Office of the Comptroller of the Currency 

250 E Street, S.W. 

Mail Stop 1-5 

Washington, DC 20219 

Re: Docket ID OCC-2007-0003 

Mr. Robert E. Feldman 

Executive Secretary 

·Attention: Comments 

Federal Deposit Insurance Corporation 

550 17th Street, N.W. 

Washington, DC 20429 

Re: RIN 3064-AD16 

Ms. Mary Rupp 

Secretary ofthe Board 

National Credit Union Administration 

1775 Duke Street 

Alexandria, Virginia 22314-3428 

Re: RIN 3133-AC84 

Ms. Nancy M. Morris 

Secretary 

Securities and Exchange Commission 

100 F Street, N.E. 

Washington, DC 20549-1090 

Re: File Number S7 -09-07. Model Privacy 

Form 

COMMENT . ' 

i F . .- "' 1:-!VC'fl •. :. - ,_ ' L .J .. . \. . . ~ . . -.. 

Ms. Jennifer Johnson ' ,_., .. ~ ?.C At1 12: I 1. 

Secretary 

Board of Governors of~e;f~~er~l ~~s~<r:T r 

System 

20th Street and Constitution Avenue, N.W. 

Washington, DC 20551 

Re: Docket No. R-1280 

Regulation Comments 

Chief Counsel's Office 

Office ofThrift Supervision 

1700 G Street, N.W. 

Washington, DC 20552 

Attention: OTS-2007-005 

Re: Docket ID OTS-2007-0005 

Federal Trade Commission 

Office of the Secretary 

Room 135 (Annex C) 

600 Pennsylvania Avenue, N.W. 

Washington, DC 20585 

Re: Model Privacy Form. FTC File No. 

P034815 

Ms. Eileen Donovan 

Acting Secretary of the Commission 

Conunodity Futures Trading Conunission 

Three Lafayette Centre 

1155 21st Street, N.W. 

Washington, DC 20581 

Re: RIN 3038-AC04 

RE: Interagency Proposal for Model Privacy Form; 72 Federal Register 14940, March 

29,2007 

Dear Sir or Madam: 

This comment letter is submitted on behalf of the Consumer Bankers Association 

("CBA") in response to the Interagency Proposal for Model Privacy Form Under the GrammLeach-Bliley Act ("Proposal") issued by the Office of the Comptroller of the Currency, Office of 

Thrift Supervision, Board of Governors of the Federal Reserve ("FRB"), Federal Deposit 
Insurance Corporation, National Credit Union Administration, Federal Trade Commission, 

Commodity Futures Trading Commission, and Securities and Exchange Commission ("SEC") 

(collectively, the "Agencies"). The CBA is the recognized voice on retail banking issues in the 

nation's capital. Member institutions are the leaders in consumer, auto, home equity and 

education finance, electronic retail delivery systems, privacy, fair lending, bank sales of 

investment products, small business services and community development. The CBA was 

founded in 1919 to provide a progressive voice in the retail banking industry. The CBA 

represents over 750 federally insured financial institutions that collectively hold more than 70% 

of all consumer credit held by federally-insured depository institutions in the United States. 

CBA appreciates the opportunity to provide our comments to the Agencies. 

Executive Summary 

CBA strongly supports the Agencies' efforts to develop a standardized Gramm-LeachBliley Act ("GLBA") privacy policy that is relatively easy for conswners to read and understand. 

We share the Agencies' goal of providing financial institutions with a model form that provides a 

safe harbor for certain requirements under the regulations issued by the Agencies implementing 

Title V, Subtitle A of the GLBA ("GLBA Regulations") and that is widely adopted by financial 

institutions. Because use of the model form developed by the Agencies ("Model") is, by statute, 

voluntary, it is critically important that the Model be attractive to financial institutions. If the 

model form does not present an attractive, or even a viable, option to financial institutions, the 

clear intent of the Agencies and of Congress-to provide a widely adopted approach to GLBA 

privacy policies-will not be achieved. Unfortunately, CBA believes that the Model does not 

provide a viable option to many fmancial institutions. We believe significant changes should be 

made to the Model in order to improve the likelihood of its use. In fact, we urge the Agencies to 

consider the comments they receive in response to the Proposal and to issue a revised proposal 

for further comment based on those comments and on additional consumer testing. 

As we discuss in more detail below, our concerns with the Proposal revolve around two 

general themes: the difficulties associated with delivering the Model and the inability to modify 

it for any reason without losing the safe harbor. For example, the Model will be extremely 

expensive to print and mail, and may not lend itselfto existing delivery methods used by 

financial institutions. CBA is also concerned that a financial institution cannot modify the 

Model, despite the fact that the Model does not reflect information practices employed by 

significantly large numbers of financial institutions, especially as those practices relate to 

affiliate sharing. 

Regardless of the changes made to the Model by the Agencies before finalization we ask 

the Agencies to provide fmancial institutions with a safe harbor as it pertains to the GLBA 

privacy requirements. In particular, if a financial institution uses the format and text provided, or 

something substantively similar in content, form, and format, such financial institution should be 

deemed compliant with the GLBA disclosure requirements. Furthermore, once the Agencies 

finalize the text of the Model, CBA strongly urges the Agencies to provide a safe harbor for 

financial institutions that rely on that text while providing them the flexibility to engage in any of 

the activities permitted and envisioned under the GLBA. 

2 5129/2007 
In General 

CBA believes, as we state above, that the Agencies should make significant 

modifications to the Model and repropose it for additional public comment. We believe this is 

appropriate because it is our opinion that the changes necessary to the Model are of the \ 

magnitude as to require an almost entirely new format and text. Specifically, we believe the 

Agencies should develop a Model that is a single page in length with modifications to the 

existing textual requirements. We firmly believe this is a realistic objective, and one that can 

result in a Model that is widely used by financial institutions and that provides consumers with 

the required information in a consumer friendly manner. 

We recognize that the Agencies have spent significant time and effort researching 

alternatives to the existing GLBA privacy notices. These efforts have included symposia, 

consumer surveys, and requests for public comment. CBA commends the Agencies for their 

.diligence and good faith in pursuing a worthwhile goal. It appears to us, however, that in 

connection with their efforts to craft the Proposal, the Agencies are relying almost exclusively on 

consumer testing which CBA believes is incomplete in its approach. In addition to considering 

comments received on the Proposal, the Agencies should engage in additional consumer testing 

of versions of the Model that reflect the realities that will coincide with their use by financial 

institutions. For example, we believe that the Agencies should test a design that is a page in 

length to determine whether it is possible to provide GLBA privacy notices that meet the · 

statutory requirements in a manner that is reasonably likely to be employed by fmancial 

institutions and that communicate effectively to consumers. In short, the question is. not whether 

consumers prefer a three-page GLBA privacy notice, because it is a moot issue if significant 

numbers of financial institutions choose not to provide such a notice. A better question is 

whether a notice that is likely to be used voluntarily by a critical number of financial institutions 

can provide GLBA privacy disclosures in a manner that is more standardized and consumer 

friendly than the status quo. To our knowledge, the Agencies have not tested such a concept. 

CBA strongly urges them to do so. 

Delivery of Model as Proposed 

According to the Proposal, the Model must be at least two pages in length, no matter how 

simple the financial institution's privacy policy. Furthermore, a financial institution must add a 

third page if it provides any type of opt-out choice to the consumer. The Model must be printed 

on one side of 8.5" x 11" paper, and must be presented in a manner that allows the consumer to 

view the first and second pages simultaneously. These requirements will result in enormous 

additional costs on financial institutions. For example, two of our larger (but not largest) 

members estimate that use of the Model would cost an additional $3 million and $6 million a 

year, respectively. One of our largest members believes the incremental cost to use the Model 

among all of its affiliates would be approximately $30 million. If the additional annual cost 

associated with the Model for only three large banks is almost $40 million, it is reasonable to 

assume that the financial services industry as a whole would shoulder extraordinary incremental 

compliance costs each year if the Model were widely adopted. 

Cost of Printing 

3 5/29/2007 
The Agencies have proposed a Model that, if used, would significantly and directly 

increase printing costs for financial institutions. Based on discussions with our members, we 

believe that the Model, if widely adopted, would result in large numbers of financial institutions 

using at least one, if not two, additional pages to deliver GLBA privacy policies than are 

currently used today. This means that a single large institution would need to order truckloads of 

additional paper if it were to use the Model. It may be a worthwhile exercise for the Agencies to 

estimate how many paper GLBA privacy policies are provided by all financial institutions in a 

year and, using that estimate, further estimate how many additional sheets of paper would be 

bought in just one year if a majority of privacy policies complied with the Model. Regardless of 

the numbers used, it is certain that the paper costs associated with widespread use of the Model 

would be significant. 

Cost of Postage 

Not only would the Model result in significant increased paper usage, but it would also 

significantly increase the amount of money spent on postage to deliver GLBA policies. This is 

true because the additional paper used relative to existing practices will result in heavier mailings 

to consumers. For example, a financial institution that can include a single-page insert in a 

periodic statement sent to the consumer could incur additional postage as a result of inserting an 

additional two pages in the same envelope. As we discuss below, many financial institutions 

would have to mail the Model as a separate mailing which would further increase postage costs. 

This would be approximately 30 cents per piece for standard mail or 40 cents per piece for first 

class. In fact, we believe the increased postage alone will cost financial institutions tens of 

millions of dollars a year if the Model were widely adopted. 

Inability to Integrate Model into Existing Delivery Methods 

In addition to the direct costs associated with printing and mailing privacy policies that 

are at least one, if not two, additional pages, the Model would impose other costs that are more 

difficult to quantify. In particular, many financial institutions would have difficulty delivering 

the Model as an initial privacy policy and/or as an annual privacy policy using their existing 

delivery mechanisms. 

The GLBA Regulations require, in many circumstances, a financial institution to provide 

customers the initial GLBA privacy policy no later than at the time the customer relationship is 

established. There are of course many ways this requirement can be met, but many financial 

institutions that open credit accounts at the point of sale, for example, have implemented 

procedures to provide GLBA privacy notices at the cash register. For example, if a consumer 

applies to open a private label or co-brand credit card while transacting with a retailer, the 

consumer may receive the GLBA privacy policy as part of the application materials. Financial 

institutions have developed compliance programs, for example, by integrating the privacy policy 

into the other required disclosures and materials provided to the consumer. In fact, some 

financial institutions have developed disclosures that comply with the law in the form of a single 

brochure that includes a tear-off application for point-of-sale credit applications. Simplicity of 

delivery is critical in light ofthe fact that it is not practical to train store clerks on the finer points 

4 5/29/2007 
of regulatory compliance requirements. If the Model must be three pages, and the pages must 

not have any other information on them, it is not clear to us how a financial institution could 

provide failsafe "take one"-style applications (or any other application styles, for that matter) in a 

retail environment without redesigning significant portions of the marketing and compliance 

components of the card program. Even in a retail bank branch, additional compliance testing 

would be required to ensure delivery of the most current version of a multi-page notice to all 

consumers who should receive such a notice. 

In addition to the difficulties some financial institutions may have in delivering privacy 

policies at the point of sale, financial institutions may have problems mailing the Model, either 

as an initial or an annual privacy policy. Although some financial institutions may regularly 

correspond with consumers using envelopes that can reasonably accommodate 8.5" x 11" paper,· 

many do not. For example, credit card issuers generally do not send billing statements in 

envelopes that could easily accommodate 8.5" x 11" paper. Those issuers that use billing 

statements to deliver annual privacy policies would need to reconfigure their compliance 

programs, either 'by changing envelopes or mailing the annual notice as a stand alone document 

in a larger envelope. Both options have significant cost implications. 

Consideration of a Single-Page Model 

We believe that many of the issues we discuss above could be mitigated if the Agencies 

designed a Model that were no more than a page in length, could be incorporated into other 

documents (i.e., could have additional information included on it), and need not be printed on 

8.5" x 11" paper. CBA believes if some of the formatting conventions in the Model were 

abandoned (e.g., elimination ofunnecessarily unused space in the Model) and if some ofthe 

disclosures were simplified, eliminated, or made optional (as we discuss below), it would not be 

difficult to create a single-page Model that effectively conveys a financial institution's GLBA 

privacy policy to consumers. 

Lack of Guidance for Electronic Delivery 

The Agencies have not provided any guidance to financial institutions with respect to the 

electronic delivery ofthe Model, other than to note that the posting of a PDF version ofthe 

Model on the financial institution's web site would qualify for the safe harbor in terms of 

delivering a clear and conspicuous policy to consumers. We ask that agencies acknowledge 

alternative electronic delivery mechanism and provide a safe harbor. We ask the Agencies to 

describe how the safe harbor will apply in connection with the use of the Model in a variety of 

electronic environments (e.g., e-mail text, web site HTML text, etc.). This is particularly 

important for delivering notices when accounts are opened through an Internet web site. 

Revisions to Model, Either by Agencies and/or by Financial Institutions 

The Agencies have made clear throughout the Proposal that a financial institution may 

alter the Model in only a few minor places or risk losing the safe harbor. If the changes financial 

institutions would need to make to the Model were only a few cosmetic tweaks, the lack of 

flexibility granted by the Agencies to financial institutions would not necessarily be an issue. 

5 5/29/2007 
However, the Model as drafted in many respects simply does not reflect financial institutions' 

information practices, nor does it accurately reflect the scope of consumers' rights under federal 

law. Many financial institutions would have to make fundamental changes to the information in 

the Model to describe their practices accurately. The materiality of such changes could make it 

difficult for financial institutions to evaluate whether the Agencies would deem the resulting 

GLBA privacy policy to be compliant.' 

General Accuracy 

The Model provides an inaccurate description of many financial institutions' information 

practices. Not only does the required text fall short of describing information practices 

accurately, the text also misstates (or simply creates) consumers' rights under applicable federal 

law. A financial- institution must be granted the flexibility to tailor the Model to describe its 

practices and to reflect only those rights granted to consumers.

2 While it may not be necessary to 

include text that is unquestionably precise with respect to information practices, the Model 

should not be patently incorrect with respect to how a financial institution handles information. 

Having said this, we agree with the Agencies' observation that the "laws governing the 

disclosure of consumers' personal information are not easily translated into short, 

comprehensible phrases that are also legally precise." For example, it would not be practical to 

list all ofthe reasons that could be included as an "everyday business purpose" or all of the 

sources of information collected. Like the existing sample clauses in the GLBA Regulations 

("Sample Clauses"), portions of the Model include concise language that gives consumers an 

accurate impression of the types of practices engaged in by a financial institution. We urge the 

Agencies to retain the existing approach in the Model with respect to those practices that can be 

described with generality. 

Safe Harbor 

We provide specific examples below of how the text in the Model could be improved 

(either by the Agencies or financial institutions themselves if granted the flexibility). Regardless 

of whether our suggestions are adopted, it is critical that the Agencies expressly state in a final 

rule that financial institutions that use the text (or something substantially similar) provided by 

the Agencies will have the flexibility to engage in any information practices permitted under the 

GLBA and the Fair Credit Reporting Act ("FCRA"), including those permitted by notice and opt 

out and for "everyday business purposes" (such as through obtaining consumer consent). If the 

Agencies do not provide such a safe harbor, and the final Model does not include legally precise 

1 Normally we would fmd it difficult to believe that the Agencies would take an enforcement action against a 

financial institution that provides an accurate, clear, and conspicuous privacy policy to conswners, regardless of its 

resemblance to the Model. The Agencies' unusual attention to detail in describing exactly how the Form should 

look (e.g., discussions of x-heights and sans serif fonts appear to be overly prescriptive) and the Agencies' unusually 

strong emphasis on the rigidity of the format and content of the Model, however, calls into question whether any 

significant deviations from the Model will be viewed by the Agencies as evidence of noncompliance with the 

applicable requirements of the GLBA Regulations. 2 We assume the Agencies did not intend to use the Model as a mechanism to modify fmancial institutions' 

information practices by limiting those practices to what is described on the Model. If we are incorrect in this 

assumption, we respectfully request the Agencies to make their intentions in this regard clear. 

6 5/29/2007 
language, financial institutions may not believe that the Model provides acceptable protection 

from lii:tbility, whether through federal, state, or private enforcement.3 A clear, unambiguous 

statement by the Agencies is necessary not only to give comfort to fmancial institutions using the 

Model for federal enforcement purposes, but also to assist state attorneys general and judges in 

determining whether liability is warranted under state unfair/deceptive theories of law against 

financial institutions using the Model in the manner intended by the Agencies. 

This safe harbor should be similar in concept to the safe harbor provided in the Truth and 

Lending Act and Regulation Z for use of forms that are similar in substance, clarity and 

meaningful sequence to the model fonns provided by the Federal Reserve Board. We believe 

that this approach combining uniformity and flexibility would be most helpful. 

Description of Information Practices: For Our Marketing Purposes 

Section _.13 of the GLBA Regulations permits a financial institution to disclose NPI to 

nonaffiliated third parties that perform services on behalfofthe financial institution. The 

privacy policy disclosure provided under§ _.13 usually, but not always, relates to a disclosure 

ofNPI to a third party service provider performing marketing services on behalf of the financial 

institution. It is not uncommon, however, for a financial institution to use a service provider 

described in a § _.13 disclosure for reasons other than its own marketing purposes. 

On page 1 ofthe Model, there is a statement pertaining to a financial institution's ability 

to disclose NPI to third parties "[f]or our marketing purposes-to offer our products and services 

to you." The Agencies state that this statement "includes service providers contemplated by 

section L.13] of' the GLBA Regulations. We ask the Agencies to modify the form so that the 

statement can be more reflective ofthe breadth of disclosures permitted under§ _.13. We also 

ask the Agencies for a more explicit statement indicating that, regardless of any change made to 

the Model, a financial institution that uses the text provided by the Agencies will have met its 

obligation to provide the disclosure required under§ _.13, even ifthe disclosure ofNPI is for 

reasons other than those listed in the Model (but still permitted under § _.13). 

Description of Information Practices: Affiliate Sharing 

CBA believes that the Model's descriptions of affiliate sharing do not accurately describe' 

significant portions of affiliate sharing in which financial institutions engage. For example, two 

of the three boxes in the chart on page 1 suggest that a financial institution shares NPI with its 

affiliates "[f]or our affiliates' everyday business purposes••-meaning for the affiliates' 

disclosure(?)/use(?) in responding to court orders, processing the affiliates' own transactions, and 

any other purpose that would be permitted for the affiliates' purposes under § ._14 or § _ .15. 

While it is true that a financial institution may disclose NPI to an affiliate so that the affiliate can 

prevent fraud, for example, we do not believe that the text in the Model provides a sufficiently 

complete description of affiliate sharing to be considered an accurate description. We believe it 

3 The safe harbor in the Proposal as it relates to federal administrative enforcement pertains only to § _.6 and § _.7 

of the GLBA Regulations. The safe harbor does not appear to extend to§ _ .4, which requires a financial 

institution's GLBA privacy policy to be one that "accurately reflects [the fmancial institution's) privacy policies and 

practices." 

7 5/29/2007 
would be sufficient to state that the affiliate sharing is "For our affiliates• use, in the boxes that 

currently refer to "affiliates• everyday business purposes." This is an accurate and concise 

statement financial institutions can use to describe their affiliate sharing practices. 

We also believe it would be appropriate to modify the descriptions of information that 

may be disclosed to affiliates for affiliates' use. The reference to "transactions and experiences" 

and to "creditworthiness" are sufficiently descriptive on their face to those familiar with the 

nuances of the FCRA. It is unclear to us whether they are sufficiently descriptive to consumers. 

For example, it is not clear that the provisions describe the disclosure of a consumer's name 

and/or address to an affiliate, which is usually viewed as not requiring notice and opt out. It is 

also not clear that a consumer would understand his or her payment history with the financial 

institution to be "transaction" information as opposed to "creditworthiness" information. 

Instead, we believe it would be more clear to describe such information as "information that is 

not credit report information" and "information we obtain from you or third parties about your 

creditworthiness," respectively. 

As we have stated elsewhere, it is critical that the Agencies provide a clear shield from 

liability no matter what language they offer in the Model as it relates to affiliate sharing. A 

financial institution should have the ability to rely on language specifically chosen and tested by 

the Agencies for purposes of its compliance obligations under the GLBA and FCRA. It simply 

cannot be the intent of the Agencies for a financial institution to become a consumer reporting 

agency under the FCRA, for example, because a consumer successfully alleges that the 

disclosure provided in the Model is not sufficient to describe the entire information sharing 

practices ofthe financial institution with respect to affiliate sharing. CBA strongly urges the 

Agencies to clarify this. Without such clarification, if the Model is perceived to be inaccurate or 

incomplete it simply will not be used. The consequences ofproviding insufficient affiliate 

sharing disclosures are too significant for many financial institutions to take such risks. 

We also note that the Agencies have not accurately described the disclosure financial 

institutions must provide to consumers under Section 624 of the FCRA. In particular, a 

consumer must have the right to opt out of certain uses of limited types of information by an 

affiliate to generate a solicitation to the consumer. The law does not provide a blanket opt out 

with respect to the sharing of such information, nor does the opt out apply to the use of all 

information obtained by the affiliate. The text in the Model, however, suggests that the 

consumer can opt out of all information sharing among affiliates if the affiliates would use it to 

market to the consumer. This is simply not an accurate description of how Section 624 of the 

FCRA operates. 

The Agencies should revise the text that currently states "[f]or our affiliates to market to 

you" but we understand the difficulties involved in simplifying and no other alternative noted. 

In the chart, in the "can you limit this sharing" column, it could say "no, but you have the right to 

limit the use of the information by affiliates to make solicitations to you". If the Agencies do not 

revise the language to reflect the contours of Section 624 ofthe FCRA, financial institutions will 

not use the Model as a vehicle to provide the Section 624 disclosures. 4 

4 Neither the FCRA nor the GLBA require the "affiliate marketing" disclosure to be provided in the GLBA privacy 

notice. 

8 5/29/2007 
It is important for the Agencies to make conforming changes to page 2 and 3 of the 

Model as they relate to affiliate sharing. The descriptions of the opt-out rights granted to 

consumers on page 2 and 3 should mirror those described on page 1. For example, the opt out on 

page 3 relating to Section 624 of the FCRA should not suggest that a consumer can block 

affiliates' use of any information, regardless of type or source, for use in. marketing. Certainly an 

affiliate can use its own information to market to the consumer, regardless of the choice provided 

in the Model. The explicit safe harbor we have requested would also need to apply to the opt-out 

language on page 3 as it would to the descriptions of affiliate sharing on page 1. 

Security Measures Designed to Comply with Federal Law 

The Agencies propose to require financial institutions to state that they "use security 

measures that comply with federal law.» Although virtually all financial institutions believe such 

a statement would be true as it applies to their operations, we do not believe the Agencies should 

require financial institutions to make such a statement. A financial institution could be found to 

be technically noncompliant with federal law in this regard for even minor, nonsubstantive 

reasons, making the statement incorrect and potentially subjecting the financial institution to 

liability relating to the accuracy of its GLBA privacy policy. Furthermore, the information 

security requirements under the GLBA are flexible, and appropriately so. A necessary result of 

this flexibility, however, is that financial institutions cannot be certain that an examiner will 

deem their programs to be compliant with the requirements. We believe it would be more 

appropriate to include a statement indicating that the financial institution's security program "is 

reasonably designed to comply with federal law." 

Description of Affiliates 

The GLBA and the GLBA Regulations require a financial institution to inform 

consumers of the "categories" of affiliates to whom the financial institution may disclose NPI. If 

the financial institution does not have affiliates, or if the institution does not disClose NPI to the 

affiliates it has, the institution need not make reference to affiliates in the privacy policy. The 

Model, however, would appear to require a description of affiliates regardless of whether the 

financial institution has any or discloses NPI to them. This is unnecessary. 

For those financial institutions that must describe the categories of affiliates to whom 

they discJose information the Model is not clear as to how to describe those affiliates. We 

assume the financial institution would describe only those affiliates to whom it may disclose 

NPI, not all of the affiliates it may have. We also assume that a financial institution need not list 

each affiliate despite the instruction to "list affiliates" in C.3 .(b). of the Proposal. CBA also 

believes that the existing language to describe affiliates is awkward for financial institutions that 

may list only one or two affiliates. It should be sufficient to name the affiliates in question, or 

the category to which they belong. 

Description ofNonaffiliates and Joint Marketing Partners 

9 5/29/2007 
The GLBA and the GLBA Regulations require a financial institution to inform 

consumers of the "categories" ofnonaffiliates to whom the financial institution may disclose 

NPI. We appreciate that the Agencies would permit financial institutions to state that they do not 

share with such entities, if such is the case. As we note below, however, it may be more 

appropriate to allow financial institutions to omit these two boxes from the Model if they do not 

share with nonaffiliated third parties other than "for everyday business purposes." 

We also believe that financial institutions should not be required to list the types of third 

parties to whom they may disclose NPI. Such a list could become unnecessarily cumbersome for 

financial institutions attempting to adopt the Model across a family of affiliates. For example, if 

five affiliates each shared with one type of third party, but none shared with the same type of 

third party, the Model may need to include all five types of companies in order to ensure 

compliance absent additional guidance. Not only is this unnecessary, but it also incorrectly and 

unfairly implies to the consumer that his or her NPI could be disclosed to each of the five types 

of nonaffiliates. CBA asks the Agencies to eliminate the requirement to list the types of 

nonaffiliates to whom NPI may be disclosed, or to provide additional guidance to permit a list of 

two or three types of companies to be sufficient in all circumstances. 

State Law 

Given the fact that state privacy laws is affecting the financial service industry, requires 

policies, we are surprised at the lack of attention paid to state law in the Model or the Proposal. 

The only reference to state law in the Model is that "[s]tate laws ... may give you additional rights 

to limit sharing." CBA fears that this may not be sufficient for financial institutions to avoid 

potential liability at the state level. For example, the Agencies would require a fmancial 

institution to use a separate document to explain any difference in its information practices that 

may vary as a result of state law. Although we believe such a document should, strictly 

speaking, be sufficient, financial institutions may not view this as an appealing option if state 

attorneys general or the class action plaintiffs bar view such a practice to be somehow unfair or 

deceptive. In other words, a fmancial institution may not be willing to risk a class action lawsuit 

over this issue. 

We believe the Agencies should permit financial institutions to include state law addenda 

in the Model itself. We recognize that this may make the Model less appealing due to the length 

that would be required to fit such addenda into the expanded format of the Model. It is not . 

realistic, however, to force financial institutions essentially to ignore state law risks in their 

GLBA privacy policies. Perhaps such a result would focus policymakers on the need to create a · 

single standard so that it is, in fact; possible to provide consumers with standardized, concise 

privacy policies. 5 

Contacting the Financial Institution to Opt Out 

5 CBA notes that Congress has directed the Agencies to develop a "succinct" privacy policy that allows consumers 

to "compare privacy practices among institutions." We urge the Agencies to consider whether state laws would be 

preempted to the extent that they prevent the implementation of the federal law. 

10 5/29/2007 
Page 3 of the Model requires financial institutions to state "[u]nless we hear from you, we 

can begin sharing your information 30 days from the date of this letter." CBA notes that this 

language is required neither by the GLBA nor by the GLBA Regulations. For that reason it 

should not be required in the Model. If the Agencies retain the concept of informing consumers 

about a timeframe to opt out, the required language must be amended to account for the 

following issues: 

• A financial institution can share NPI immediately (and even prior to the privacy policy 

being delivered) for any reason other than pursuant to notice and opt out; 

• Even for third-party disclosures subject to an opt out, even the Agencies have indicated 

that a 30-day time period is not necessary in all circumstances; 

• There is no waiting period at all if the notice is an annual notice; 

• If the consumer has already opted out, he or she needs not opt out again and the 30-day 

reference is meaningless; 

• The Model may or may not be part of a "letter;" 

• The Model most likely does not have a "date" printed on it from which the consumer can 

start a 30-day clock; and 

• By suggesting that the financial institution need only "hear from [the consumer]" the 

statement implies that the consumer can opt out by contacting the financial institution in 

any manner, regardless of whether such manner is designated by the financial institution. 

Inability to Otherwise Customize when Appropriate or Necessary 

CBA believes a financial institution should be able to make modifications to the Model if 

the financial institution determines such modifications to be appropriate or necessary. For 

example, the Model makes several declaratory statements regarding a financial institution's 

information practices which may or may not be true. The Model makes statements such as 

"[ w ]hen you close your account, we continue to share information about you according to our 

policies," "[t]he types of personal information we collect and share depend on the product or 

service you have with us," and "[w]e also collect your personal information from others, such as 

credit bureaus, affiliates, or other companies." These statements, and several others, may or may 

not be true depending on the fmancial institution or the product offered. The financial institution 

should have the ability to state that the information collected "may" vary depending on the 

product, for example. 

A financial institution may also need to explain features of its information practices that 

are not currently included in the Model. For example, it is common for a financial institution to 

have multiple privacy policies depending on the financial product in question. As another 

example, a jointly marketed financial product may have a privacy policy applicable to both 

financial institutions that is different from the privacy policy each institution delivers to its other 

respective customers. The Model does not appear to give financial institutions the ability to 

explain the limited applicability of a specific privacy policy in these circumstances. Similarly, 

financial institutions oftentimes rely on consumer consent in connection with disclosures ofNPI 

to third parties, such as co-brand partners. A financial institution should be able to explain the 

scope ofthe consumer's consent as part of the Model. The inability to customize the Model in 

11 5/29/2007 
these and other ways will serve as a significant disincentive to financial institutions using the 

Model ifthey need that flexibility. · 

Ability to Modify for Use by Diversified Financial Institutions 

The Agencies specifically state that the Model could be used by "a group of financial 

holding company affiliates that use a common privacy notice."6 However, the SEC has provided 

text that differs from the other Agencies' text, yet no Agency will allow for deviation from its 

text without sacrificing the protection of the safe harbor. It would be impossible, therefore, for a 

diversified brand that has both a broker-dealer and a bank to provide the same privacy policy to 

all consumers. CBA urges the Agencies to grant a safe harbor to a financial institution that uses 

any text offered by any Agency in connection with its use ofthe Model. Unless such flexibility 

is granted, many diversified financial institutions will not be able to enjoy the benefits of the 

Model. 

Brevity 

As we state above, CBA firmly believes that financial institutions should be given an 

option of providing a one page Model to consumers. We believe that this goal is realistic, 

especially given the unused space in the Model as it is proposed. Not only is there significant 

empty space that could be eliminated without sacrificing the clarity of the Model, but there are 

also significant amounts of information that are not necessary to comply with the GLBA or the 

GLBA Regulations. If the Agencies eliminate these portions, or allow financial institutions to 

delete them at their option, we believe the Model could be significantly shorter. 

For example, the following portions of the Model are not required under any law or 

regulation: 

• The "FACTS" title line on each ofthe pages; 

• The information in the "Why?" box; 

• The information in the "How?" box; 

• Thejoint marketing disclosure for financial institutions that do not engage in joint 

marketing; 

• The FCRA affiliate sharing disclosure for financial institutions that do not share 

consumer report information with affiliates; 

• The ''[f]or nonaffiliates to market to you" disclosure for financial institUtions that do not 

. share NPI with third parties for that purpose; 

• The information in the "Contact Us" box; 

• The information in the "How often does [financial institution] notify me about their 

practices" box; 

• The information in the "Why can't I limit all sharing" box; 

6 CBA asks the Agencies to revise this portion of the Proposal to avoid any implication that the Model could not be 

used by a group of affiliates that is not part of a "financial holding company" as such term is defined in Section 3(p) 

of the Bank Holding Company Act. 

12 5/29/2007 
• The information in the "Mfiliates" box for financial institutions that do not share NPI 

with affiliates; 

• The information in the ''Nonaffiliates" box for financial institutions that do not share NPI 

with nonaffiliates; and 

• Theinformation in the "Joint marketing" box for financial institutions that do not share 

NPI pursuant to joint marketing agreements. 

Even if the Agencies were to eliminate only those disclosures that no financial institution, 

regardless of information practices, is required to make under law, the Model would be . 

approximately one less page of text without having to modify the format of the Model. 

CBA certainly understands that the information described in the bullets can have value 

both to consumers as well as to financial institutions. For this reason the information should be 

optional. We believe that financial institutions would be more likely to include such information 

in the Model if the information did not result in a disclosure of more than one page, but some 

financial institutions may still choose to include those disclosures even if the Agencies were to 

determine that such disclosures might necessitate a second page. 

We also note that it is not necessary to require the opt-out provisions on a separate page. 

These could be included on the same page as the rest of the privacy policy, as many financial 

institutions currently do today in full compliance with the law. The Agencies suggest that the 

Model includes the opt-out form on a separate page because staff at some of the Agencies stated 

in a prior F AQ that a financial institution could not provide a detachable opt-out form that 

removed some text of the privacy notice itself. Regardless of the fact that this staff interpretation 

does not reflect the Agencies' plain language requirement in the GLBA Regulations,7 it would be 

possible to include a tear-off opt-out form on a single-page Model without removing any of the 

text. 

Bias Against Information Practices 

CBA believes that a financial institution will be less likely to use a Model if that Model 

suggests the fmancial institution's information practices are somehow inappropriate. We note 

for the record that consumers benefit from information disclosures. Consumers can only benefit 

from being made aware of competing offers, new products, or special pricing. We recognize that 

opponents of information sharing have succeeded to some extent in demonizing the practice of 

information sharing, but the consumer benefits associated with information sharing cannot be 

denied.8 . 

Having said this, CBA recognizes that policy decisions have been made to allow 

consumers to opt out of certain information disclosures. We agree that consumers should receive 

a clear and conspicuous description of a financial institution's information practices and 

consumers' legal rights. We do not believe, however, that the privacy policy should be designed 

7 The GLBA Regulations require a financial institution to provide GLBA privacy notices to "customers" so that the 

"customer can retain them or obtain them later." (Emphasis added.) 

8 To the extent that consumers wish to avoid the mechanism through which such offers are provided, existing law 

gives them simple options to opt out of receiving information through telemarketing and e-mail marketing. 

13 5/29/2007 
to make a financial institution appear profligate or irresponsible with respect to information 

sharing. CBA believes that asking a financial institution to include a chart implying widespread 

and reckless information sharing, i.e., one that requires it to answer "yes" to up to seven 

questions about sharing, is not conducive to having such fmancial institutions use the Model. 

For example, virtually every fmancial institution makes disclosures "for its everyday business 

purposes" and to service providers under§ _.13. These information disclosures are innocuous 

and expected. They probably do not warrant their own places in a chart, especially since these 

portions of the chart will not serve to differentiate the vast majority of financial institutions. 

We also note that requiring a financial institution to tell consumers "no" in a chart 

repeatedly is also not going to encourage the financial institution to use the chart. This is, in 

essence, how the Agencies have constructed the chart by using "[c]an you limit this sharing?" as 

a heading and requiring financial institutions to say "no" repeatedly. It may be equally effective, 

however, to include as a column heading such as "You can limit this sharing" and require the 

financial institution to check the appropriate boxes if the consumer can, in fact, limit the sharing 

in question. Alternatively, the heading could be "Does [federal] law give you the right to limit 

this sharing?" with use of the word "federal" depending on how the Agencies address state law 

issues. 

CBA also believes that a financial institution should have the option of explaining why it 

shares information with affiliates and/or third parties, even if it increases the length of the Model. 

The Agencies use significant text and space in the Model to explain a variety of things to 

consumers, virtually none of which are required by the GLBA or the GLBA Regulations. It 

would seem reasonable, therefore, that financial institutions should have the ability to explain 

why consumers benefit from affiliate sharing and/or third-party sharing. Again, our objective is 

to encourage use of the Model. We believe that this flexibility will result in more, not less, 

financial institutions using the Model. 

Branding 

CBA commends the Agencies for allowing fmancial institutions the ability to use "spot 

color" on the Forni and to include "a corporate logo on any page of the notice, so long as it does 

not interfere with the readability of the model form or the space constraints of each page." We 

ask the Agencies to grant financial institutions broader flexibility so that the Model may include 

colors, markings, logos, and other visual effects consistent with other communications from the 

financial institution. 

Financialinstitutions spend significant resources determining how best to communicate 

with their customers. The GLBA privacy policy, like periodic statements or account 

applications, is one more opportunity for a financial institution to communicate with its 

customers. We believe that a fmancial institution should be permitted to brand such 

communications in a manner that it determines to be appropriate. For example, it may: 

• Choose to use a certain color paper (other than white or cream) to send communications 

to the consumer; 

• Include its corporate logo in more than one place in documents; 

14 5/29/2007 
• Include a logo associated with the product; and/or 

• Include a branding phrase, such as "[Name of bank], the Bank in Your Neighborhood". 

So long as these branding mechanisms do not interfere with the disclosures provided, we do not 

believe the Agencies should limit a financial institution's ability to customize the appearance of 

the Model. 

Repeal of Existing Safe Harbor and Sample Clauses 

The Agencies propose to repeal the Sample Clauses and their safe harbor status in the 

GLBA Regulations one year after a final rule is adopted. CBA asks the Agencies to retain the 

Sample Clauses and the existing safe harbor. Although Congress directed the Agencies to 

develop "a" model form as part of the Financial Services Regulatory Relief Act of 2006, it did 

not direct the Agencies to make it "the" model form, nor to repeal any existing models. CBA is 

also concerned that many financial institutions will not be able to use the Model absent 

significant revisions to it, and that a repeal of the current safe harbor will leave fmancial 

institutions with no meaningful guidance or legal certainty with respect to their GLBA privacy 

notices. Not only would this result in unnecessary uncertainty at the federal level, but financial 

institutions could also face significant difficulties at the state level ifthere is not a widely 

accepted standard with respect to adequate GLBA privacy policies. 

Even if the Agencies eliminate the existing Sample Clauses and safe harbor, we believe 

the Agencies should provide financial institutions with guidance as to whether the Agencies will 

view use of the Sample Clauses as indicia of noncompliance with the GLBA Regulations. The 

Agencies note in the Proposal, for example, that they are granting a year for continued use of the 

Sample Clauses "for compliance purposes." Although CBA appreciates the fact that the 

Agencies are not proposing to delete the Sample Clauses immediately, we are concerned with the 

implication that financial institutions must cease use of the Sample Clauses in order to be in· 

compliance with the GLBA Regulations after the one year transition period. We agree with the 

Agencies' existing views that a financial institution can comply with the privacy policy 

notification requirements of the GLBA Regulations through use of the Sample Clauses. We are 

unaware of any developments that would change this view, and we believe it would be 

capricious for the Agencies to grant the Sample Clauses safe harbor status one day and view 

them as evidence of noncompliance literally the next day. For this reason, we strongly urge the 

Agencies to indicate that the Model will not become a de facto requirement, either intentionally 

or through examiner reliance on it as the only acceptable method to comply with the GLBA 

Regulations. 

Alerting Consumers to Changes in Policy 

The Agencies request comment on whether "financial institutions should be required to 

alert consumers to changes in an institution's privacy practices as part of the model form." We 

do not believe the Agencies should adopt such a requirement. As a primary matter, Congress has 

not required such information to be included in the GLBA privacy policy, and we do not believe 

15 5/29/2007 
it is necessary for the Agencies to do so. This is especially true since the Model already runs the 

significant risk of being too long to be adopted by many financial institutions. It is also not clear 

to us how the Agencies could view use of the Model, minus any highlighting of changes, to 

violate the GLBA Regulations since the Agencies' regulations themselves do not require such 

information. 

There are practical problems to the requirement to inform consumers to changes in an 

institution's privacy practices, as well. For example, a description of a change may not be as 

simple as it would appear. Would a financial institution need to "alert" consumers if a listed 

affiliate changed a name? Was sold? A category of affiliates was added/deleted? Even if a 

change in the disclosure practices were the only item that required "highlighting," it is not clear 

how such a requirement would work if there was a merger or acquisition because setting a 

baseline for comparison would be difficult. Of course, as state laws continue to change, it would 

seem that such a requirement could create interesting compliance decisions as to how to inform 

residents of that state of changes specific to that state when the state law disclosures are not 

permitted on the Model in the first place. 

SSNs/Account Numbers 

The Agencies also request comment as to whether financial institutions "need [the 

consumer's account number, Social Security number, or other personal information] in order to 

process opt-out requests, or would the customer's name and address alone, or the customer's 

name, address, and a truncated account number for a single account, be sufficient to process optout requests, including for customers with multiple accounts at the same institutions?" In short, 

financial institutions should continue to be permitted to request Social Security numbers or any 

other reasonably necessary information in connection with an opt-out request. 

A consumer that provides only a name and address may or may not provide sufficient 

information to implement an opt out. For example, the name provided by the consumer on the 

opt-out form may or may not match the name on any given account depending on whether the 

consumer lists his/her name on the opt-out form exactly as it appears in the financial institution's 

records. The same is true for an address. This is especially difficult ifthere are two people with 

the same or similar names at the same address. Even if name and address were sufficient, 

consumers' handwriting is not always legible. Additional searchable information, such as SSNs, 

results in increased ability to record consumers' choices accurately. 

While an institution may in some circumstances be able to use the last four digits of an 

account, in conjunction with a name and address, to implement an opt out on a single account, 

the institution may not be able to implement the opt-out "across the board," even if the Agencies 

were to permit a :financial institution to allow a consumer to indicate such a preference for such a 

broad opt out. The consumer could have used multiple versions of the same name and/or used 

different addresses in connection with multiple accounts with the same financial institution. 

There simply must be a unique identifier available to the financial institution if it must 

implement opt outs across accounts. This is also true for those affiliated entities that implement 

opt outs across the family of companies. 

16 .5/29/2007 
.. 

CBA is concerned that the Agencies have raised this issue in the context of the Proposal. 

If the Agencies were to delete the· option from the Model to colleCt a unique identifier, they 

would be suggesting that to request such information could violate the GI:,BA and GLBA 

Regulations. If the Agencies did not mean to imply such a result, there would be no reason to 

exclude affirmatively that option from the Model and its safe harbor. We strongly urge the 

Agencies to permit financial institutions to collect the information they deem to be important 

through use of the Model when implementing consumers' opt-out requests . 

. Conclusion 

CBA strongly urges the Agencies to develop a Model that will provide consumers with 

clear, concise, and succinct GLBA privacy policies. In order to achieve this goal, however, the 

Agencies must develop a Model that fmancial institutions are willing to use for large numbers of 

accounts. We believe the Model currently has several material shortcomings that will hinder its 

widespread adoption by financial institutions. CBA hopes the Agencies will consider the 

comments it receives, engage in additional consumer testing involving privacy policies likely to 

be delivered to consumers, and repropose a Model for additional feedback. 

Again, we thank the Agencies for the opportunity to comment on the Proposal and the 

Model. Please do not hesitate to contact me if you have any comments or questions, or if we 

may be of further assistance in this matter. 

Very truly yours, 

Marcia Z. Sullivan 

Vice President 

Director, Government Relations 

msullivan@cbanet.org 

703-276-3873 

17 5/29/2007