ........... Main operative provision.10

8(a) ....... Opt out methods and

opt out notice content.

7(a)

8(b)(1) .. How to deliver opt out

notices.

9(a)

8(b)(2) .. Oral delivery ................. 9(d)

8(b)(3) .. Same form as initial notice.7(b)

8(b)(4) .. Initial notice must accompany opt out notice.7(c)

N/A ....... Joint relationships (opt

out notice).

7(d)

8(d) ....... Time to comply with opt

out; continuing right

to opt out.

7(e) & (f)

8(e) ....... Duration of opt out ....... 7(g)

8(c)(1) .. Revised notices ........... 8(a)

8(c)(2) .. How to deliver revised

notice.

8(c)

8(c)(3) .. Examples of when revised notice is required.8(b)

9 ........... Exception for service

providers and joint

marketers.

13

10 ......... Exceptions for processing and servicing

transactions.

14

11 ......... Other exceptions .......... 15

12 ......... Redisclosure and reuse 11

13 ......... Sharing account number information.12

14 ......... FCRA ........................... 16

15 ......... State law ...................... 17

16 ......... Effective date ............... 18

VI. Guidance for Certain Institutions

To minimize the burden and costs to

a broker-dealer, fund, or registered

adviser (‘‘you’’) and generally clarify the

operation of the final rules, we have

included this guidance that you may use

in conjunction with the sample clauses

in the Appendix. This guidance

specifically applies to you if you:

(1) do not have any affiliates;

(2) only disclose nonpublic personal

information to nonaffiliated third

parties in accordance with an exception

under sections 248.14 or 248.15, such as

in connection with servicing or

processing a financial product or service

that a consumer requests or authorizes;

and

(3) do not reserve the right to disclose

nonpublic personal information to

40358 Federal Register / Vol. 65, No. 126 / Thursday, June 29, 2000 / Rules and Regulations

181 If you disclose or reserve the right to disclose

nonpublic personal information to a nonaffiliated

third party under other circumstances, you must

comply with other provisions in the rules, notably

sections 248.7, 248.8, and 248.13, if applicable. If

you disclose or reserve the right to disclose

nonpublic personal information to an affiliate you

must comply with other provisions in the rules,

notably section 248.6(a)(7), as applicable.

nonaffiliated third parties, except under

sections 248.14 and 248.15.181

In addition, if you disclose nonpublic

personal information in accordance

with the exception in section 248.13 (for

service providers and joint marketers)

you also must include an accurate

description of that information, as

illustrated by the sample clause in

section (K) below.

In general, if you disclose nonpublic

personal information to nonaffiliated

third parties only as authorized under

an exception, then your only

responsibilities under the regulation are

to provide initial and annual privacy

notices to each of your customers. You

do not need to provide an opt out notice

or opt out rights to your customers.

A. Initial notice to customers. You

must provide an initial notice to each of

your customers. A customer is a natural

person who has a continuing

relationship with you, as described in

section 248.4(c). In general, an

individual who opens a brokerage

account or enters into an investment

advisory contract (whether written or

oral) with you is your customer. By

contrast, an individual who establishes

an account solely for the purpose of

liquidating or purchasing securities as

an accommodation, i.e., on a one-time

basis, without the expectation of

engaging in other transactions, is not

your customer. In other words, you

must provide initial and annual notices

to each of your customers, but not to

others.

B. Time to provide initial notice. You

must provide an initial privacy notice to

each of your customers not later than

when you establish a customer

relationship (section 248.4(a)(1)). For

example, you must provide a privacy

notice to an individual not later than

when that individual opens a brokerage

account or purchases fund shares in his

or her own name. Thus, you can provide

the notice to a brokerage account

customer together with the account

agreement or to a fund shareholder with

the application to purchase shares.

If one of your existing customers

obtains a new financial product or

service from you, then you need not

provide another initial notice to that

customer (section 248.4(d)) if the earlier

notice covered the subsequent product.

For instance, if Alison Individual

walks into Broker-Dealer for the first

time on July 2, 2001, to open a cash

account, then Broker-Dealer complies

with section 248.4(a)(1) of the rules if it

provides an initial notice to Alison

together with the account agreement.

When Alison opens her cash account,

she becomes a customer of BrokerDealer. Alison maintains her cash

account and, six months later, returns to

the Broker-Dealer to open a margin

account. If the initial notice that the

Broker-Dealer provided to Alison was

accurate with respect to the margin

account, then the Broker-Dealer need

not provide another initial notice to her

when she opens the margin account

because it has provided a notice to

Alison that covered the margin account

when she opened her cash account.

C. Method of providing the initial

notice. You must provide your initial

notice so that each customer can

reasonably be expected to receive it

(section 248.9(a)). For example, you may

provide the initial notice by mailing a

printed copy of it together with a

prospectus. Similarly, you may provide

the initial notice by hand-delivering a

printed copy of it to the customer

together with a brokerage account

application or an investment advisory

contract.

D. Compliance with initial notice

requirement for existing customers by

compliance date. You must provide an

initial notice to each of your current

customers not later than July 1, 2001

(section 248.18(b)). You may do so by

mailing a printed copy of the notice to

the customer’s last known address.

E. Annual notice. During the

continuation of the customer

relationship, you must provide an

annual notice to the customer, as

described in section 248.5(a). You must

provide an annual notice to each

customer at least once in any period of

12 consecutive months during which

the customer relationship exists. You

may define the 12-consecutive-month

period, but must consistently apply that

period to the customer. You may define

the 12-consecutive-month period as a

calendar year and provide the annual

notice to the customer once in each

calendar year following the calendar

year in which you provided the initial

notice. You do not need to provide an

annual notice in addition to an initial

notice in the same 12-month period.

For example, assume that BrokerDealer defines the 12-consecutivemonth period as a calendar year and

provides annual notices to all of its

customers on October 1 of each year. If

Alison Individual opens a cash account

with Broker-Dealer on July 2, 2001,

thereby becoming a customer, then

Broker-Dealer must provide an initial

notice to Alison together with the

account agreement or earlier. BrokerDealer must provide an annual notice to

Alison by December 31, 2002. If BrokerDealer provides an annual notice to

Alison on October 1, 2002, as it does for

other customers, then it must provide

the next annual notice to Alison not

later than October 1, 2003.

F. Method of providing the annual

notice. Like the initial notice, you must

provide the annual notice so that each

customer can reasonably be expected to

receive actual notice of it, in writing

(section 248.9(a)). You may do so by

mailing a printed copy of the notice to

the customer’s last known address.

G. Joint accounts. If two or more

customers jointly obtain a financial

product or service, then you may

provide one initial notice to those

customers jointly. Similarly, you may

provide one annual notice to those

customers jointly (section 248.9(g)).

H. Information described in the initial

and annual notices. The initial and

annual notices must include an accurate

description of the following items of

information:

• The categories of nonpublic

personal information that you collect

(section 248.6(a)(1));

• The fact that you do not disclose

nonpublic personal information about

your current and former customers to

affiliates or nonaffiliated third parties,

except as authorized by sections 248.14

and 248.15 (section 248.6(a)(2)–(4)).

When describing the categories with

respect to those parties, you are required

to state only that you make disclosures

to other nonaffiliated third parties as

permitted by law (section 248.6(c));

• Your policies and practices with

respect to protecting the confidentiality

and security of nonpublic personal

information (section 248.6(a)(8)).

For each of these items of information

above, you may use a sample clause

from the Appendix.

Note: You may use a sample clause only

if that clause accurately describes your actual

policies and practices.

I. Example of notice. If Broker-Dealer

(i) does not have any affiliates and (ii)

only discloses nonpublic personal

information to nonaffiliated third

parties as authorized under sections

248.14 and 248.15, Broker-Dealer may

comply with the requirements of section

248.6 of the rules by using the following

notice, if applicable.

Broker-Dealer collects nonpublic

personal information about you from

the following sources:

• Information we receive from you on

applications or other forms;

• Information about your transactions

with us or others; and

Federal Register / Vol. 65, No. 126 / Thursday, June 29, 2000 / Rules and Regulations 40359

182 You need to describe only those general

categories that apply to your policies and practices.

Accordingly, if you do not collect information from

a ‘‘consumer reporting agency,’’ for instance, then

you need not describe that category in your notices.

183See Proposing Release, supra note 4, at section

IV.

184For purposes of the Paperwork Reduction Act,

Commission staff has estimated that an investment

adviser would require 4 hours of professional time

(at $150 per hour) and 1 hour of clerical or

administrative time (at $15 per hour) to prepare (or

revise) its privacy notice, for a total of $615 ((4 ×

$150) + (1 × $15) = $615).

185For purposes of the Paperwork Reduction Act,

Commission staff has estimated that a broker-dealer

or investment company would require 32 hours of

professional time and 8 hours of clerical or

administrative time to prepare (or revise) its privacy

notice, for a total of $4920 ((32 × $150) + (8 × $15)

= $4920).

186This amount equals the sum of the costs for

broker-dealers, funds, and registered advisers ((5500

+ 4300) × $4920) + (8,100 × $615) = $53.2 million.

The amount of time required for each institution to

prepare (or revise) its privacy notices will vary

depending on the extent to which (i) the institution

shares information and (ii) the institution’s sharing

policy differs for certain consumers or customers.

An institution that does not share information with

affiliates or nonaffiliated third parties may provide

a simplified notice. See section 248.6(c)(5). An

institution that has many affiliates and has different

policies on sharing based on the affiliate or the

customer is likely to require much more time to

draft its notices. Our estimate was based on the

assumption that most broker-dealers and funds

share nonpublic personal information about

consumers or customers with their affiliates (or as

permitted under one of the exceptions discussed

above), but many fewer share information with

nonaffiliated third parties, and that registered

advisers generally do not share with affiliates or

nonaffiliated third parties. For purposes of the

Paperwork Reduction Act, Commission staff has

estimated that a registered adviser would require,

on average, about 5 hours, and a broker-dealer or

fund would require from 5 to over 100 hours, with

an average of about 40 hours, to prepare (or revise)

its privacy notice.

187We assumed that broker-dealers, funds, and

registered advisers generally would include the

initial privacy notices to customers with disclosure

documents or account statements that customers

currently receive, and that the statements generally

would be assembled and sent by organizations that

specialize in mailing and distribution. The

individual cost per institution would vary

significantly depending on the number of the

institution’s customers. The estimate was based on

an average additional cost per mailing of $0.02 for

130.7 million investor accounts. We assumed there

are 53 million brokerage accounts, 77.3 million

individual fund shareholders (see Investment

Company Institute, 1999 Mutual Fund Fact Book 41

(May 1999)), and 400,000 customers of registered

advisers. We noted that the estimated number of

accounts may be significantly higher than the actual

number because we were unable to estimate the

number of individual accounts used for personal,

family, or household purposes.

• Information we receive from a

consumer reporting agency.182

We do not disclose any nonpublic

personal information about you to

anyone, except as permitted by law.

If you decide to close your account(s)

or become an inactive customer, we will

adhere to the privacy policies and

practices as described in this notice.

Broker-Dealer restricts access to your

personal and account information to

those employees who need to know that

information to provide products or

services to you. Broker-Dealer maintains

physical, electronic, and procedural

safeguards to guard your nonpublic

personal information.

J. Initial and annual notices must be

clear and conspicuous. We emphasize

that you must ensure that both the

initial and annual notices are clear and

conspicuous, as defined in section

248.3(c).

K. Example of notice for disclosure to

service providers and joint marketers. If

you disclose nonpublic personal

information in accordance with the

exception in section 248.13, for service

providers and joint marketers, you also

must include an accurate description of

that information. You may comply with

the requirements of section 248.13 of

the rules by including the following

sample clause, if applicable, in the

example of notice described in section

(I) above:

We may disclose all of the

information we collect, as described

[describe location in the notice, such as

‘‘above’’ or ‘‘below’’] to companies that

perform marketing services on our

behalf or to other financial institutions

with whom we have joint marketing

agreements.

L. Internal controls/supervision. The

Commission expects brokers-dealers,

funds, and registered advisers to create

appropriate internal control systems and

exercise appropriate supervision over

compliance with this rule. Compliance

systems could include the maintenance

of copies of the notices provided to

consumers and customers,

documentation in customer files

showing compliance, and procedures

for handling and monitoring opt out

requests.

VII. Cost-Benefit Analysis

The Commission is sensitive to the

costs and benefits that result from its

rules and understands that the rules

may impose costs on broker-dealers,

funds, and registered advisers.

Nevertheless, the rules implement the

privacy provisions of Title V and, we

believe, impose no costs in addition to

those that would result from compliance

with the G–L–B Act.

We believe that the requirements to

provide opt out notices and to protect

customer information will benefit

consumers and customers by protecting

the privacy of their nonpublic personal

information. In addition, the

requirements to provide initial and

annual privacy notices will allow

customers to compare the privacy

policies of financial institutions.

We also believe that the rules provide

greater certainty to the private sector on

how to comply with the G–L–B Act

because they are consistent with and

comparable to the rules adopted by the

Agencies. The examples in the rules and

the sample clauses in the Appendix also

should provide guidance on how the

rules will be enforced with respect to

broker-dealers, funds, and registered

advisers. Finally, in order to reduce

compliance burdens, the rules allow

broker-dealers, funds, and registered

advisers flexibility to distribute notices

and to adopt policies and procedures to

protect customer information that are

best suited to the institution’s business

and needs. These benefits are difficult to

quantify, and we received no data from

commenters.

We estimate that approximately 5500

broker-dealers, 4300 funds, and 8100

registered advisers will be required to

comply with the rules. In the first year

after the rules are adopted, these

institutions must comply with the

following requirements: (i) Prepare

notices describing the institution’s

privacy policies; (ii) provide an initial

privacy notice and opt out notice to

each consumer; (iii) provide an initial

privacy notice to each new customer

(who did not receive a notice when he

or she was a consumer); (iv) provide an

annual privacy notice to each existing

customer; (v) adopt policies and

procedures that address the protection

of customer information and records.

After the first year, broker-dealers,

funds, and registered advisers would be

required to revise notices only to reflect

changes in their privacy policies.

Similarly, these institutions would have

to revise their policies and procedures

on safeguarding customer information

as appropriate to ensure the protection

of the information.

In the Proposing Release, we

estimated certain costs of complying

with the proposed rules.183 We

estimated that a registered adviser

would spend on average $615 to draft a

privacy notice,184 and a broker-dealer or

fund would spend on average $4920 to

draft a privacy notice.185 Therefore, we

estimated a one-time cost to the

industry of approximately $53.2 million

to draft privacy notices.186 For mailing

the notices, we estimated that it would

cost broker-dealers, funds, and

registered advisers $2.6 million to

provide to their customers initial

notices in the first year after adoption,

and the same amount to provide annual

notices to customers each year after

that.187 In addition, we assumed that

most broker-dealers, funds, and

40360 Federal Register / Vol. 65, No. 126 / Thursday, June 29, 2000 / Rules and Regulations

188The estimate represented the costs of 30 hours

of professional time (at $150 per hour) ((5500 +

4300 + 8100) × 30 × $150 = $80.6 million). Our

estimates were based on staff conversations with

representatives from the industry. We understand

that many large institutions currently have

comprehensive policies and procedures for

protecting customer information and records.

Although the policies of those institutions may

need little revision, there may be many departments

or other divisions that will participate in the

review. Smaller institutions that need less

comprehensive policies may devote more time to

implementation or revision of their policies and

procedures.

189See section 248.8.

190This estimate was based on a cost of $0.02 per

mailing to 130.7 million accounts every other year

($0.02 × 130.7 × 5 = $1.3 million). One commenter

stated that it would cost $0.40 per piece to mail the

privacy notices, the same cost as mailing a

confirmation statement. We believe that this

commenter assumed that it would have to provide

a privacy notice to its existing customers in a

separate mailing (as a confirmation must be sent).

The extended compliance date should permit

broker-dealers, funds, and registered advisers to

mail privacy notices to existing customers together

with another mailing, such as an account statement

or shareholder report, so that the costs will be

significantly reduced. The other commenter used

our estimate of $0.02 in its estimate of mailing

costs, and we have continued to use that estimate

in our final cost-benefit analysis.

191See Proposing Release, supra note 4, at section

V.

192The title for the collections of information is:

‘‘Regulation S–P.’’ The OMB control number for

Regulation S–P is 3235–0537 (expiration date April

30, 2003).

193 44 U.S.C. 3506(c)(1)(B)(v).

registered advisers currently have in

place procedures to protect customer

information. Thus, we estimated that

each institution would on average

require approximately 30 hours to

review and revise its policies and

procedures, with a one-time cost to the

industry to comply with the rules of

approximately $80.6 million.188

We received two comments on the

cost-benefit analysis, both of which

opined that we underestimated the costs

and burdens of complying with

Regulation S–P. One commenter

suggested that we increase our estimate

of the cost to mail annual notices to

reflect the cost of providing revised

privacy notices.189 This commenter

suggested that the cost for privacy

notices would increase annual mailing

costs by approximately $1.3 million per

year.190

These commenters further noted that

our estimates did not address other

costs of compliance, including:

Modifying existing systems and

databases, developing new systems to

track delivery of privacy notices and (if

necessary) opt out elections, and

training personnel. One commenter

estimated that the overall cost of

implementing the rules for a large firm

would be at least $1 million. The other

commenter provided no estimates for

these additional costs. Neither

commenter provided any specific data

to explain the amount of time or the

costs associated with the time they

believe will be required to implement

the rules.

The cost of developing and

maintaining records of delivery of

privacy notices and opt out elections,

and costs for personnel training will

vary greatly depending upon the size of

the financial institution, its customer

base, number of affiliates, and the extent

to which the institution intends to share

information. We have been unable to

obtain any reliable information with

which to quantify the amount of these

costs. We recognize that the costs for a

large institution that shares information

with affiliates and nonaffiliated third

parties and that has many customers

may exceed $1 million, and that this

could increase the compliance costs of

the rules. We also believe that the costs

for a small institution, such as a

registered adviser, that has far fewer

customers and does not share with

affiliates or nonaffiliated third parties

will be significantly less.

As discussed above, the privacy

notices will allow customers of brokerdealers, funds, and registered advisers

to compare the privacy policies of

different institutions. This information

is likely to result in some customers

moving their accounts or relationships

from one institution to another whose

policies are better suited to the

customers’ needs. We are unable to

estimate the number of customers who

may make this transfer or the resulting

economic impact on the industry. We

do not believe, however, that customers

would move their accounts from brokerdealers, funds, or investment advisers to

a different type of financial institution

(such as a bank), because we have no

basis for assuming that the privacy

policies adopted by 17,900 brokerdealers, investment companies, and

registered investment advisers would

not be sufficiently varied to address the

needs of any customer.

VIII. Paperwork Reduction Act

Certain provisions of the rules contain

‘‘collection of information’’

requirements within the meaning of the

Paperwork Reduction Act of 1995 (44

U.S.C. 3501–3520). The Commission

published notice soliciting comments

on the collection of information

requirements in the Proposing

Release,191 and submitted these

requirements to the Office of

Management and Budget (‘‘OMB’’) for

review in accordance with 44 U.S.C.

3507(d) and 5 CFR 1320.11. OMB

approved the regulation’s information

collection requirements.192 An agency

may not conduct or sponsor, and a

person is not required to respond to, an

information collection unless it displays

a currently valid OMB control

number.193

IX. Summary of Final Regulatory

Flexibility Analysis

The Commission has prepared a Final

Regulatory Flexibility Analysis (‘‘FRFA’’

or ‘‘analysis’’) for Regulation S–P in

accordance with 5 U.S.C. 604. The

following summarizes the FRFA. A copy

of the FRFA may be obtained by

contacting Penelope W. Saltzman,

Securities and Exchange Commission,

450 5th Street, NW., Washington, DC

20549–0506.

The analysis explains that Regulation

S–P implements provisions of Title V

and that, in general, Title V requires

financial institutions to provide notice

to consumers about the institution’s

privacy policies and practices. The

statute also restricts the ability of a

financial institution to share nonpublic

personal information about consumers

with nonaffiliated third parties, and

allows consumers to prevent the

institution from sharing nonpublic

personal information about them with

certain nonaffiliated third parties by

‘‘opting out’’ of the information sharing.

In addition, Title V requires the

Commission to establish appropriate

standards for financial institutions

subject to their jurisdiction to safeguard

customer information and records.

Section 504 of the G–L–B Act

authorizes the Commission and the

Agencies to prescribe ‘‘such regulations

as may be necessary’’ to carry out the

purposes of Title V. As discussed in the

analysis, we believe that by adopting

rules implementing Title V that are

consistent with and comparable to those

of the Agencies, we will provide the

private sector greater certainty on how

to comply with the statute and clearer

guidance on how the rules will be

enforced with respect to the financial

institutions subject to Title V that are

under the Commission’s jurisdiction.

The analysis states that the Proposing

Release solicited comments on the

IRFA, but we received none. Several

commenters who addressed the

proposed rules, however, suggested that

the Commission reduce compliance

burdens by, among other things,

providing model forms, providing

additional examples, adding additional

flexibility for providing the initial

notice, and extending the effective date.

In response to these comments, we have

Federal Register / Vol. 65, No. 126 / Thursday, June 29, 2000 / Rules and Regulations 40361

194See section 248.9(c)(2).

195See section 248.4(e)(1)(ii) and (iii).

196For purposes of the Regulatory Flexibility Act,

under the Exchange Act a small entity is a broker

or dealer that (i) had total capital of less than

$500,000 on the date in its prior fiscal year as of

which its audited financial statements were

prepared or, if not required to file audited financial

statements, on the last business day of its prior

fiscal year, and (ii) is not affiliated with any person

that is not a small entity and is not affiliated with

any person that is not a small entity. 17 CFR 240.0–

10. Under the Investment Company Act a ‘‘small

entity’’ is an investment company that, together

with other investment companies in the same group

of related investment companies, has net assets of

$50 million or less as of the end of its most recent

fiscal year. 17 CFR 270.0–10. Under the Investment

Advisers Act, a small entity is an investment

adviser that ‘‘(i) manages less than $25 million in

assets, (ii) has total assets of less than $5 million

on the last day of its most recent fiscal year, and

(iii) does not control, is not controlled by, and is

not under common control with another investment

adviser that manages $25 million or more in assets,

or any person that had total assets of $5 million or

more on the last day of the most recent fiscal year.

17 CFR 275.0–7.

197For example, as noted in the Proposing

Release, investment advisers have fiduciary duties

under state law that limit their ability to share

information with third parties. See Proposing

Release, supra note 4, at n.4. This and other

assumptions discussed in this section also are based

on staff conversations with representatives from the

securities industry.

provided a guide to assist brokerdealers, funds, and registered advisers

in complying with the rules. The rules

also include an Appendix with sample

clauses that could be used in privacy

notices under appropriate

circumstances, and should be of

particular help to small entities. Other

revisions to the rules include: (i) A

compliance date of July 1, 2001 (to

allow more time to comply and more

opportunity to include initial notices

with other mailings); (ii) an example

that permits householding annual

privacy notices with prospectuses or

investor reports delivered under the

Commission’s householding rules; 194

and (iii) permitting delivery of an initial

notice within a reasonable time after

establishing the customer relationship

in two additional circumstances.195

As explained in the analysis, the rules

will affect all broker-dealers, funds, and

registered advisers, including small

entities.196 We estimate that

approximately 1000 out of 5500 brokerdealers, 227 out of 4300 funds, and 1500

out of 8100 registered advisers are small

entities.

The analysis explains that subject to

certain exceptions, the rules generally

require that a financial institution

provide all of its customers the

following notices: (i) An initial privacy

notice (not later than when the customer

relationship is established or, by July 1,

2001 for individuals who are your

customers on that date); (ii) an opt out

notice (before sharing the customer’s

nonpublic personal information with

nonaffiliated third parties); and (iii) an

annual privacy notice for the duration of

the customer relationship.

The rules also require a financial

institution to provide its consumers an

initial privacy notice and an opt out

notice prior to disclosing the

individual’s nonpublic personal

information with nonaffiliated third

parties. If the institution does not intend

to share that information about its

consumers, then it need not provide

them with a privacy or opt out notice.

The many exceptions to the general

rules stated above are set forth in

sections 248.13, 248.14, and 248.15. The

analysis notes that in cases in which a

financial institution enters into a

contract with a nonaffiliated third party

to undertake joint marketing or to have

the third party perform certain functions

on behalf of the institution, no opt out

notice need be given. In those cases, the

institution must disclose to the

consumer that it is providing the

information and enter into a contract

with the third party that restricts the

third party’s use of the information and

requires the third party to maintain

confidentiality of the information.

As discussed in the analysis,

compliance requirements will vary

depending, for example, on an

institution’s information sharing

practices, whether the institution

already has or discloses a privacy

policy, and whether the institution

already has established an opt out

mechanism. A financial institution

would have to summarize its practices

regarding its collection, sharing, and

safeguarding of certain nonpublic

personal information in its initial and

annual notices. However, if the

institution does not share that

information (or shares only to the extent

permitted under the exceptions), its

privacy notice may be brief. We believe

that many financial institutions already

have privacy policies in place as part of

usual and customary business practices,

and that many broker-dealers, funds,

and investment advisers currently do

not share nonpublic personal

information about consumers with

nonaffiliated third parties except as

would be consistent with one of the

many exceptions in the rules.197 In the

Proposing Release, we estimated that a

registered adviser would spend an

average of 5 hours to prepare a privacy

notice, and a broker-dealer or fund

would spend approximately 40 hours on

average to prepare a privacy notice. We

further understand that those

institutions that do share information

under one of the permitted exceptions

generally have contract provisions that

prohibit the third party’s use of the

information for purposes other than the

purpose for which the information was

shared. Thus we believe that, as a result

of the rules, many financial institutions

will not have to provide opt out notices

to consumers, will have brief annual

privacy notices for customers, and will

not need to revise their contracts with

nonaffiliated third parties to restrict

those parties’ use of information.

To minimize the burden and costs of

distributing privacy policies, the rules

do not specify the method for

distributing required notices. As

discussed more fully in the analysis, a

financial institution may include an

initial privacy statement with other

required disclosure statements, and may

include an annual notice with periodic

account statements. We estimate that

the costs of distributing the notices will

be minimal because an institution will

include the notices in mailings or

distributions that it already sends to

consumers and customers.

The analysis explains that the rules

require every broker-dealer, fund, and

registered adviser to adopt policies and

procedures reasonably designed to

safeguard customer records and

information. The IRFA noted, and we

continue to believe, that most if not all

financial institutions already have

policies and procedures to address the

safety and confidentiality of consumer

records and information. Nevertheless,

financial institutions may review and

revise their policies after the rules are

adopted. The amount of time an

institution will spend reviewing and

revising its policies will depend, among

other things, on the institution’s current

policies and its sharing practices. The

rules do not specify the means by which

institutions must ensure the safety of

customer information and records in

order to allow each institution to tailor

its policies and procedures to its own

systems of information gathering and

transfer, and the needs of its customers.

As noted in the IRFA, Commission staff

estimated that in the first year after the

rules are adopted, a financial institution

would spend an average of 30 hours to

adopt or revise its policies.

Two commenters argued that we

underestimated the costs of

implementing Regulation S–P. As

explained in the analysis, the

commenters did not provide estimates

of the amount of time or the costs to

implement the rules. We have been

unable to obtain reliable information

regarding these costs. Therefore, we

have not provided an estimate of the

cost of implementing the rules for

40362 Federal Register / Vol. 65, No. 126 / Thursday, June 29, 2000 / Rules and Regulations

198 15 U.S.C. 78w(a)(2).

199See, e.g., Banking Agencies’ Release, supra

note 2.

200 G–L–B Act § 501(b).

201 15 U.S.C. 78c(f).

202 15 U.S.C. 80a–2(c).

203See Proposing Release, supra note 4, at section

VII.

individual institutions or for the

industry as a whole. Although we

recognize that the cost of implementing

the rules may be $1 million or more for

a large institution that shares

information with affiliates and

nonaffiliated third parties, we believe

the costs for small institutions that do

not share nonpublic personal

information about consumers will be

substantially less.

The analysis explains that the

Regulatory Flexibility Act directs the

Commission to consider significant

alternatives that would accomplish the

stated objective, while minimizing any

significant adverse impact on small

entities. As noted above, we believe that

a number of revisions made to the final

rules will benefit small entities. Finally,

the analysis notes that the rules contain

performance rather than design

standards. The rules do not specify the

(i) form of privacy notices, (ii) method

of delivery of the notices to customers

and consumers, or (iii) policies and

procedures that broker-dealers, funds,

and registered advisers must adopt to

ensure the privacy of the financial

information and records of their

customers and consumers. Therefore,

the rules provide these entities

substantial flexibility that allows them

to meet the requirements of Regulation

S–P in a way that best suits the

institution’s individual needs.

X. Analysis of Effects on Efficiency,

Competition, and Capital Formation

Section 23(a)(2) of the Exchange

Act 198 requires the Commission, in

adopting rules under the Exchange Act,

to consider the anti-competitive effects

of any rules it adopts. The rules, which

implement Title V, apply to all brokerdealers, funds, and registered advisers.

Each of these institutions must provide

initial and annual privacy notices to

customers as well as initial notices and

opt out forms to consumers before the

institution shares nonpublic personal

information about consumers with

nonaffiliated third parties. These

institutions also must establish

standards for protecting customer

information and records.

Other financial institutions will be

subject to substantially similar privacy

notice and opt out requirements under

rules adopted by the Agencies.199 Under

the G–L–B Act, these agencies also are

required to adopt rules addressing

policies and procedures for protecting

customer information.200 Therefore, all

financial institutions will have to bear

the costs of implementing the rules or

substantially similar rules.

The rules do not dictate the privacy

policies of any financial institution.

Some customers may move their

accounts from one institution to another

based on the institution’s privacy

policies. Thus, the rules may promote

competition among financial

institutions based on customers’

preferences regarding privacy policies.

Section 3(f) of the Exchange Act 201

and section 2(c) of the Investment

Company Act 202 require the

Commission, when engaging in

rulemaking that requires it to consider

or determine whether an action is

necessary or appropriate in the public

interest, to consider whether the action

will promote efficiency, competition,

and capital formation. We solicited

comment on these matters in connection

with the proposed rules but received no

comment.203 Our analysis on

competition is discussed above. The

rules will result in additional costs for

financial institutions, which may affect

the efficiency of these institutions. On

the other hand, the rules will allow

customers of financial institutions to

compare privacy policies, which may

result in customers choosing to do

business with a financial institution

based on its policies. We are not aware

of any effect the rules will have on

capital formation.

XI. Statutory Authority

The Commission is adopting

Regulation S–P under the authority set

forth in section 504 of the G–L–B Act

[15 U.S.C. 6804], sections 17 and 23 of

the Exchange Act [15 U.S.C. 78q, 78w],

sections 31 and 38 of the Investment

Company Act [15 U.S.C. 80a–30(a), 80a–

37], and sections 204 and 211 of the

Investment Advisers Act [15 U.S.C.

80b–4, 80b–11].

Text of Rules

List of Subjects in 17 CFR Part 248

Brokers, Dealers, Investment advisers,

Investment companies, Privacy,

Reporting and recordkeeping

requirements.

For the reasons set out in the

preamble, the Commission amends Title

17, Chapter II of the Code of Federal

Regulations by adding a new part 248 to

read as follows:

PART 248—REGULATION S–P:

PRIVACY OF CONSUMER FINANCIAL

INFORMATION

Sec.

248.1 Purpose and scope.

248.2 Rule of construction.

248.3 Definitions.

Subpart A—Privacy and Opt Out Notices

248.4 Initial privacy notice to consumers

required.

248.5 Annual privacy notice to customers

required.

248.6 Information to be included in privacy

notices.

248.7 Form of opt out notice to consumers;

opt out methods.

248.8 Revised privacy notices.

248.9 Delivering privacy and opt out

notices.

Subpart B—Limits on Disclosures

248.10 Limits on disclosure of nonpublic

personal information to nonaffiliated

third parties.

248.11 Limits on redisclosure and reuse of

information.

248.12 Limits on sharing account number

information for marketing purposes.

Subpart C—Exceptions

248.13 Exception to opt out requirements

for service providers and joint marketing.

248.14 Exceptions to notice and opt out

requirements for processing and

servicing transactions.

248.15 Other exceptions to notice and opt

out requirements.

Subpart D—Relation to Other Laws;

Effective Date

248.16 Protection of Fair Credit Reporting

Act.

248.17 Relation to State laws.

248.18 Effective date; transition rule.

248.19–248.29 [Reserved]

248.30 Procedures to safeguard customer

records and information.

Appendix A to Part 248—Sample

Clauses

Authority: 15 U.S.C. 6801–6809; 15 U.S.C.

78q, 78w, 80a–30(a), 80a–37, 80b–4, and

80b–11.

§ 248.1 Purpose and scope.

(a) Purpose. This part governs the

treatment of nonpublic personal

information about consumers by the

financial institutions listed in paragraph

(b) of this section. This part:

(1) Requires a financial institution to

provide notice to customers about its

privacy policies and practices;

(2) Describes the conditions under

which a financial institution may

disclose nonpublic personal information

about consumers to nonaffiliated third

parties; and

(3) Provides a method for consumers

to prevent a financial institution from

disclosing that information to most

nonaffiliated third parties by ‘‘opting

Federal Register / Vol. 65, No. 126 / Thursday, June 29, 2000 / Rules and Regulations 40363

out’’ of that disclosure, subject to the

exceptions in §§ 248.13, 248.14, and

248.15.

(b) Scope. This part applies only to

nonpublic personal information about

individuals who obtain financial

products or services primarily for

personal, family, or household purposes

from the institutions listed below. This

part does not apply to information about

companies or about individuals who

obtain financial products or services

primarily for business, commercial, or

agricultural purposes. This part applies

to brokers, dealers, and investment

companies, as well as to investment

advisers that are registered with the

Commission. It also applies to foreign

(non-resident) brokers, dealers,

investment companies and investment

advisers that are registered with the

Commission. These entities are referred

to in this part as ‘‘you.’’ This part does

not apply to foreign (non-resident)

brokers, dealers, investment companies

and investment advisers that are not

registered with the Commission.

Nothing in this part modifies, limits, or

supersedes the standards governing

individually identifiable health

information promulgated by the

Secretary of Health and Human Services

under the authority of sections 262 and

264 of the Health Insurance Portability

and Accountability Act of 1996 (42

U.S.C. 1320d–1320d–8).

§ 248.2 Rule of construction.

The examples in this part and the

sample clauses in appendix A of this

part provide guidance concerning the

rule’s application in ordinary

circumstances. The facts and

circumstances of each individual

situation, however, will determine

whether compliance with an example or

use of a sample clause, to the extent

applicable, constitutes compliance with

this part.

§ 248.3 Definitions.

As used in this part, unless the

context requires otherwise:

(a) Affiliate of a broker, dealer, or

investment company, or an investment

adviser registered with the Commission

means any company that controls, is

controlled by, or is under common

control with the broker, dealer, or

investment company, or investment

adviser registered with the Commission.

In addition, a broker, dealer, or

investment company, or an investment

adviser registered with the Commission

will be deemed an affiliate of a company

for purposes of this part if:

(1) That company is regulated under

Title V of the G–L–B Act by the Federal

Trade Commission or by a Federal

functional regulator other than the

Commission; and

(2) Rules adopted by the Federal

Trade Commission or another federal

functional regulator under Title V of the

G–L–B Act treat the broker, dealer, or

investment company, or investment

adviser registered with the Commission

as an affiliate of that company.

(b) Broker has the same meaning as in

section 3(a)(4) of the Securities

Exchange Act of 1934 (15 U.S.C.

78c(a)(4)).

(c)(1) Clear and conspicuous means

that a notice is reasonably

understandable and designed to call

attention to the nature and significance

of the information in the notice.

(2) Examples. (i) Reasonably

understandable. You make your notice

reasonably understandable if you:

(A) Present the information in the

notice in clear, concise sentences,

paragraphs, and sections;

(B) Use short explanatory sentences or

bullet lists whenever possible;

(C) Use definite, concrete, everyday

words and active voice whenever

possible;

(D) Avoid multiple negatives;

(E) Avoid legal and highly technical

business terminology whenever

possible; and

(F) Avoid explanations that are

imprecise and readily subject to

different interpretations.

(ii) Designed to call attention. You

design your notice to call attention to

the nature and significance of the

information in it if you:

(A) Use a plain-language heading to

call attention to the notice;

(B) Use a typeface and type size that

are easy to read;

(C) Provide wide margins and ample

line spacing;

(D) Use boldface or italics for key

words; and

(E) Use distinctive type size, style,

and graphic devices, such as shading or

sidebars when you combine your notice

with other information.

(iii) Notices on web sites. If you

provide a notice on a web page, you

design your notice to call attention to

the nature and significance of the

information in it if you use text or visual

cues to encourage scrolling down the

page if necessary to view the entire

notice and ensure that other elements

on the web site (such as text, graphics,

hyperlinks, or sound) do not distract

attention from the notice, and you

either:

(A) Place the notice on a screen that

consumers frequently access, such as a

page on which transactions are

conducted; or

(B) Place a link on a screen that

consumers frequently access, such as a

page on which transactions are

conducted, that connects directly to the

notice and is labeled appropriately to

convey the importance, nature, and

relevance of the notice.

(d) Collect means to obtain

information that you organize or can

retrieve by the name of an individual or

by identifying number, symbol, or other

identifying particular assigned to the

individual, irrespective of the source of

the underlying information.

(e) Commission means the Securities

and Exchange Commission.

(f) Company means any corporation,

limited liability company, business

trust, general or limited partnership,

association, or similar organization.

(g)(1) Consumer means an individual

who obtains or has obtained a financial

product or service from you that is to be

used primarily for personal, family, or

household purposes, or that individual’s

legal representative.

(2) Examples. (i) An individual is

your consumer if he or she provides

nonpublic personal information to you

in connection with obtaining or seeking

to obtain brokerage services or

investment advisory services, whether

or not you provide brokerage services to

the individual or establish a continuing

relationship with the individual.

(ii) An individual is not your

consumer if he or she provides you only

with his or her name, address, and

general areas of investment interest in

connection with a request for a

prospectus, an investment adviser

brochure, or other information about

financial products or services.

(iii) An individual is not your

consumer if he or she has an account

with another broker or dealer (the

introducing broker-dealer) that carries

securities for the individual in a special

omnibus account with you (the clearing

broker-dealer) in the name of the

introducing broker-dealer, and when

you receive only the account numbers

and transaction information of the

introducing broker-dealer’s consumers

in order to clear transactions.

(iv) If you are an investment

company, an individual is not your

consumer when the individual

purchases an interest in shares you have

issued only through a broker or dealer

or investment adviser who is the record

owner of those shares.

(v) An individual who is a consumer

of another financial institution is not

your consumer solely because you act as

agent for, or provide processing or other

services to, that financial institution.

(vi) An individual is not your

consumer solely because he or she has

designated you as trustee for a trust.

40364 Federal Register / Vol. 65, No. 126 / Thursday, June 29, 2000 / Rules and Regulations

(vii) An individual is not your

consumer solely because he or she is a

beneficiary of a trust for which you are

a trustee.

(viii) An individual is not your

consumer solely because he or she is a

participant or a beneficiary of an

employee benefit plan that you sponsor

or for which you act as a trustee or

fiduciary.

(h) Consumer reporting agency has

the same meaning as in section 603(f) of

the Fair Credit Reporting Act (15 U.S.C.

1681a(f)).

(i) Control of a company means the

power to exercise a controlling

influence over the management or

policies of a company whether through

ownership of securities, by contract, or

otherwise. Any person who owns

beneficially, either directly or through

one or more controlled companies, more

than 25 percent of the voting securities

of any company is presumed to control

the company. Any person who does not

own more than 25 percent of the voting

securities of any company will be

presumed not to control the company.

Any presumption regarding control may

be rebutted by evidence, but, in the case

of an investment company, will

continue until the Commission makes a

decision to the contrary according to the

procedures described in section 2(a)(9)

of the Investment Company Act of 1940

(15 U.S.C. 80a–2(a)(9)).

(j) Customer means a consumer who

has a customer relationship with you.

(k)(1) Customer relationship means a

continuing relationship between a

consumer and you under which you

provide one or more financial products

or services to the consumer that are to

be used primarily for personal, family,

or household purposes.

(2) Examples. (i) Continuing

relationship. A consumer has a

continuing relationship with you if:

(A) The consumer has a brokerage

account with you, or if a consumer’s

account is transferred to you from

another broker-dealer;

(B) The consumer has an investment

advisory contract with you (whether

written or oral);

(C) The consumer is the record owner

of securities you have issued if you are

an investment company;

(D) The consumer holds an

investment product through you, such

as when you act as a custodian for

securities or for assets in an Individual

Retirement Arrangement;

(E) The consumer purchases a

variable annuity from you;

(F) The consumer has an account with

an introducing broker or dealer that

clears transactions with and for its

customers through you on a fully

disclosed basis;

(G) You hold securities or other assets

as collateral for a loan made to the

consumer, even if you did not make the

loan or do not effect any transactions on

behalf of the consumer; or

(H) You regularly effect or engage in

securities transactions with or for a

consumer even if you do not hold any

assets of the consumer.

(ii) No continuing relationship. A

consumer does not, however, have a

continuing relationship with you if you

open an account for the consumer solely

for the purpose of liquidating or

purchasing securities as an

accommodation, i.e., on a one time

basis, without the expectation of

engaging in other transactions.

(1) Dealer has the same meaning as in

section 3(a)(5) of the Securities

Exchange Act of 1934 (15 U.S.C.

78c(a)(5)).

(m) Federal functional regulator

means:

(1) The Board of Governors of the

Federal Reserve System;

(2) The Office of the Comptroller of

the Currency;

(3) The Board of Directors of the

Federal Deposit Insurance Corporation;

(4) The Director of the Office of Thrift

Supervision;

(5) The National Credit Union

Administration Board; and

(6) The Securities and Exchange

Commission.

(n)(1) Financial institution means any

institution the business of which is

engaging in activities that are financial

in nature or incidental to such financial

activities as described in section 4(k) of

the Bank Holding Company Act of 1956

(12 U.S.C. 1843(k)).

(2) Financial institution does not

include:

(i) Any person or entity with respect

to any financial activity that is subject

to the jurisdiction of the Commodity

Futures Trading Commission under the

Commodity Exchange Act (7 U.S.C. 1 et

seq.);

(ii) The Federal Agricultural Mortgage

Corporation or any entity chartered and

operating under the Farm Credit Act of

1971 (12 U.S.C. 2001 et seq.); or

(iii) Institutions chartered by Congress

specifically to engage in securitizations,

secondary market sales (including sales

of servicing rights), or similar

transactions related to a transaction of a

consumer, as long as such institutions

do not sell or transfer nonpublic

personal information to a nonaffiliated

third party.

(o)(1) Financial product or service

means any product or service that a

financial holding company could offer

by engaging in an activity that is

financial in nature or incidental to such

a financial activity under section 4(k) of

the Bank Holding Company Act of 1956

(12 U.S.C. 1843(k)).

(2) Financial service includes your

evaluation or brokerage of information

that you collect in connection with a

request or an application from a

consumer for a financial product or

service.

(p) G–L–B Act means the GrammLeach-Bliley Act (Pub. L. No. 106–102,

113 Stat. 1338 (1999)).

(q) Investment adviser has the same

meaning as in section 202(a)(11) of the

Investment Advisers Act of 1940 (15

U.S.C. 80b–2(a)(11)).

(r) Investment company has the same

meaning as in section 3 of the

Investment Company Act of 1940 (15

U.S.C. 80a–3), and includes a separate

series of the investment company.

(s)(1) Nonaffiliated third party means

any person except:

(i) Your affiliate; or

(ii) A person employed jointly by you

and any company that is not your

affiliate (but nonaffiliated third party

includes the other company that jointly

employs the person).

(2) Nonaffiliated third party includes

any company that is an affiliate solely

by virtue of your or your affiliate’s

direct or indirect ownership or control

of the company in conducting merchant

banking or investment banking activities

of the type described in section

4(k)(4)(H) or insurance company

investment activities of the type

described in section 4(k)(4)(I) of the

Bank Holding Company Act (12 U.S.C.

§§ 1843(k)(4)(H) and (I)).

(t)(1) Nonpublic personal information

means:

(i) Personally identifiable financial

information; and

(ii) Any list, description, or other

grouping of consumers (and publicly

available information pertaining to

them) that is derived using any

personally identifiable financial

information that is not publicly

available information.

(2) Nonpublic personal information

does not include:

(i) Publicly available information,

except as included on a list described in

paragraph (t)(1)(ii) of this section or

when the publicly available information

is disclosed in a manner that indicates

the individual is or has been your

consumer; or

(ii) Any list, description, or other

grouping of consumers (and publicly

available information pertaining to

them) that is derived without using any

personally identifiable financial

Federal Register / Vol. 65, No. 126 / Thursday, June 29, 2000 / Rules and Regulations 40365

information that is not publicly

available information.

(3) Examples of lists. (i) Nonpublic

personal information includes any list

of individuals’ names and street

addresses that is derived in whole or in

part using personally identifiable

financial information that is not

publicly available information, such as

account numbers.

(ii) Nonpublic personal information

does not include any list of individuals’

names and addresses that contains only

publicly available information, is not

derived in whole or in part using

personally identifiable financial

information that is not publicly

available information, and is not

disclosed in a manner that indicates that

any of the individuals on the list is a

consumer of a financial institution.

(u)(1) Personally identifiable financial

information means any information:

(i) A consumer provides to you to

obtain a financial product or service

from you;

(ii) About a consumer resulting from

any transaction involving a financial

product or service between you and a

consumer; or

(iii) You otherwise obtain about a

consumer in connection with providing

a financial product or service to that

consumer.

(2) Examples. (i) Information

included. Personally identifiable

financial information includes:

(A) Information a consumer provides

to you on an application to obtain a

loan, credit card, or other financial

product or service;

(B) Account balance information,

payment history, overdraft history, and

credit or debit card purchase

information;

(C) The fact that an individual is or

has been one of your customers or has

obtained a financial product or service

from you;

(D) Any information about your

consumer if it is disclosed in a manner

that indicates that the individual is or

has been your consumer;

(E) Any information that a consumer

provides to you or that you or your

agent otherwise obtain in connection

with collecting on a loan or servicing a

loan;

(F) Any information you collect

through an Internet ‘‘cookie’’ (an

information collecting device from a

web server); and

(G) Information from a consumer

report.

(ii) Information not included.

Personally identifiable financial

information does not include:

(A) A list of names and addresses of

customers of an entity that is not a

financial institution; or

(B) Information that does not identify

a consumer, such as aggregate

information or blind data that does not

contain personal identifiers such as

account numbers, names, or addresses.

(v)(1) Publicly available information

means any information that you

reasonably believe is lawfully made

available to the general public from:

(i) Federal, State, or local government

records;

(ii) Widely distributed media; or

(iii) Disclosures to the general public

that are required to be made by federal,

State, or local law.

(2) Examples. (i) Reasonable belief.

(A) You have a reasonable belief that

information about your consumer is

made available to the general public if

you have confirmed, or your consumer

has represented to you, that the

information is publicly available from a

source described in paragraphs (v)(1)(i)–

(iii) of this section;

(B) You have a reasonable belief that

information about your consumer is

made available to the general public if

you have taken steps to submit the

information, in accordance with your

internal procedures and policies and

with applicable law, to a keeper of

federal, State, or local government

records that is required by law to make

the information publicly available.

(C) You have a reasonable belief that

an individual’s telephone number is

lawfully made available to the general

public if you have located the telephone

number in the telephone book or the

consumer has informed you that the

telephone number is not unlisted.

(D) You do not have a reasonable

belief that information about a

consumer is publicly available solely

because that information would

normally be recorded with a keeper of

federal, State, or local government

records that is required by law to make

the information publicly available, if the

consumer has the ability in accordance

with applicable law to keep that

information nonpublic, such as where a

consumer may record a deed in the

name of a blind trust.

(ii) Government records. Publicly

available information in government

records includes information in

government real estate records and

security interest filings.

(iii) Widely distributed media.

Publicly available information from

widely distributed media includes

information from a telephone book, a

television or radio program, a

newspaper, or a web site that is

available to the general public on an

unrestricted basis. A web site is not

restricted merely because an Internet

service provider or a site operator

requires a fee or a password, so long as

access is available to the general public.

(w) You means:

(1) Any broker or dealer;

(2) Any investment company; and

(3) Any investment adviser registered

with the Commission under the

Investment Advisers Act of 1940.

Subpart A—Privacy and Opt Out

Notices

§ 248.4 Initial privacy notice to consumers

required.

(a) Initial notice requirement. You

must provide a clear and conspicuous

notice that accurately reflects your

privacy policies and practices to:

(1) Customer. An individual who

becomes your customer, not later than

when you establish a customer

relationship, except as provided in

paragraph (e) of this section; and

(2) Consumer. A consumer, before you

disclose any nonpublic personal

information about the consumer to any

nonaffiliated third party, if you make

such a disclosure other than as

authorized by §§ 248.14 and 248.15.

(b) When initial notice to a consumer

is not required. You are not required to

provide an initial notice to a consumer

under paragraph (a) of this section if:

(1) You do not disclose any nonpublic

personal information about the

consumer to any nonaffiliated third

party, other than as authorized by

§§ 248.14 and 248.15; and

(2) You do not have a customer

relationship with the consumer.

(c) When you establish a customer

relationship. (1) General rule. You

establish a customer relationship when

you and the consumer enter into a

continuing relationship.

(2) Special rule for loans. You do not

have a customer relationship with a

consumer if you buy a loan made to the

consumer but do not have the servicing

rights for that loan.

(3) Examples of establishing customer

relationship. You establish a customer

relationship when the consumer:

(i) Effects a securities transaction with

you or opens a brokerage account with

you under your procedures;

(ii) Opens a brokerage account with

an introducing broker or dealer that

clears transactions with and for its

customers through you on a fully

disclosed basis;

(iii) Enters into an advisory contract

with you (whether in writing or orally);

or

(iv) Purchases shares you have issued

(and the consumer is the record owner

of the shares), if you are an investment

company.

(d) Existing customers. When an

existing customer obtains a new

40366 Federal Register / Vol. 65, No. 126 / Thursday, June 29, 2000 / Rules and Regulations

financial product or service from you

that is to be used primarily for personal,

family, or household purposes, you

satisfy the initial notice requirements of

paragraph (a) of this section as follows:

(1) You may provide a revised privacy

notice, under § 248.8, that covers the

customer’s new financial product or

service; or

(2) If the initial, revised, or annual

notice that you most recently provided

to that customer was accurate with

respect to the new financial product or

service, you do not need to provide a

new privacy notice under paragraph (a)

of this section.

(e) Exceptions to allow subsequent

delivery of notice. (1) You may provide

the initial notice required by paragraph

(a)(1) of this section within a reasonable

time after you establish a customer

relationship if:

(i) Establishing the customer

relationship is not at the customer’s

election;

(ii) Providing notice not later than

when you establish a customer

relationship would substantially delay

the customer’s transaction and the

customer agrees to receive the notice at

a later time; or

(iii) A nonaffiliated broker or dealer or

investment adviser establishes a

customer relationship between you and

a consumer without your prior

knowledge.

(2) Examples of exceptions. (i) Not at

customer’s election. Establishing a

customer relationship is not at the

customer’s election if the customer’s

account is transferred to you by a trustee

selected by the Securities Investor

Protection Corporation (‘‘SIPC’’) and

appointed by a United States Court.

(ii) Substantial delay of customer’s

transaction. Providing notice not later

than when you establish a customer

relationship would substantially delay

the customer’s transaction when you

and the individual agree over the

telephone to enter into a customer

relationship involving prompt delivery

of the financial product or service.

(iii) No substantial delay of

customer’s transaction. Providing notice

not later than when you establish a

customer relationship would not

substantially delay the customer’s

transaction when the relationship is

initiated in person at your office or

through other means by which the

customer may view the notice, such as

on a web site.

(f) Delivery. When you are required to

deliver an initial privacy notice by this

section, you must deliver it according to

§ 248.9. If you use a short-form initial

notice for non-customers according to

§ 248.6(d), you may deliver your privacy

notice according to § 248.6(d)(3).

§ 248.5 Annual privacy notice to

customers required.

(a)(1) General rule. You must provide

a clear and conspicuous notice to

customers that accurately reflects your

privacy policies and practices not less

than annually during the continuation

of the customer relationship. Annually

means at least once in any period of 12

consecutive months during which that

relationship exists. You may define the

12-consecutive-month period, but you

must apply it to the customer on a

consistent basis.

(2) Example. You provide a notice

annually if you define the 12-

consecutive-month period as a calendar

year and provide the annual notice to

the customer once in each calendar year

following the calendar year in which

you provided the initial notice. For

example, if a customer opens an account

on any day of year 1, you must provide

an annual notice to that customer by

December 31 of year 2.

(b)(1) Termination of customer

relationship. You are not required to

provide an annual notice to a former

customer.

(2) Examples. Your customer becomes

a former customer when:

(i) The individual’s brokerage account

is closed;

(ii) The individual’s investment

advisory contract is terminated;

(iii) You are an investment company

and the individual is no longer the

record owner of securities you have

issued; or

(iv) You are an investment company

and your customer has been determined

to be a lost securityholder as defined in

17 CFR 240.17a–24(b).

(c) Special rule for loans. If you do not

have a customer relationship with a

consumer under the special provision

for loans in § 248.4(c)(2), then you need

not provide an annual notice to that

consumer under this section.

(d) Delivery. When you are required to

deliver an annual privacy notice by this

section, you must deliver it according to

§ 248.9.

§ 248.6 Information to be included in

privacy notices.

(a) General rule. The initial, annual,

and revised privacy notices that you

provide under §§ 248.4, 248.5, and

248.8 must include each of the

following items of information that

applies to you or to the consumers to

whom you send your privacy notice, in

addition to any other information you

wish to provide:

(1) The categories of nonpublic

personal information that you collect;

(2) The categories of nonpublic

personal information that you disclose;

(3) The categories of affiliates and

nonaffiliated third parties to whom you

disclose nonpublic personal

information, other than those parties to

whom you disclose information under

§§ 248.14 and 248.15;

(4) The categories of nonpublic

personal information about your former

customers that you disclose and the

categories of affiliates and nonaffiliated

third parties to whom you disclose

nonpublic personal information about

your former customers, other than those

parties to whom you disclose

information under §§ 248.14 and 248.15;

(5) If you disclose nonpublic personal

information to a nonaffiliated third

party under § 248.13 (and no other

exception applies to that disclosure), a

separate statement of the categories of

information you disclose and the

categories of third parties with whom

you have contracted;

(6) An explanation of the consumer’s

right under § 248.10(a) to opt out of the

disclosure of nonpublic personal

information to nonaffiliated third

parties, including the method(s) by

which the consumer may exercise that

right at that time;

(7) Any disclosures that you make

under section 603(d)(2)(A)(iii) of the

Fair Credit Reporting Act (15 U.S.C.

1681a(d)(2)(A)(iii)) (that is, notices

regarding the ability to opt out of

disclosures of information among

affiliates);

(8) Your policies and practices with

respect to protecting the confidentiality

and security of nonpublic personal

information; and

(9) Any disclosure that you make

under paragraph (b) of this section.

(b) Description of nonaffiliated third

parties subject to exceptions. If you

disclose nonpublic personal information

to third parties as authorized under

§§ 248.14 and 248.15, you are not

required to list those exceptions in the

initial or annual privacy notices

required by §§ 248.4 and 248.5. When

describing the categories with respect to

those parties, you are required to state

only that you make disclosures to other

nonaffiliated third parties as permitted

by law.

(c) Examples. (1) Categories of

nonpublic personal information that

you collect. You satisfy the requirement

to categorize the nonpublic personal

information that you collect if you list

the following categories, as applicable:

(i) Information from the consumer;

(ii) Information about the consumer’s

transactions with you or your affiliates;

Federal Register / Vol. 65, No. 126 / Thursday, June 29, 2000 / Rules and Regulations 40367

(iii) Information about the consumer’s

transactions with nonaffiliated third

parties; and

(iv) Information from a consumerreporting agency.

(2) Categories of nonpublic personal

information you disclose. (i) You satisfy

the requirement to categorize the

nonpublic personal information that

you disclose if you list the categories

described in paragraph (e)(1) of this

section, as applicable, and a few

examples to illustrate the types of

information in each category.

(ii) If you reserve the right to disclose

all of the nonpublic personal

information about consumers that you

collect, you may simply state that fact

without describing the categories or

examples of the nonpublic personal

information you disclose.

(3) Categories of affiliates and

nonaffiliated third parties to whom you

disclose. You satisfy the requirement to

categorize the affiliates and

nonaffiliated third parties to whom you

disclose nonpublic personal information

if you list the following categories, as

applicable, and a few examples to

illustrate the types of third parties in

each category:

(i) Financial service providers;

(ii) Non-financial companies; and

(iii) Others.

(4) Disclosures under exception for

service providers and joint marketers. If

you disclose nonpublic personal

information under the exception in

§ 248.13 to a nonaffiliated third party to

market products or services that you

offer alone or jointly with another

financial institution, you satisfy the

disclosure requirement of paragraph

(a)(5) of this section if you:

(i) List the categories of nonpublic

personal information you disclose,

using the same categories and examples

you used to meet the requirements of

paragraph (a)(2) of this section, as

applicable; and

(ii) State whether the third party is:

(A) A service provider that performs

marketing services on your behalf or on

behalf of you and another financial

institution; or

(B) A financial institution with which

you have a joint marketing agreement.

(5) Simplified notices. If you do not

disclose, and do not wish to reserve the

right to disclose, nonpublic personal

information to affiliates or nonaffiliated

third parties except as authorized under

§§ 248.14 and 248.15, you may simply

state that fact, in addition to the

information you must provide under

paragraphs (a)(1), (a)(8), (a)(9), and (b) of

this section.

(6) Confidentiality and security. You

describe your policies and practices

with respect to protecting the

confidentiality and security of

nonpublic personal information if you

do both of the following:

(i) Describe in general terms who is

authorized to have access to the

information; and

(ii) State whether you have security

practices and procedures in place to

ensure the confidentiality of the

information in accordance with your

policy. You are not required to describe

technical information about the

safeguards you use.

(d) Short-form initial notice with opt

out notice for non-customers. (1) You

may satisfy the initial notice

requirements in §§ 248.4(a)(2), 248.7(b),

and 248.7(c) for a consumer who is not

a customer by providing a short-form

initial notice at the same time as you

deliver an opt out notice as required in

§ 248.7.

(2) A short-form initial notice must:

(i) Be clear and conspicuous;

(ii) State that your privacy notice is

available upon request; and

(iii) Explain a reasonable means by

which the consumer may obtain the

privacy notice.

(3) You must deliver your short-form

initial notice according to § 248.9. You

are not required to deliver your privacy

notice with your short-form initial

notice. You instead may simply provide

the consumer a reasonable means to

obtain your privacy notice. If a

consumer who receives your short-form

notice requests your privacy notice, you

must deliver your privacy notice

according to § 248.9.

(4) Examples of obtaining privacy

notice. You provide a reasonable means

by which a consumer may obtain a copy

of your privacy notice if you:

(i) Provide a toll-free telephone

number that the consumer may call to

request the notice; or

(ii) For a consumer who conducts

business in person at your office,

maintain copies of the notice on hand

that you provide to the consumer

immediately upon request.

(e) Future disclosures. Your notice

may include:

(1) Categories of nonpublic personal

information that you reserve the right to

disclose in the future, but do not

currently disclose; and

(2) Categories of affiliates or

nonaffiliated third parties to whom you

reserve the right in the future to

disclose, but to whom you do not

currently disclose, nonpublic personal

information.

(f) Sample clauses. Sample clauses

illustrating some of the notice content

required by this section are included in

Appendix A of this part.

§ 248.7 Form of opt out notice to

consumers; opt out methods.

(a)(1) Form of opt out notice. If you

are required to provide an opt out notice

under § 248.10(a), you must provide a

clear and conspicuous notice to each of

your consumers that accurately explains

the right to opt out under that section.

The notice must state:

(i) That you disclose or reserve the

right to disclose nonpublic personal

information about your consumer to a

nonaffiliated third party;

(ii) That the consumer has the right to

opt out of that disclosure; and

(iii) A reasonable means by which the

consumer may exercise the opt out

right.

(2) Examples. (i) Adequate opt out

notice. You provide adequate notice that

the consumer can opt out of the

disclosure of nonpublic personal

information to a nonaffiliated third

party if you:

(A) Identify all of the categories of

nonpublic personal information that

you disclose or reserve the right to

disclose, and all of the categories of

nonaffiliated third parties to which you

disclose the information, as described in

§ 248.6(a)(2) and (3) and state that the

consumer can opt out of the disclosure

of that information; and

(B) Identify the financial products or

services that the consumer obtains from

you, either singly or jointly, to which

the opt out direction would apply.

(ii) Reasonable opt out means. You

provide a reasonable means to exercise

an opt out right if you:

(A) Designate check-off boxes in a

prominent position on the relevant

forms with the opt out notice;

(B) Include a reply form together with

the opt out notice;

(C) Provide an electronic means to opt

out, such as a form that can be sent via

electronic mail or a process at your web

site, if the consumer agrees to the

electronic delivery of information; or

(D) Provide a toll-free telephone

number that consumers may call to opt

out.

(iii) Unreasonable opt out means. You

do not provide a reasonable means of

opting out if:

(A) The only means of opting out is

for the consumer to write his or her own

letter to exercise that opt out right; or

(B) The only means of opting out as

described in any notice subsequent to

the initial notice is to use a check-off

box that you provided with the initial

notice but did not include with the

subsequent notice.

(iv) Specific opt out means. You may

require each consumer to opt out

through a specific means, as long as that

means is reasonable for that consumer.

40368 Federal Register / Vol. 65, No. 126 / Thursday, June 29, 2000 / Rules and Regulations

(b) Same form as initial notice

permitted. You may provide the opt out

notice together with or on the same

written or electronic form as the initial

notice you provide in accordance with

§ 248.4.

(c) Initial notice required when opt

out notice delivered subsequent to

initial notice. If you provide the opt out

notice after the initial notice in

accordance with § 248.4, you must also

include a copy of the initial notice with

the opt out notice in writing or, if the

consumer agrees, electronically.

(d) Joint relationships. (1) If two or

more consumers jointly obtain a

financial product or service from you,

you may provide a single opt out notice.

Your opt out notice must explain how

you will treat an opt out direction by a

joint consumer.

(2) Any of the joint consumers may

exercise the right to opt out. You may

either:

(i) Treat an opt out direction by a joint

consumer as applying to all of the

associated joint consumers; or

(ii) Permit each joint consumer to opt

out separately.

(3) If you permit each joint consumer

to opt out separately, you must permit

one of the joint consumers to opt out on

behalf of all of the joint consumers.

(4) You may not require all joint

consumers to opt out before you

implement any opt out direction.

(5) Example. If John and Mary have a

joint brokerage account with you and

arrange for you to send statements to

John’s address, you may do any of the

following, but you must explain in your

opt out notice which opt out policy you

will follow:

(i) Send a single opt out notice to

John’s address, but you must accept an

opt out direction from either John or

Mary;

(ii) Treat an opt out direction by

either John or Mary as applying to the

entire account. If you do so, and John

opts out, you may not require Mary to

opt out as well before implementing

John’s opt out direction; or

(iii) Permit John and Mary to make

different opt out directions. If you do so:

(A) You must permit John and Mary

to opt out for each other.

(B) If both opt out, you must permit

both to notify you in a single response

(such as on a form or through a

telephone call).

(C) If John opts out and Mary does

not, you may only disclose nonpublic

personal information about Mary, but

not about John and not about John and

Mary jointly.

(e) Time to comply with opt out. You

must comply with a consumer’s opt out

direction as soon as reasonably

practicable after you receive it.

(f) Continuing right to opt out. A

consumer may exercise the right to opt

out at any time.

(g) Duration of consumer’s opt out

direction. (1) A consumer’s direction to

opt out under this section is effective

until the consumer revokes it in writing

or, if the consumer agrees,

electronically.

(2) When a customer relationship

terminates, the customer’s opt out

direction continues to apply to the

nonpublic personal information that

you collected during or related to that

relationship. If the individual

subsequently establishes a new

customer relationship with you, the opt

out direction that applied to the former

relationship does not apply to the new

relationship.

(h) Delivery. When you are required to

deliver an opt out notice by this section,

you must deliver it according to § 248.9.

§ 248.8 Revised privacy notices.

(a) General rule. Except as otherwise

authorized in this part, you must not,

directly or through any affiliate, disclose

any nonpublic personal information

about a consumer to a nonaffiliated

third party other than as described in

the initial notice that you provided to

that consumer under § 248.4, unless:

(1) You have provided to the

consumer a clear and conspicuous

revised notice that accurately describes

your policies and practices;

(2) You have provided to the

consumer a new opt out notice;

(3) You have given the consumer a

reasonable opportunity, before you

disclose the information to the

nonaffiliated third party, to opt out of

the disclosure; and

(4) The consumer does not opt out.

(b) Examples. (1) Except as otherwise

permitted by §§ 248.13, 248.14, and

248.15, you must provide a revised

notice before you:

(i) Disclose a new category of

nonpublic personal information to any

nonaffiliated third party;

(ii) Disclose nonpublic personal

information to a new category of

nonaffiliated third party; or

(iii) Disclose nonpublic personal

information about a former customer to

a nonaffiliated third party, if that former

customer has not had the opportunity to

exercise an opt out right regarding that

disclosure.

(2) A revised notice is not required if

you disclose nonpublic personal

information to a new nonaffiliated third

party that you adequately described in

your prior notice.

(c) Delivery. When you are required to

deliver a revised privacy notice by this

section, you must deliver it according to

§ 248.9.

§ 248.9 Delivering privacy and opt out

notices.

(a) How to provide notices. You must

provide any privacy notices and opt out

notices, including short-form initial

notices that this part requires so that

each consumer can reasonably be

expected to receive actual notice in

writing or, if the consumer agrees,

electronically.

(b)(1) Examples of reasonable

expectation of actual notice. You may

reasonably expect that a consumer will

receive actual notice if you:

(i) Hand-deliver a printed copy of the

notice to the consumer;

(ii) Mail a printed copy of the notice

to the last known address of the

consumer;

(iii) For the consumer who conducts

transactions electronically, post the

notice on the electronic site and require

the consumer to acknowledge receipt of

the notice as a necessary step to

obtaining a particular financial product

or service; or

(iv) For an isolated transaction with

the consumer, such as an ATM

transaction, post the notice on the ATM

screen and require the consumer to

acknowledge receipt of the notice as a

necessary step to obtaining the

particular financial product or service.

(2) Examples of unreasonable

expectation of actual notice. You may

not, however, reasonably expect that a

consumer will receive actual notice of

your privacy policies and practices if

you:

(i) Only post a sign in your branch or

office or generally publish

advertisements of your privacy policies

and practices; or

(ii) Send the notice via electronic mail

to a consumer who does not obtain a

financial product or service from you

electronically.

(c) Annual notices only. (1) You may

reasonably expect that a customer will

receive actual notice of your annual

privacy notice if:

(i) The customer uses your web site to

access financial products and services

electronically and agrees to receive

notices at the web site and you post

your current privacy notice

continuously in a clear and conspicuous

manner on the web site; or

(ii) The customer has requested that

you refrain from sending any

information regarding the customer

relationship, and your current privacy

notice remains available to the customer

upon request.

(2) Example of reasonable expectation

of receipt of annual privacy notice. You

Federal Register / Vol. 65, No. 126 / Thursday, June 29, 2000 / Rules and Regulations 40369

may reasonably expect that consumers

who share an address will receive actual

notice of your annual privacy notice if

you deliver the notice with or in a

stockholder or shareholder report under

the conditions in 17 CFR 270.30d–1(f)

or 17 CFR 270.30d–2(b), or with or in

a prospectus under the conditions in 17

CFR 230.154.

(d) Oral description of notice

insufficient. You may not provide any

notice required by this part solely by

orally explaining the notice, either in

person or over the telephone.

(e) Retention or accessibility of notices

for customers. (1) For customers only,

you must provide the initial notice

required by § 248.4(a)(1), the annual

notice required by § 248.5(a), and the

revised notice required by § 248.8, so

that the customer can retain them or

obtain them later in writing or, if the

customer agrees, electronically.

(2) Examples of retention or

accessibility. You provide a privacy

notice to the customer so that the

customer can retain it or obtain it later

if you:

(i) Hand-deliver a printed copy of the

notice to the customer;

(ii) Mail a printed copy of the notice

to the last known address of the

customer; or

(iii) Make your current privacy notice

available on a web site (or a link to

another web site) for the customer who

obtains a financial product or service

electronically and agrees to receive the

notice at the web site.

(f) Joint notice with other financial

institutions. You may provide a joint

notice from you and one or more of your

affiliates or other financial institutions,

as identified in the notice, as long as the

notice is accurate with respect to you

and the other institutions.

(g) Joint relationships. If two or more

consumers jointly obtain a financial

product or service from you, you may

satisfy the initial, annual, and revised

notice requirements of paragraph (a) of

this section by providing one notice to

those consumers jointly.

Subpart B—Limits on Disclosures

§ 248.10 Limits on disclosure of nonpublic

personal information to nonaffiliated third

parties.

(a)(1) Conditions for disclosure.

Except as otherwise authorized in this

part, you may not, directly or through

any affiliate, disclose any nonpublic

personal information about a consumer

to a nonaffiliated third party unless:

(i) You have provided to the

consumer an initial notice as required

under § 248.4;

(ii) You have provided to the

consumer an opt out notice as required

in § 248.7;

(iii) You have given the consumer a

reasonable opportunity, before you

disclose the information to the

nonaffiliated third party, to opt out of

the disclosure; and

(iv) The consumer does not opt out.

(2) Opt out definition. Opt out means

a direction by the consumer that you not

disclose nonpublic personal information

about that consumer to a nonaffiliated

third party, other than as permitted by

§§ 248.13, 248.14, and 248.15.

(3) Examples of reasonable

opportunity to opt out. You provide a

consumer with a reasonable opportunity

to opt out if:

(i) By mail. You mail the notices

required in paragraph (a)(1) of this

section to the consumer and allow the

consumer to opt out by mailing a form,

calling a toll-free telephone number, or

any other reasonable means within 30

days after the date you mailed the

notices.

(ii) By electronic means. A customer

opens an on-line account with you and

agrees to receive the notices required in

paragraph (a)(1) of this section

electronically, and you allow the

customer to opt out by any reasonable

means within 30 days after the date that

the customer acknowledges receipt of

the notices in conjunction with opening

the account.

(iii) Isolated transaction with

consumer. For an isolated transaction,

such as the provision of brokerage

services to a consumer as an

accommodation, you provide the

consumer with a reasonable opportunity

to opt out if you provide the notices

required in paragraph (a)(1) of this

section at the time of the transaction

and request that the consumer decide,

as a necessary part of the transaction,

whether to opt out before completing

the transaction.

(b) Application of opt out to all

consumers and all nonpublic personal

information. (1) You must comply with

this section, regardless of whether you

and the consumer have established a

customer relationship.

(2) Unless you comply with this

section, you may not, directly or

through any affiliate, disclose any

nonpublic personal information about a

consumer that you have collected,

regardless of whether you collected it

before or after receiving the direction to

opt out from the consumer.

(c) Partial opt out. You may allow a

consumer to select certain nonpublic

personal information or certain

nonaffiliated third parties with respect

to which the consumer wishes to opt

out.

§ 248.11 Limits on redisclosure and reuse

of information.

(a)(1) Information you receive under

an exception. If you receive nonpublic

personal information from a

nonaffiliated financial institution under

an exception in § 248.14 or 248.15, your

disclosure and use of that information is

limited as follows:

(i) You may disclose the information

to the affiliates of the financial

institution from which you received the

information;

(ii) You may disclose the information

to your affiliates, but your affiliates may,

in turn, disclose and use the

information only to the extent that you

may disclose and use the information;

and

(iii) You may disclose and use the

information pursuant to an exception in

§§ 248.14 or 248.15 in the ordinary

course of business to carry out the

activity covered by the exception under

which you received the information.

(2) Example. If you receive a customer

list from a nonaffiliated financial

institution in order to provide accountprocessing services under the exception

in §§ 248.14(a), you may disclose that

information under any exception in

§ 248.14 or 248.15 in the ordinary

course of business in order to provide

those services. You could also disclose

that information in response to a

properly authorized subpoena or in the

ordinary course of business to your

attorneys, accountants, and auditors.

You could not disclose that information

to a third party for marketing purposes

or use that information for your own

marketing purposes.

(b)(1) Information you receive outside

of an exception. If you receive

nonpublic personal information from a

nonaffiliated financial institution other

than under an exception in §§ 248.14 or

248.15, you may disclose the

information only:

(i) To the affiliates of the financial

institution from which you received the

information;

(ii) To your affiliates, but your

affiliates may, in turn, disclose the

information only to the extent that you

can disclose the information; and

(iii) To any other person, if the

disclosure would be lawful if made

directly to that person by the financial

institution from which you received the

information.

(2) Example. If you obtain a customer

list from a nonaffiliated financial

institution outside of the exceptions in

§§ 248.14 and 248.15:

40370 Federal Register / Vol. 65, No. 126 / Thursday, June 29, 2000 / Rules and Regulations

(i) You may use that list for your own

purposes;

(ii) You may disclose that list to

another nonaffiliated third party only if

the financial institution from which you

purchased the list could have lawfully

disclosed the list to that third party.

That is, you may disclose the list in

accordance with the privacy policy of

the financial institution from which you

received the list, as limited by the opt

out direction of each consumer whose

nonpublic personal information you

intend to disclose, and you may disclose

the list in accordance with an exception

in §§ 248.14 or 248.15, such as in the

ordinary course of business to your

attorneys, accountants, or auditors.

(c) Information you disclose under an

exception. If you disclose nonpublic

personal information to a nonaffiliated

third party under an exception in

§§ 248.14 or 248.15, the third party may

disclose and use that information only

as follows:

(1) The third party may disclose the

information to your affiliates;

(2) The third party may disclose the

information to its affiliates, but its

affiliates may, in turn, disclose and use

the information only to the extent that

the third party may disclose and use the

information; and

(3) The third party may disclose and

use the information pursuant to an

exception in §§ 248.14 or 248.15 in the

ordinary course of business to carry out

the activity covered by the exception

under which it received the

information.

(d) Information you disclose outside

of an exception. If you disclose

nonpublic personal information to a

nonaffiliated third party other than

under an exception in §§ 248.14 or

248.15, the third party may disclose the

information only:

(1) To your affiliates;

(2) To its affiliates, but its affiliates, in

turn, may disclose the information only

to the extent the third party can disclose

the information; and

(3) To any other person, if the

disclosure would be lawful if you made

it directly to that person.

§ 248.12 Limits on sharing account

number information for marketing

purposes.

(a) General prohibition on disclosure

of account numbers. You must not,

directly or through an affiliate, disclose,

other than to a consumer reporting

agency, an account number or similar

form of access number or access code

for a consumer’s credit card account,

deposit account, or transaction account

to any nonaffiliated third party for use

in telemarketing, direct mail marketing,

or other marketing through electronic

mail to the consumer.

(b) Exceptions. Paragraph (a) of this

section does not apply if you disclose an

account number or similar form of

access number or access code:

(1) To your agent or service provider

solely in order to perform marketing for

your own products or services, as long

as the agent or service provider is not

authorized to directly initiate charges to

the account; or

(2) To a participant in a private label

credit card program or an affinity or

similar program where the participants

in the program are identified to the

customer when the customer enters into

the program.

(c) Example—Account number. An

account number, or similar form of

access number or access code, does not

include a number or code in an

encrypted form, as long as you do not

provide the recipient with a means to

decode the number or code.

Subpart C—Exceptions

§ 248.13 Exception to opt out

requirements for service providers and joint

marketing.

(a) General rule. (1) The opt out

requirements in §§ 248.7 and 248.10 do

not apply when you provide nonpublic

personal information to a nonaffiliated

third party to perform services for you

or functions on your behalf, if you:

(i) Provide the initial notice in

accordance with § 248.4; and

(ii) Enter into a contractual agreement

with the third party that prohibits the

third party from disclosing or using the

information other than to carry out the

purposes for which you disclosed the

information, including use under an

exception in §§ 248.14 or 248.15 in the

ordinary course of business to carry out

those purposes.

(2) Example. If you disclose

nonpublic personal information under

this section to a financial institution

with which you perform joint

marketing, your contractual agreement

with that institution meets the

requirements of paragraph (a)(1)(ii) of

this section if it prohibits the institution

from disclosing or using the nonpublic

personal information except as

necessary to carry out the joint

marketing or under an exception in

§§ 248.14 or 248.15 in the ordinary

course of business to carry out that joint

marketing.

(b) Service may include joint

marketing. The services a nonaffiliated

third party performs for you under

paragraph (a) of this section may

include marketing of your own products

or services or marketing of financial

products or services offered pursuant to

joint agreements between you and one

or more financial institutions.

(c) Definition of joint agreement. For

purposes of this section, joint agreement

means a written contract pursuant to

which you and one or more financial

institutions jointly offer, endorse, or

sponsor a financial product or service.

§ 248.14 Exceptions to notice and opt out

requirements for processing and servicing

transactions.

(a) Exceptions for processing and

servicing transactions at consumer’s

request. The requirements for initial

notice in § 248.4(a)(2), for the opt out in

§§ 248.7 and 248.10, and for initial

notice in § 248.13 in connection with

service providers and joint marketing,

do not apply if you disclose nonpublic

personal information as necessary to

effect, administer, or enforce a

transaction that a consumer requests or

authorizes, or in connection with:

(1) Processing or servicing a financial

product or service that a consumer

requests or authorizes;

(2) Maintaining or servicing the

consumer’s account with you, or with

another entity as part of a private label

credit card program or other extension

of credit on behalf of such entity; or

(3) A proposed or actual

securitization, secondary market sale

(including sales of servicing rights), or

similar transaction related to a

transaction of the consumer.

(b) Necessary to effect, administer, or

enforce a transaction means that the

disclosure is:

(1) Required, or is one of the lawful

or appropriate methods, to enforce your

rights or the rights of other persons

engaged in carrying out the financial

transaction or providing the product or

service; or

(2) Required, or is a usual,

appropriate, or acceptable method:

(i) To carry out the transaction or the

product or service business of which the

transaction is a part, and record, service,

or maintain the consumer’s account in

the ordinary course of providing the

financial service or financial product;

(ii) To administer or service benefits

or claims relating to the transaction or

the product or service business of which

it is a part;

(iii) To provide a confirmation,

statement, or other record of the

transaction, or information on the status

or value of the financial service or

financial product to the consumer or the

consumer’s agent or broker;

(iv) To accrue or recognize incentives

or bonuses associated with the

transaction that are provided by you or

any other party;

Federal Register / Vol. 65, No. 126 / Thursday, June 29, 2000 / Rules and Regulations 40371

(v) To underwrite insurance at the

consumer’s request or for reinsurance

purposes, or for any of the following

purposes as they relate to a consumer’s

insurance: Account administration,

reporting, investigating, or preventing

fraud or material misrepresentation,

processing premium payments,

processing insurance claims,

administering insurance benefits

(including utilization review activities),

participating in research projects, or as

otherwise required or specifically

permitted by federal or State law; or

(vi) In connection with:

(A) The authorization, settlement,

billing, processing, clearing,

transferring, reconciling or collection of

amounts charged, debited, or otherwise

paid using a debit, credit, or other

payment card, check, or account

number, or by other payment means;

(B) The transfer of receivables,

accounts, or interests therein; or

(C) The audit of debit, credit, or other

payment information.

§ 248.15 Other exceptions to notice and

opt out requirements.

(a) Exceptions to notice and opt out

requirements. The requirements for

initial notice in § 248.4(a)(2), for the opt

out in §§ 248.7 and 248.10, and for

initial notice in § 248.13 in connection

with service providers and joint

marketing do not apply when you

disclose nonpublic personal

information:

(1) With the consent or at the

direction of the consumer, provided that

the consumer has not revoked the

consent or direction;

(2)(i) To protect the confidentiality or

security of your records pertaining to

the consumer, service, product, or

transaction;

(ii) To protect against or prevent

actual or potential fraud, unauthorized

transactions, claims, or other liability;

(iii) For required institutional risk

control or for resolving consumer

disputes or inquiries;

(iv) To persons holding a legal or

beneficial interest relating to the

consumer; or

(v) To persons acting in a fiduciary or

representative capacity on behalf of the

consumer;

(3) To provide information to

insurance rate advisory organizations,

guaranty funds or agencies, agencies

that are rating you, persons that are

assessing your compliance with

industry standards, and your attorneys,

accountants, and auditors;

(4) To the extent specifically

permitted or required under other

provisions of law and in accordance

with the Right to Financial Privacy Act

of 1978 (12 U.S.C. 3401 et seq.), to law

enforcement agencies (including a

federal functional regulator, the

Secretary of the Treasury, with respect

to 31 U.S.C. Chapter 53, Subchapter II

(Records and Reports on Monetary

Instruments and Transactions) and 12

U.S.C. Chapter 21 (Financial

Recordkeeping), a State insurance

authority, with respect to any person

domiciled in that insurance authority’s

State that is engaged in providing

insurance, and the Federal Trade

Commission), self-regulatory

organizations, or for an investigation on

a matter related to public safety;

(5)(i) To a consumer reporting agency

in accordance with the Fair Credit

Reporting Act (15 U.S.C. 1681 et seq.),

or

(ii) From a consumer report reported

by a consumer reporting agency;

(6) In connection with a proposed or

actual sale, merger, transfer, or exchange

of all or a portion of a business or

operating unit if the disclosure of

nonpublic personal information

concerns solely consumers of such

business or unit; or

(7)(i) To comply with federal, State, or

local laws, rules and other applicable

legal requirements;

(ii) To comply with a properly

authorized civil, criminal, or regulatory

investigation, or subpoena or summons

by federal, State, or local authorities; or

(iii) To respond to judicial process or

government regulatory authorities

having jurisdiction over you for

examination, compliance, or other

purposes as authorized by law.

(b) Examples of consent and

revocation of consent. (1) A consumer

may specifically consent to your

disclosure to a nonaffiliated mortgage

lender of the value of the assets in the

consumer’s brokerage or investment

advisory account so that the lender can

evaluate the consumer’s application for

a mortgage loan.

(2) A consumer may revoke consent

by subsequently exercising the right to

opt out of future disclosures of

nonpublic personal information as

permitted under § 248.7(f).

Subpart D—Relation to Other Laws;

Effective Date

§ 248.16 Protection of Fair Credit

Reporting Act.

Nothing in this part shall be

construed to modify, limit, or supersede

the operation of the Fair Credit

Reporting Act (15 U.S.C. 1681 et seq.),

and no inference shall be drawn on the

basis of the provisions of this part

regarding whether information is

transaction or experience information

under section 603 of that Act.

§ 248.17 Relation to State laws.

(a) In general. This part shall not be

construed as superseding, altering, or

affecting any statute, regulation, order,

or interpretation in effect in any State,

except to the extent that such State

statute, regulation, order, or

interpretation is inconsistent with the

provisions of this part, and then only to

the extent of the inconsistency.

(b) Greater protection under State law.

For purposes of this section, a State

statute, regulation, order, or

interpretation is not inconsistent with

the provisions of this part if the

protection such statute, regulation,

order, or interpretation affords any

consumer is greater than the protection

provided under this part, as determined

by the Federal Trade Commission, after

consultation with the Commission, on

the Federal Trade Commission’s own

motion, or upon the petition of any

interested party.

§ 248.18 Effective date; transition rule.

(a) Effective date. This part is effective

November 13, 2000. In order to provide

sufficient time for you to establish

policies and systems to comply with the

requirements of this part, the

compliance date for this part is July 1,

2001.

(b)(1) Notice requirement for

consumers who are your customers on

the compliance date. By July 1, 2001,

you must have provided an initial

notice, as required by § 248.4, to

consumers who are your customers on

July 1, 2001.

(2) Example. You provide an initial

notice to consumers who are your

customers on July 1, 2001, if, by that

date, you have established a system for

providing an initial notice to all new

customers and have mailed the initial

notice to all your existing customers.

(c) Two-year grandfathering of service

agreements. Until July 1, 2002, a

contract that you have entered into with

a nonaffiliated third party to perform

services for you or functions on your

behalf satisfies the provisions of

§ 248.13(a)(2), even if the contract does

not include a requirement that the third

party maintain the confidentiality of

nonpublic personal information, as long

as you entered into the agreement on or

before July 1, 2000.

§§ 248.19–248.29 [Reserved]

§ 248.30 Procedures to safeguard

customer records and information.

Every broker, dealer, and investment

company, and every investment adviser

registered with the Commission must

adopt policies and procedures that

address administrative, technical, and

40372 Federal Register / Vol. 65, No. 126 / Thursday, June 29, 2000 / Rules and Regulations

physical safeguards for the protection of

customer records and information.

These policies and procedures must be

reasonably designed to:

(a) Insure the security and

confidentiality of customer records and

information;

(b) Protect against any anticipated

threats or hazards to the security or

integrity of customer records and

information; and

(c) Protect against unauthorized

access to or use of customer records or

information that could result in

substantial harm or inconvenience to

any customer.

Appendix A to Part 248—Sample

Clauses

Financial institutions, including a group of

financial holding company affiliates that use

a common privacy notice, may use the

following sample clauses, if the clause is

accurate for each institution that uses the

notice. (Note that disclosure of certain

information, such as assets, income, and

information from a consumer reporting

agency, may give rise to obligations under the

Fair Credit Reporting Act, such as a

requirement to permit a consumer to opt out

of disclosures to affiliates or designation as

a consumer reporting agency if disclosures

are made to nonaffiliated third parties.)

A–1—Categories of Information You Collect

(All Institutions)

You may use this clause, as applicable, to

meet the requirement of § 248.6(a)(1) to

describe the categories of nonpublic personal

information you collect.

Sample Clause A–1:

We collect nonpublic personal information

about you from the following sources:

• Information we receive from you on

applications or other forms;

• Information about your transactions with

us, our affiliates, or others; and

• Information we receive from a consumer

reporting agency.

A–2—Categories of Information You Disclose

(Institutions That Disclose Outside of the

Exceptions)

You may use one of these clauses, as

applicable, to meet the requirement of

§ 248.6(a)(2) to describe the categories of

nonpublic personal information you disclose.

You may use these clauses if you disclose

nonpublic personal information other than as

permitted by the exceptions in §§ 248.13,

248.14, and 248.15.

Sample Clause A–2, Alternative 1:

We may disclose the following kinds of

nonpublic personal information about you:

• Information we receive from you on

applications or other forms, such as [provide

illustrative examples, such as ‘‘your name,

address, social security number, assets, and

income’’];

• Information about your transactions with

us, our affiliates, or others, such as [provide

illustrative examples, such as ‘‘your account

balance, payment history, parties to

transactions, and credit card usage’’]; and

• Information we receive from a consumer

reporting agency, such as [provide illustrative

examples, such as ‘‘your creditworthiness

and credit history’’].

Sample Clause A–2, Alternative 2:

We may disclose all of the information that

we collect, as described [describe location in

the notice, such as ‘‘above’’ or ‘‘below’’].

A–3—Categories of Information You Disclose

and Parties to Whom You Disclose

(Institutions That Do Not Disclose Outside of

the Exceptions)

You may use this clause, as applicable, to

meet the requirements of §§ 248.6(a)(2), (3),

and (4) to describe the categories of

nonpublic personal information about

customers and former customers that you

disclose and the categories of affiliates and

nonaffiliated third parties to whom you

disclose. You may use this clause if you do

not disclose nonpublic personal information

to any party, other than as permitted by the

exceptions in §§ 248.14 and 248.15.

Sample Clause A–3:

We do not disclose any nonpublic personal

information about our customers or former

customers to anyone, except as permitted by

law.

A–4—Categories of Parties to Whom You

Disclose (Institutions That Disclose Outside

of the Exceptions)

You may use this clause, as applicable, to

meet the requirement of § 248.6(a)(3) to

describe the categories of affiliates and

nonaffiliated third parties to whom you

disclose nonpublic personal information.

You may use this clause if you disclose

nonpublic personal information other than as

permitted by the exceptions in §§ 248.13,

248.14, and 248.15, as well as when

permitted by the exceptions in §§ 248.14 and

248.15.

Sample Clause A–4:

We may disclose nonpublic personal

information about you to the following types

of third parties:

• Financial service providers, such as

[provide illustrative examples, such as

‘‘mortgage bankers, securities broker-dealers,

and insurance agents’’];

• Non-financial companies, such as

[provide illustrative examples, such as

‘‘retailers, direct marketers, airlines, and

publishers’’]; and

• Others, such as [provide illustrative

examples, such as ‘‘non-profit

organizations’’].

We may also disclose nonpublic personal

information about you to nonaffiliated third

parties as permitted by law.

A–5—Service Provider/Joint Marketing

Exception

You may use one of these clauses, as

applicable, to meet the requirements of

§ 248.6(a)(5) related to the exception for

service providers and joint marketers in

§ 248.13. If you disclose nonpublic personal

information under this exception, you must

describe the categories of nonpublic personal

information you disclose and the categories

of third parties with whom you have

contracted.

Sample Clause A–5, Alternative 1:

We may disclose the following information

to companies that perform marketing services

on our behalf or to other financial

institutions with which we have joint

marketing agreements:

• Information we receive from you on

applications or other forms, such as [provide

illustrative examples, such as ‘‘your name,

address, social security number, assets, and

income’’];

• Information about your transactions with

us, our affiliates, or others, such as [provide

illustrative examples, such as ‘‘your account

balance, payment history, parties to

transactions, and credit card usage’’]; and

• Information we receive from a consumer

reporting agency, such as [provide illustrative

examples, such as ‘‘your creditworthiness

and credit history’’].

Sample Clause A–5, Alternative 2:

We may disclose all of the information we

collect, as described [describe location in the

notice, such as ‘‘above’’ or ‘‘below’’] to

companies that perform marketing services

on our behalf or to other financial

institutions with whom we have joint

marketing agreements.

A–6—Explanation of Opt Out Right

(Institutions That Disclose Outside of the

Exceptions)

You may use this clause, as applicable, to

meet the requirement of § 248.6(a)(6) to

provide an explanation of the consumer’s

right to opt out of the disclosure of nonpublic

personal information to nonaffiliated third

parties, including the method(s) by which the

consumer may exercise that right. You may

use this clause if you disclose nonpublic

personal information other than as permitted

by the exceptions in §§ 248.13, 248.14, and

248.15.

Sample Clause A–6:

If you prefer that we not disclose

nonpublic personal information about you to

nonaffiliated third parties, you may opt out

of those disclosures, that is, you may direct

us not to make those disclosures (other than

disclosures permitted by law). If you wish to

opt out of disclosures to nonaffiliated third

parties, you may [describe a reasonable

means of opting out, such as ‘‘call the

following toll-free number: (insert number)’’].

A–7—Confidentiality and Security (All

Institutions)

You may use this clause, as applicable, to

meet the requirement of § 248.6(a)(8) to

describe your policies and practices with

respect to protecting the confidentiality and

security of nonpublic personal information.

Sample Clause A–7:

We restrict access to nonpublic personal

information about you to [provide an

appropriate description, such as ‘‘those

employees who need to know that

information to provide products or services to

you’’]. We maintain physical, electronic, and

procedural safeguards that comply with

federal standards to guard your nonpublic

personal information.

By the Commission.

Federal Register / Vol. 65, No. 126 / Thursday, June 29, 2000 / Rules and Regulations 40373

Dated: June 22, 2000.

Margaret H. McFarland,

Deputy Secretary.

[FR Doc. 00–16269 Filed 6–28–00; 8:45 am]

BILLING CODE 8010–01–P