COMMENT 

RECElVI:O 

C.F. . 

I ~. I 

Reee\Ved CFTC 

ReCOrdr Sectton .)j jb Of 

, ·• ..,r . ... '! .) .) li != 1\5 

Peter L. McCorkell Law Department 

Senior Counsel 633 Folsom Street 

May29, 2007 

Seventh Floor 

San Francisco, CA 94107 

415-396-0940 

415-975-7863 

Via e-mail to: W\vw.regs.comments@occ.treas.gov 

RE: INTERAGENCY PROPOSAL FOR MODEL PRIVACY FORM 

Office of the Comptroller of the Currency 

250 E Street, S.W. 

Mail Stop 1-5 

Washington, DC 20219 

Re: Docket lD OCC-2007-0003 

Mr. Robert E. Feldman 

Executive Secretary 

Attention: Comments 

Federal Deposit Insurance Corporation 

550 17th Street, N.W. 

Washington, DC 20429 

Re: RIN 3064-AD 16 

Ms. Mary Rupp 

Secretary of the Board 

National Credit Union Administration 

1775 Duke Street 

Alexandria, Virginia 22314-3428 

Re: RIN 3133-AC84 

Ms. Nancy M. Morris 

Secretary 

Securities and Exchange Commission 

100 F Street, N.E. 

Washington, DC 20549-1090 

Re: File Number 87-09-07, Model Privacy 

Form 

Ms. Jennifer Johnson 

Secretary 

Board ofGovemors of the Federal Reserve System 

20th Street and Constitution Avenue, N.W. 

Washington, DC 20551 

Re: Docket No. R-1280 

Regulation Comments 

Chief Counsel's Office 

Office of Thrift Supervision 

1700 G Street, N.W. 

Washington, DC 20552 

Attention: OTS-2007-005 

Re: Docket ID OTS-2007-0005 

Federal Trade Commission 

Office of the Secretary 

Room 135 (Annex C) 

600 Pennsylvania Avenue, N.W. 

Washington, DC 20585 

Re: Model Privacy Form, FTC File No. 

P034815 

Ms. Eileen Donovan 

Acting Secretary of the Commission 

Commodity Futures Trading Commission 

Three Lafayette Centre 

1155 21st Street, N.W. 

Washington, DC 20581 

Re: RIN 3038-AC04 
Office of the Comptroller of the Currency 

M~. Jennifer Johnson/Board of Governors of the Federal Reserve System 

Mr. Robert E. Feldman/Federal Deposit Insurance Corporation 

Regulation Comments/Office of Thrift Supervision 

Ms. Mary Rupp/National Credit Union Administration 

Federal Trade Commission 

Ms. Nancy M. Morris/Securities and Exchange Commission 

Ms. Eileen Donovan/Commodity Futures Trading Commission 

May 29,2007 

Page 2 

RE: INTERAGENCY PROPOSAL FOR MODEL PRIVACY FORM 

Ladies and Gentlemen: 

This comment letter is submitted on behalf of Wells Fargo & Company and its subsidiaries and 

affiliates ("Wells Fargo") in response to the Interagency Proposal for Model Privacy Form Under 

the Gramm-Leach-Bliley Act ("Proposal") issued by the Office of the Comptroller of the 

Currency, Office ofThrift Supervision, Board of Governors of the Federal Reserve ("FRB"), 

Federal Deposit Insurance Corporation, National Credit Union Administration, Federal Trade 

Commission, Commodity Futures Trading Commission, and Securities and Exchange 

Commission ("SEC") (collectively, the "Agencies"). Wells Fargo appreciates the opportunity to 

provide our comments to the Agencies. 

Wells Fargo is one of the country's largest diversified financial services organizations. The 

Wells Fargo family of companies includes national and state-chartered banks, consumer finance 

companies, insurance brokers and underwriters, and securities broker-dealers and investment 

advisors. We have operations in almost all 50 states as well a number of countries outside the 

United States. A key aspect of Wells Fargo's business strategy is to develop multiple 

relationships with its customers across its various lines of business, in many cases by offering 

packages of complementary products and services. To the extent that the Model Form Proposal 

inhibits doing so in an integrated fashion, it has effects on Wells Fargo that may be different in 

kind than the imp~ct on other financial institutions. 

Summary 

Wells Fargo supports the Agencies' efforts to develop a simplified Gramm-Leach-Bliley Act 

("GLBA") privacy disclosure and opt-out form that is relatively easy for consumers to read and 

understand. We share the Agencies' goal of providing financial institutions with a model form 

that provides a safe harbor for certain requirements under the regulations issued by the Agencies 

implementing Title V, Subtitle A ofGLBA ("GLBA Regulations"). And we support the goal of 

making it easier for consumers to compare privacy policies and practices across different 

financial institutions. 

By statute, use of the model form developed by the Agencies ("Model") is voluntary. To achieve 

the goal of comparability across institutions, the Model must be attractive enough so that it will 

be adopted by a critical mass of financial institutions. If the model form is not widely adopted, 

the clear intent of the Agencies and of Congress- to provide easily comparable GLBA privacy 

policies-will not be achieved. Unfortunately, the Model does not provide a viable option to 
Office of the Comptroller of the Currency 

Ms. Jennifer Johnson/Board of Governors of the Federal Reserve System 

M~. Robert E. Feldman/Federal Deposit Insurance Corporation 

Regulation Comments/Office of Thrift Supervision 

Ms. Mary Rupp/National Credit Union Administration 

Federal Trade Commission 

Ms. Nancy M. Morris/Securities and Exchange Commission 

Ms. Eileen Donovan/Commodity Futures Trading Commission 

May 29,2007 

Page 3 

Wells Fargo, and we believe many other financial institutions will reach the same conclusion. In 

our view, significant changes must be made to the Model for it to have any chance of widespread 

use. We urge the Agencies to carefully consider the comments they receive in response to the 

Proposal and to issue a revised proposal for further comment. 

We have two fundamental concerns with the proposed Model: 

1. The format requirement that the Model be in the form of three separate sheets-for any 

institution that provides an opt out under GLBA or FCRA-printed on one side only, 

would result in prohibitive increases in paper, printing, postage and other distribution 

costs for initial and, especially, annual privacy notices; and 

2. The extremely prescriptive content requirements make it impossible for many 

institutions-including Wells Fargo-to use the Model and still accurately describe 

information use and sharing policies and practices which are not merely allowed by 

GLBA, but in some respects, more protective of consumers than what the statute requires. 

Instead, the content required by the Proposal will, in some cases, be misleading to 

consumers and, in others, simply does not accurately describe the law. 

Regardless of the changes made to the Model, we ask the Agencies to provide financial 

institutions with a meaningful safe harbor with respect to the GLBA privacy notice requirements 

based on content and not format. If a financial institution uses a notice substantively similar to 

the final text of the Model, such financial institution should be deemed compliant with the 

GLBA disclosure requirements even if it does not follow the proposed format. 

In General 

Wells Fargo believes that the Agencies should make significant modifications to the Model and 

repropose it for additional public comment. We believe this is appropriate because, in our 

opinion, the changes necessary to the Model are of such magnitude as to require an almost 

entirely new format and text. Specifically, we believe the Agencies should develop a Model that 

can be printed on a single sheet ofpaper (not necessarily 8.5" x 11") with modifications to the 

existing textual requirements. We firmly believe this objective can be achieved (and we provide 

some sample alternatives) while still providing consumers with the required information in a 

simple, clear and comparable manner. If the Agencies are not willing to explore such an 

approach, we believe it is unlikely that many of the larger financial institutions will adopt the 

Model in any form, thus defeating the goal of comparability across institutions. 

We recognize that the Agencies have spent significant time and effort researching alternatives to 

the existing GLBA privacy notices. However, the Agencies seem to be relying almost 

exclusively on consumer testing which did not include anything resembling the notice that we 
Office of the Comptroller of the Currency 

M~. Jennifer Johnson/Board of Governors of the Federal Reserve System 

Mr. Robert E. Feldman/Federal Deposit Insmance Corporation 

Regulation Comments/Office ofThrift Supervision 

Ms. Mary Rupp/National Credit Union Administration 

Federal Trade Commission 

Ms. Nancy M. Morris/Secmities and Exchange Commission 

Ms. Eileen Donovan/Commodity Futures Trading Commission 

May 29,2007 

Page4 

propose. In addition to considering comments received on the Proposal, the Agencies should 

engage in additional consumer testing of alternative versions of a privacy notice. The question is 

not whether consumers prefer a three-page GLBA privacy notice, because that will be a moot 

point if significant numbers of financial institutions decline to provide such a notice. The 

relevant question is whether a notice that is actually likely to be used by a critical number of 

financial institutions can provide GLBA privacy disclosures in a manner that is both comparable 

across institutions and easy for consumers to understand. To our knowledge, the Agencies have 

not tested such a concept. 

Format, Cost and Delivery Considerations 

Under the Proposal, in order to qualify for the safe harbor, a financial institution's notice must be 

at least two pages in length no matter how simple its privacy policy might be. Furthermore, any 

institution-and that would include Wells Fargo-that provides any type of opt-out choice to the 

consumer must add a third page. The Model notice must be printed on only one side of 8.5" x 

11" paper, and must be presented in a manner that allows the consumer to view all pages 

simultaneously. No other information could be printed on the otherwise unused portions ofthese 

sheets, and they may not be combined into any other document. Meeting these requirements 

would result in enormous increases in the cost of paper, printing, production and postage, 

especially for the annual privacy disclosures. In addition, several of our business units are 

simply not able to deliver notices that conform to the Model's format requirements without 

making significant changes to their print production environments. 

Like many other financial institutions, Wells Fargo now provides information to its customers 

that goes beyond what is legally required to be in the GLBA privacy notice including legally 

required information- such as the notice of reporting negative credit information to consumer 

reporting agencies required by Section 217 ofthe FACT Act-and other, optional informationsuch as how to opt out of credit bureau prescreening, information about the Direct Marketing 

Association's Mail Preference Service, and internal solicitation preferences (do not mail, do not 

call, etc.) information. We believe this information is useful to and appreciated by our customers 

(and, in the case of the FACT Act Section 217 notice, legally required) so we would want to (or 

have to) continue to provide it. This means that using the Model form would require sending at 

least FOUR sheets of paper, instead of the one we now use. If nothing else, the environmental 

and natural resource impacts inherent in the Proposal ought to invite serious reconsideration. 

Some of the additional costs that would have to be incurred in order to comply with the format 

requirements of the Model form are described and quantified below. 
Office of the Comptroller ofthe Currency 

Ms. Jermifer Johnson/Board of Governors of the Federal Reserve System 

M~. Robert E. Feldman/Federal Deposit Insurance Corporation 

Regulation Comments/Office of Thrift Supervision 

Ms. Mary Rupp/National Credit Union Administration 

Federal Trade Commission 

Ms. Nancy M. Morris/Securities and Exchange Commission 

Ms. Eileen Donovan/Commodity Futures Trading Commission 

May 29,2007 

Page 5 

Cost and Environmental Impact of Additional Paper 

Just for Wells Fargo's annual privacy notices, and assuming we did not need a separate sheet of 

paper in order to disseminate the other required and optional information described above, we 

estimate that paper costs to produce the Model form would more than double compared to 

current costs. The cost of shipping that paper to the printer and then to distribution facilities (not 

including postage to deliver the notice to consumers) would also be more than double current 

costs. Moreover, the environmental impacts of using that much more paper are staggering: More 

than 2,000 additional trees would have to be cut down to produce that paper; and, using a 

recycling rate of approximately 50%, nearly 60 additional tons of paper would wind up in 

landfills. 

Cost of Printing 

We estimate the cost of printing annual notices using the Model format would be approximately 

50% higher than the current cost, again assuming that we did not do any additional printing to 

provide the other information described above which, under the Proposal, could no longer be 

included in the privacy disclosure. 

Cost of Postage 

Again, just for our annual privacy disclosures, we estimate that the average weight per piece 

would increase from 0.21 oz. to 0.53 oz. Because of this additional weight, and because, as 

explained below, many of the notices that are now delivered along with periodic statements 

would have to be mailed separately, we estimate that we would incur an additional $3,000,000 in 

postage costs to deliver the Model notice. 

Production Costs and Constraints 

In addition to the direct costs associated with paper, printing and mailing privacy policies that are 

at least one, if not two, additional pages, the Model would impose other costs that are more 

difficult to quantify. In particular, many Wells Fargo business units would have difficulty 

delivering the Model using their existing delivery mechanisms. 

The GLBA Regulations require, in many circumstances, a financial institution to provide 

customers the initial GLBA privacy policy no later than at the time the customer relationship is 

established. Some of our business units ensure compliance with this requirement by integrating 

the privacy policy into the other required disclosures and materials provided to the consumer at 
Office of the Comptroller of the Currency 

M~. Jennifer Johnson/Board of Governors of the Federal Reserve System 

Mr. Robert E. Feldman/Federal Deposit Insurance Corporation 

Regulation Comments/Office of Thrift Supervision 

Ms. Mary Rupp/National Credit Union Administration 

Federal Trade Commission 

Ms. Nancy M. Morris/Securities and Exchange Commission 

Ms. Eileen Donovan/Commodity Futures Trading Commission 

May 29, 2007 

Page 6 

the time of account opening. This type of delivery would appear to be prohibited if we were to 

adopt the Model. Simplicity of delivery is critical in light of the fact that it is not practical to train 

our own employees and also employees of establishments for whom we issue private label and 

similar forms of credit, on the finer points of regulatory compliance requirements. If the Model 

must be three pages, and the pages must not have any other information on them, it is not clear to 

us how a card-issuing financial institution could provide failsafe "take one" -style applications (or 

any other application styles, for that matter) in a retail environment without redesigning 

significant portions of the marketing and compliance components of the card program. 

In addition to the difficulties we would have in delivering the Model privacy policy at the point 

of account opening, some of our businesses would have problems mailing the Model, either as an 

initial or an annual privacy policy. Most of our annual privacy notices are delivered along with 

periodic statements. Our credit card division, for example, sends billing statements in envelopes 

that simply cannot accommodate 8.5" x 11" paper. Other business units have the same problem. 

To use the Model notice they would need to reconfigure their production processes, either by 

changing envelopes or mailing the annual notice as a stand alone document in a larger envelope. 

Both options are expensive. Even in the businesses that can currently accommodate 8.5" x 11" 

paper in their statement envelopes, stuffing three additional pieces of paper is significantly 

harder, more expensive and more prone to error than stuffing just one. Also some units produce 

privacy statements "in stream" with other documents being sent in the same envelope. The size 

of the file for each customer is a significant production consideration. Also, the large areas that 

need to be printed in dark ink prescribed in the Model form may not dry fast enough in a highspeed printing environment causing pages to stick together and/or smear. 

Alternative Formats 

It would be one thing if the three-sheet format, and the prohibition of including any other 

information, were the only way to achieve the stated goals of readability and comparability. 

However, that is demonstrably not the case. Exhibits A, B and C to this letter are samples of 

single-sheet disclosures (using, for the sake of example only, the content prescribed in the 

Proposal). While they "sacrifice" either font size or the ability to place all three pages side-byside, we believe each is perfectly readable by the average consumer. Moreover, each has some 

space which could be used for other required disclosures or "optional" information without 

detracting or distracting from the GLBA privacy notice. Most importantly, a single-sheet notice 

actually has some chance of being adopted by a significant number of financial institutions- if 

the content issues discussed below can be resolved. 
Office of the Comptroller of the Currency 

Ms. Jennifer Johnson/Board of Governors of the Federal Reserve System 

M;. Robert E. Feldman/Federal Deposit Insurance Corporation 

Regulation Comments/Office of Thrift Supervision 

Ms. Mary Rupp/National Credit Union Administration 

Federal Trade Commission 

Ms. Nancy M. Morris/Securities and Exchange Commission 

Ms. Eileen Donovan/Commodity Futures Trading Commission 

May29, 2007 

Page 7 

Electronic Delivery 

The only electronic delivery method sanctioned by the Proposal (to qualify for the safe harbor in 

terms of delivering a clear and conspicuous policy to consumers) is the posting of a pdf version 

of the Model on the financial institution's web site. It appears that any other electronic delivery 

mechanism, such as delivering the notice as text in an e-mail, or posting it as text on a web page, 

would not qualify for the safe harbor. This could result in fewer financial institutions adopting 

the Model. We urge the Agencies to provide more flexibility in making the safe harbor available 

in connection with the use of the Model in a variety of electronic environments (e.g., e-mail text, 

web site HTML text, etc.). 

Content Issues 

The Proposal makes it clear that a financial institution may alter the Model in only a few 

narrowly prescribed ways without entirely losing the safe harbor. If the changes financial 

institutions would need to make to the Model were only a few minor adjustments, this lack of 

flexibility might not be an issue. However, the Model as drafted in many respects simply does 

not accurately reflect Wells Fargo's information policies and practices, nor does it accurately 

reflect the scope of consumers' rights under federal law. Wells Fargo would have to make 

substantial changes to the content of the Model to describe our policies and practices accurately. 

The materiality of such changes would not only mean we could not claim the protection of the 

safe harbor, but would also make it difficult for us to evaluate whether the Agencies would deem 

the resulting notice to be compliant with GLBA. 

General Accuracy 

Wells Fargo does not share NPI with non-affiliated third parties for the purpose of marketing 

products or services of those third parties except in very limited circumstances involving private 

label, co-branded or affinity credit programs. We have also determined that we will offer only a 

single opt out to customers covering both the "affiliate sharing" requirements of Section 

603( d)(2)(A)(iii) of FCRA and the "affiliate marketing" requirements of Section 624. We believe 

that offering separate opt outs would be confusing both to our customers and our own 

employees, not to mention that doing so would require major information systems changes. 

Wells Fargo simply could not accurately describe its privacy policies and practices within the 

required and permitted content of the Model. Not only is the required and permitted text 

incapable of describing our information practices accurately, the text also misstates (or simply 

creates) consumers' rights under applicable federal law. We must have the flexibility to tailor 

the content of the Model to accurately describe our policies and practices, and to reflect only 

those rights actually granted to consumers by the relevant statutes. While it may not be necessary 

to include text that is unquestionably complete and precise with respect to our information 
Office of the Comptroller of the Currency 

Ms. Jennifer Johnson/Board of Governors of the Federal Reserve System 

Mi. Robert E. Feldman/Federal Deposit Insurance Corporation 

Regulation Comments/Office of Thrift Supervision 

Ms. Mary Rupp/National Credit Union Administration 

Federal Trade Commission 

Ms. Nancy M. Morris/Securities and Exchange Commission 

Ms. Eileen Donovan/Commodity Futures Trading Commission 

May 29,2007 

Page 8 

practices, the permitted language cannot be patently incorrect with respect to how we handle 

information. 

We agree with the observation that the "laws governing the disclosure of consumers' personal 

information are not easily translated into short, comprehensible phrases that are also legally 

precise." For example, it would not be practical to list all of the reasons that could be included 

as an "everyday business purpose" or all of the sources of information collected. Like the 

existing sample clauses in the GLBA Regulations ("Sample Clauses"),portions of the Model 

include concise language that gives consumers an accurate impression of the types of practices 

engaged in by a financial institution. We urge the Agencies to retain that approach in the Model 

with respect to those practices that can be described with generality. 

Safe Harbor 

Below are specific examples of how the text in the Model could be improved (either by the 

Agencies or by us if we had the requisite flexibility). Regardless of whether our suggestions are 

adopted, it is critical that the Agencies expressly state in a final rule that financial institutions 

that use the text (or something substantially similar) provided by the Agencies will have the 

flexibility to engage in any information practices permitted under GLBA, including those 

permitted by notice and opt out and for "everyday business purposes." If the Agencies do not 

provide such a safe harbor, and the final Model does not include legally precise language, use of 

the Model may not provide acceptable protection from liability, whether through federal, state, or 

private enforcement. 1 This is necessary not only for federal enforcement purposes, but also to 

assist state attorneys general and judges in determining whether liability is warranted under state 

claims based on unfair/deceptive theories. 

Description of Information Practices: For Our Marketing Purposes 

On page 1 of the Model, there is a statement pertaining to a financial institution's ability to 

disclose NPI to third parties "[f]or our marketing purposes-to offer our products and services to 

you." The Proposal says that this statement "includes service providers contemplated by section 

[_.13] of' the GLBA Regulations. We ask the Agencies to modify the form so that the 

statement can be more reflective of the breadth of disclosures permitted under§ _.13. We· also 

ask the Agencies for a more explicit statement indicating that, regardless of any change made to 

the Model, a financial institution that uses the text provided by the Agencies will have met its 

1 The safe harbor in the Proposal as it relates to federal administrative enforcement pertains only to§ _ .6 and§ _ .7 

of the GLBA Regulations. The safe harbor does not appear to extend to § _ .4, which requires a financial 

institution's GLBA privacy policy to be one that "accurately reflects [the financial institution's] privacy policies and 

practices." 
Office of the Comptroller of the Currency 

Ms. Jennifer Johnson/Board of Governors of the Federal Reserve System 

M~. Robert E. Feldman/Federal Deposit Insurance Corporation 

Regulation Comments/Office of Thrift Supervision 

Ms. Mary Rupp/National Credit Union Administration 

Federal Trade Commission 

Ms. Nancy M. Morris/Securities and Exchange Commission 

Ms. Eileen Donovan/Commodity Futures Trading Commission 

May 29,2007 

Page 9 

obligation to provide the disclosure required under§ _.13, even if the disclosure ofNPI is for 

reasons other than those listed in the Model (but still permitted under§ _.13). 

Description of Information Practices: Affiliate Sharing 

The Model's descriptions of affiliate sharing do not accurately describe the affiliate sharing 

engaged in by Wells Fargo. For example, two of the three boxes in the chart on page 1 suggest 

that a financial institution shares NPI with its affiliates "[f]or our affiliates' everyday business 

purposes"-meaning for the affiliates' disclosure(?)/use(?) in responding to court orders, 

processing the affiliates' own transactions, and any other purpose that would be permitted for the 

affiliates' purposes under§ ._14 or§ _.15. While it is true that a financial institution may 

disclose NPI to an affiliate so that the affiliate canprevent fraud, for example, we do not believe 

that the text in the Model provides a sufficiently complete description of affiliate sharing to be 

considered an accurate description. We believe it would be sufficient to state that the affiliate 

sharing is "For our affiliates' use" in the boxes that currently refer to "affiliates' everyday 

business purposes." This is an accurate and concise statement financial institutions can use to 

describe their affiliate sharing practices. 

While the Proposal defines "everyday business purposes" with respect to the "general" 

exceptions in the GLBA Regulations, it is not at all clear that consumers will share that 

understanding ofthis phrase. Maybe it is time to recognize that GLBA takes the long way around 

to what could be a fairly straightforward destination. Instead of following GLBA's tortuous route 

of prohibiting all disclosures ofNPI to non-affiliates-and then exempting virtually all 

disclosures except those made for marketing purposes-perhaps the Model should use a more 

direct and descriptive phrase, such as "purposes o.ther than marketing." 

Likewise, we believe it would be appropriate to modify the descriptions of the types of 

information that may be disclosed to affiliates for their use. The reference to "transactions and 

experiences" and to "creditworthiness" may be clear to those who have read the preamble to the 

Proposal and are familiar with the nuances of the Fair Credit Reporting Act ("FCRA"), but it is 

not at all obvious that they are sufficiently descriptive for consumers. For example, it is not clear 

that the provisions describe the disclosure of a consumer's name and/or address to an affiliate, 

which is usually viewed as not requiring notice and opt out. It is also not clear that a consumer 

would understand his or her payment history with the financial institution to be "transaction" 

information as opposed to "creditworthiness" information. Instead, we believe it would be 

clearer to describe those categories of information as "information that is not credit report 

information" and "information we obtain from you or third parties about your creditworthiness," 

respectively. 
Office of the Comptroller of the Currency 

Ms. Jennifer Johnson/Board of Governors of the Federal Reserve System 

Mr. Robert E. Feldman/Federal Deposit Insurance Corporation 

Regulation Comments/Office of Thrift Supervision 

Ms. Mary Rupp/National Credit Union Administration 

Federal Trade Cornnrission 

Ms. Nancy M. Morris/Securities and Exchange Commission 

Ms. Eileen Donovan/Commodity Futures Trading Commission 

May 29,2007 

Page 10 

As noted above with respect to the GLBA safe harbor, the Agencies should provide a clear shield 

from liability no matter what language they offer in the Model as it relates to affiliate sharing. A 

financial institution should have the ability to rely on language specifically chosen and tested by 

the Agencies for purposes of its compliance obligations under GLBA and FCRA. It is 

inconceivable that a financial institution might become a "consumer reporting agency" under the 

FCRA because a consumer successfully alleges that the disclosure provided in the Model notice 

is not sufficient to describe the entire information sharing practices of the institution with respect 

to affiliate sharing. Again, if the Model is perceived to be inaccurate or incomplete, it simply 

will not be used. The consequences of providing insufficient affiliate-sharing disclosures are too 

significant for any financial institutions to take such a risk. 

In addition, the Model does not accurately describe the disclosure a financial institution must 

provide to consumers under Section 624 ofFCRA. In particular, a consumer must have the right 

to opt out of the use of limited types of information by an affiliate to generate solicitations to the 

consumer. The law does not provide a blanket opt out with respect to the sharing of such 

information, nor does the opt out apply to the use of all information obtained by the affiliate. 

The text in the Model, however, suggests that the consumer can opt out of all information 

sharing among affiliates if the affiliates would use it to market to the consumer. This is simply 

not an accurate description of how Section 624 of the FCRA operates. The text that currently 

states "[f]or our affiliates to market to you" should be changed to "[f]or our affiliates to make a 

solicitation for marketing purposes to you-information about your creditworthiness that we 

create or obtain from you or third parties." In the chart, in the "can you limit this sharing" 

column, it could say "no, but you have the right to limit the use of the information by affiliates to 

make solicitations to you." If the language does not accurately reflect the contours of Section 624 

ofFCRA, financial institutions-including Wells Fargo-simply will not use the Model as a 

vehicle to provide the Section 624 disclosures.2 

It is also important that the Agencies make conforming changes to pages 2 and 3 of the 

Model as they relate to affiliate sharing. The descriptions of the opt-out rights granted to 

consumers on pages 2 and 3 should mirror those described on page 1. The explicit safe harbor 

should also to apply to the opt-out language on page 3 as it would to the descriptions of affiliate 

sharing on page 1. 

Description of Affiliates 

GLBA and the GLBA Regulations require a financial institution to inform consumers of the 

"categories" of affiliates to whom the financial institution may disclose NPI. If the financial 

institution does not have affiliates, or if the institution does not disclose NPI to affiliates, the 

2 Neither FCRA nor GLBA require the "affiliate marketing" disclosure to be provided in the GLBA privacy notice. 
Office of the Comptroller of the Currency 

Ms. Jennifer Johnson/Board of Governors of the Federal Reserve System 

Mr. Robert E. Feldman/Federal Deposit Insurance Corporation 

Regulation Comments/Office of Thrift Supervision 

Ms. Mary Rupp/National Credit Union Administration 

Federal Trade Commission 

Ms. Nancy M. Morris/Securities and Exchange Commission 

Ms. Eileen Donovan/Commodity Futures Trading Commission 

May 29,2007 

Page ll 

institution need not make reference to affiliates in the privacy policy. The Model, however, 

would appear to require a description of affiliates regardless of whether the financial institution 

has any affiliates or discloses NPI to them. 

For those financial institutions that must describe the categories of affiliates to whom they 

disclose information, the Model is not clear as to how to describe those affiliates. We assume 

the financial institution would describe only those affiliates to whom it may disclose NPI, not all 

of the affiliates it may have. We also assume that a financial institution need not list each 

affiliate despite the instruction to "list affiliates" in C.3.(b ). of the Proposal. The existing 

language to describe affiliates is awkward for financial institutions that may list only one or two 

affiliates. It should be sufficient to name the affiliates in question, or the category to which they 

belong. 

State Law 

Given the fact that a proliferation of state privacy laws is perhaps the single largest impediment 

to developing a concise, standardized privacy policy, we were surprised by the lack of attention 

paid to state law in the Model and the Proposal. The only reference to state law in the Model is 

that "[s]tate laws ... may give you additional rights to limit sharing." This may not be sufficient 

for financial institutions to avoid potential liability at the state level. The Proposal would seem 

to require a financial institution to use a separate document to explain any difference in its 

information practices that may vary as a result of state law. Although such a document should, 

in theory, be sufficient, it would not be an appealing option if state attorneys general or the class 

action plaintiffs' bar view such a practice to be somehow unfair or deceptive. Thus we believe 

financial institutions should be permitted to include state law addenda in the notice itself without 

jeopardizing safe harbor status. 

Contacting the Financial Institution to Opt Out 

Page 3 of the Model requires financial institutions to state "[u]nless we hear from you, we can 

begin sharing your information 30 days from the date of this letter. This language is required 

neither by GLBA nor by the GLBA Regulations. For that reason it should not be required in the 

Model. If the Agencies retain the concept of informing consumers about a time frame to opt out, 

the required language must be amended to account for the following Issues: 

• A financial institution can share NPI immediately (and even prior to the privacy policy 

being delivered) for any reason other than pursuant to notice and opt out (including with 

the consent of the customer); 

• Even for third-party disclosures subject to an opt out, the Agencies have indicated that a 

30-day waiting period is not necessary in all circumstances; 
Office of the Comptroller of the Currency 

Ms. Jennifer Johnson/Board of Governors of the Federal Reserve System 

Mr. Robert E. Feldman/Federal Deposit Insurance Corporation 

Regulation Comments/Office of Thrift Supervision 

Ms. Mary Rupp/National Credit Union Administration 

Federal Trade Commission 

Ms. Nancy M. Morris/Securities and Exchange Commission 

Ms. Eileen Donovan/Commodity Futures Trading Commission 

May 29,2007 

Page 12 

• There is no waiting period at all if the notice is an annual notice; 

• The Model may or may not be part of a "letter;" 

• The Model most likely would not have a "date" printed on it from which the consumer 

can start a 30-day clock; and 

• By suggesting that the financial institution need only "hear from [the consumer]," the 

statement implies that the consumer can opt out by contacting the financial institution in 

any manner, regardless of whether such manner is designated by the financial institution. 

Wells Fargo, like many other financial institutions, retains and honors opt-out requests (for both 

the "old" FCRA "affiliate sharing" and the "new" FACT Act "affiliate marketing" rules) 

indefinitely. However the "unless you contact us ... " language of the Model will result in many 

customers who already have an opt out on file contacting us again, year after year, to needlessly 

"renew" these opt-out requests. Processing these contacts would be a waste of resources for the 

financial institution and making them would be an unnecessary burden on consumers. Financial 

institutions should have the flexibility to inform consumers if they maintain opt outs indefinitely 

and, if so, that a consumer who has already requested opt-out status does not need to contact the 

institution again. 

Inability to Otherwise Customize when Appropriate or Necessary 

A financial institution should be able to make modifications to the Model if the financial 

institution determines such modifications to be appropriate or necessary. For example, the 

Model makes several declaratory statements regarding a financial institution's information 

practices which may or may not be true. The Model makes statements such as "[ w ]hen you close 

your account, we continue to share information about you according to our policies," "[t]he types 

of personal information we collect and share depend on the product or service you have with us," 

and "[ w ]e also collect your personal information from others, such as credit bureaus, affiliates, or 

other companies." These statements, and several others, may or may not be true depending on 

the financial institution or the product offered. A financial institution should have the ability to 

state that the information collected "may" vary depending on the product, for example. 

A financial institution may also need to explain features of its information practices that are not 

currently included in the Model. For example, it is common for a financial institution to have 

multiple privacy policies depending on the financial product in question. As another example, a 

jointly marketed financial product may have a privacy policy applicable to both financial 

institutions that is different from the privacy policy each institution delivers to its other 

respective customers. The Model does not appear to give financial institutions the ability to 

explain the limited applicability of a specific privacy policy in these circumstances. Similarly, 
Office of the Comptroller of the Currency 

Ms. Jennifer Johnson/Board of Governors of the Federal Reserve System 

Mr. Robert E. Feldman/Federal Deposit Insurance Corporation 

Regulation Comments/Office of Thrift Supervision 

Ms. Mary Rupp/National Credit Union Administration 

Federal Trade Commission 

Ms. Nancy M. Morris/Securities and Exchange Commission 

Ms. Eileen Donovan/Commodity Futures Trading Commission 

May 29,2007 

Page 13 

financial institutions oftentimes rely on consumer consent in connection with disclosures ofNPI 

to third parties, such as co-brand partners. A financial institution should be able to explain the 

scope ofthe consumer's consent as part of the Model. The inability to customize the Model in 

these and other ways will serve as a significant disincentive to financial institutions using the 

Model if they need that flexibility. 

Ability to Modify for Use by Diversified Financial Institutions 

The Agencies specifically state that the Model could be used by "a group of financial holding 

company affiliates that use a common privacy notice." However, the SEC has provided text that 

differs from the other Agencies' text, yet no Agency will allow for deviation from its text 

without sacrificing the protection of the safe harbor. It would be impossible, therefore, for a 

diversified financial institution such as Wells Fargo that has both a broker-dealer and a bank to 

provide the same privacy policy to all consumers. We urge the Agencies to grant a safe harbor 

to a financial institution that uses any text offered by any Agency in connection with its use of 

the Model. Similar issues exist with respect to insurance entities subject to state privacy 

disclosure requirements. Unless sufficient flexibility is granted, many diversified financial 

institutions will not be able to use the Model to deliver a single privacy notice to customers of 

different business units. 

Brevity 

As noted above, Wells Fargo strongly believes that financial institutions should be given the 

option of providing a single-sheet GLBA notice to consumers. We believe that this goal is 

realistic, especially given the unused space in the Model as it is proposed. Not only is there 

significant empty space that could be eliminated without sacrificing the clarity ofthe Model, but 

there are also significant amounts of information that are not necessary to comply with the 

GLBA or the GLBA Regulations. 

For example, the following portions of the Model content are not required under any law or 

regulation: 

• The "FACTS" title line on each of the pages; 

• The information in the "Why?" box; 

• The information in the "How?" box; 

• The joint marketing disclosure for financial institutions that do not engage in joint 

marketing; 

• The FCRA affiliate-sharing disclosure for financial institutions that do not share 

consumer report information with affiliates; 
Office of the Comptroller of the Currency 

Ms. Jennifer Johnson/Board of Governors of the Federal Reserve System 

Mr. Robert E. Feldman/Federal Deposit Insurance Corporation 

Regulation Comments/Office of Thrift Supervision 

Ms. Mary Rupp/National Credit Union Administration 

Federal Trade Commission 

Ms. Nancy M. Morris/Securities and Exchange Commission 

Ms. Eileen Donovan/Commodity Futures Trading Commission 

May 29,2007 

Page 14 

• The "[f]or nonaffiliates to market to you" disclosure for financial institutions that do not 

share NPI with third parties for that purpose; 

• The information in the "Contact Us" box; 

• The information in the "How often does [financial institution] notify me about their 

practices" box; 

• The information in the "Why can't I limit all sharing" box; 

• The information in the "Affiliates" box for financial institutions that do not share NPI 

with affiliates; 

• The information in the "Nonaffiliates" box for financial institutions that do not share NPI 

with nonaf:filiates; and 

• The information in the "Joint marketing" box for financial institutions that do not share 

NPI pursuant to joint marketing agreements. 

We understand that this information may have value both to consumers as well as to financial 

institutions. For this reason the information should be optional. We believe that financial 

institutions would be more likely to include such information in the Model if the information did 

not result in a disclosure of more than one sheet, but some financial institutions may still choose 

to include those disclosures even if doing so might require a second sheet. Alternatively, some 

institutions might elect to include other information- such as that now provided by Wells Fargo 

in its privacy notice (see above at page 4). 

We also note that it is not necessary to require that the opt-out form be on a separate page. It 

could be included as a tear-off portion of the same sheet as the rest of the privacy policy, as 

many financial institutions do today in full compliance with the law. As shown in Exhibits A, B 

and C, it is possible to include a tear-off opt-out form on a single-sheet notice without removing 

any of the required text. Indeed, many financial institutions simply do not accept opt outs by 

mail. 

Branding 

The Proposal allows financial institutions the ability to use "spot color" on the Model form and 

to include "a corporate logo on any page of the notice, so long as it does not interfere with the 

readability of the model form or the space constraints of each page." Financial institutions 

should have broader flexibility so that the Model notice may include colors, markings, logos, and 

other visual effects consistent with other communications from the financial institution. So long 

as these branding mechanisms do not interfere with the disclosures provided, we do not believe 

the Agencies should limit a financial institution's ability to customize the appearance of the 

Model. 
Office of the Comptroller of the Currency 

Ms. Jennifer Johnson/Board of Governors of the Federal Reserve System 

Mr. Robert E. Feldman/Federal Deposit Insurance Corporation 

Regulation Comments/Office of Thrift Supervision 

Ms. Mary Rupp/National Credit Union Administration 

Federal Trade Commission 

Ms. Nancy M. Morris/Securities and Exchange Commission 

Ms. Eileen Donovan/Commodity Futures Trading Commission 

May 29,2007 

Page 15 

Other Issues 

Repeal' of Existing Safe Harbor and Sample Clauses 

The Agencies propose to repeal the Sample Clauses and their safe harbor status in the GLBA 

Regulations one year after a final rule is adopted. We believe the Sample Clauses and the 

existing safe harbor should be retained. Although Congress directed the Agencies to develop "a" 

model form as part of the Financial Services Regulatory Relief Act of 2006, it did not direct the 

Agencies to make it "the" model form, nor to repeal any existing safe harbor. Many financial 

institutions will not be able to use the Model absent significant revisions to it, so a repeal of the 

current safe harbor will leave such financial institutions with no meaningful guidance or legal 

certainty with respect to their GLBA privacy notices. Not only would this result in unnecessary 

uncertainty at the federal level, but financial institutions could also face significant difficulties at 

the state level ifthere is not a widely accepted standard with respect to adequate GLBA privacy 

policies. 

Even if the Agencies eliminate the existing Sample Clauses and safe harbor, we believe the 

Agencies should clearly state that they will not view failure to use the Model as evidence of 

noncompliance with the GLBA Regulations. The Agencies note in the Proposal, for example, 

that they are granting a year for continued use of the Sample Clauses "for compliance purposes." 

Although Wells Fargo appreciates that the Agencies are not proposing to delete the Sample 

Clauses immediately, we are concerned with the implication that financial institutions must cease 

use of the Sample Clauses in order to be in compliance with the GLBA Regulations after the 

one-year transition period. We agree with the Agencies' existing views that a financial 

institution can comply with the privacy policy notification requirements of the GLBA 

Regulations through use of the Sample Clauses. We are unaware of any developments that 

would change this view, and we believe it would be capricious for the Agencies to grant the 

Sample Clauses safe harbor status one day and view them as evidence of noncompliance literally 

the next day. 

Use of Social Security Numbers 

The Agencies also request comment as to whether financial institutions "need [the consumer's 

account number, Social Security number, or other personal information] in order to process optout requests, or would the customer's name and address alone, or the customer's name, address, 

and a truncated account number for a single account, be sufficient to process opt-out requests, 

including for customers with multiple accounts at the same institutions?" In short, financial 

institutions should continue to be permitted to request Social Security numbers or any other 

reasonably necessary information in connection with an opt-out request. 
Office ofthe Comptroller of the Currency 

Ms. Jennifer Johnson/Board of Governors of the Federal Reserve System 

Mr. Robert E. Feldman/Federal Deposit Insutance Corporation 

Regulation Comments/Office of Thrift Supervision 

Ms. Mary Rupp/National Credit Union Administration 

Federal Trade Commission 

Ms. Nancy M. Morris/Securities and Exchange Commission 

Ms. Eileen Donovan/Commodity Futures Trading Commission 

May 29,2007 

Page 16 

A consumer that provides only a name and address may or may not provide sufficient 

information to fully and correctly implement an opt out. For example, the name provided by the 

consumer on the opt-out form may or may not match the name on any given account depending 

on whether the consumer lists his/her name on the opt-out form exactly as it appears in the 

financial institution's records. The same is true for an address. This is especially difficult if 

there are two people with the same or similar names at the same address. 

While an institution may in some circumstances be able to use the last four digits of an account, 

in conjunction with a name and address, to implement an opt out on a single account, Wells 

Fargo, like most institutions, applies opt outs to all accounts of a given consumer. There simply 

must be a unique identifier available to the financial institution for it to implement opt outs 

across multiple accounts. This is also true for organizations such as Wells Fargo that implement 

opt outs across the family of companies. 

Conclusion 

Wells Fargo strongly urges the Agencies to develop a Model that will provide consumers with 

clear, concise, and succinct GLBA privacy policies. In order to achieve this goal, however, the 

Agencies must develop a Model that a large number of financial institutions are willing to use for 

large numbers of accounts. We believe the proposed Model has material shortcomings that will 

hinder its widespread adoption by financial institutions. We hope the Agencies will consider the 

comments they receive, engage in additional consumer testing involving alternatives that are 

likely to be adopted by financial institutions, and propose a new Model for additional feedback. 

Again, we thank the Agencies for the opportunity to comment on the Proposal and the 

Model. Please do not hesitate to contact the undersigned if you have any comments or questions, 

or ifWells Fargo may be of further assistance in this matter. 

Sincerely, 
+ 

E 

~ 

' 

' 

~ 

;;! 

!! 

a 

~ 

~ 

~ ~~ .:!® 

>- 0~ 0)0 

~~ "'u -"' Qi .::: 

5:ct 

'2 ~ -o ~ 

~-~ ~ ... c::: ::I ~ 0.. ~ <0 ..cE§ do·"!! 8t; .a -g., 

~a ~ ~ ~ ~ ~ E ~ ~ c.§ I! .2 .2 ~ 

<lJ 

!.... 

::J a 

0 c <lJ 

r .Q V) 

!.... 

0'1+-'"0 

c C1J c ·- E ro c..~.. 

(1)0~ 

<lJ ~ C1J 

~.sV) 

- ::3 -~ 0 ·3 -s g -~ ~ o a ~ 

~{ j · ~ ~ ~ P n:gl! n 

o_ E-c"' UI~ 0 ~g-~ 0:; ~ 0 ""~ s E ~ ~ 8 ~~ c~oo~ ~~..,~~:S~g 

~ ~ ~ .[ g' ~ :g -~ :·;a §:~~8.~ 

v c .,a~ijo 

lJ~ ~~er::!: 1: ·;;;ecE 

g~g ~~§.~-~ ~ -5 5 • • • .. c u 

~ 2 ~ 

c ~ 0 ~ 2 3 ~~a~ >.. ~ c::.S. .... \II~"' o :) a "' 2~ ~ 5 c:~ 112:1°~ ~ 

E E E • 0 0 0 vuu 

I! .. 

c 

. .,. 

~ 

.<> 

., 

~ _; ~ 

" > iE w <( 

~ Q.U 

·- c -5 ~ 

~g 

~ c 

c!! 

0 .. 

h 

8 ~ li'~ 

1:1: 

~ 3 0~ 

~~ t ·c e ·c: "-Q.Cc. .. E 8 E 8 0 8 

~ ~ c 

0 

z 

c 

~ ~ 0 

~ :s. ~ 

~ ~ g ~~g 

~~~ 

·i ~ -~ 

ji~ ~:s.g; 

~ a·;: c ~ ~ ~ -g l ~!: ~ 

~ ~ ~ ~ • 

By telephone: 1-600-XXX-XXXX - our '!'enu will prompt you 1hrough your choices 

On the web: www.weUsfarqo.com/privacy 

By mail: mark your choices below, fill in and send form to: 

Wells Fargo 

Privacy Department 

PO Box 00000 

City, State 00000 

:<! ~ ~ "8 '6 cE ~ ~ ~ ·d 'g 

~iii "" t ~ -~ t: ]i s 

i ~ & ! Q; go 

~~ ~ ~ 

~! ~ ~ l ~£ s ~ e !.~ § ~~ ~ c ·;: 0 8 o a~ • ~ ~ ll 

"' c 'i 

-!! 

E 

c 

:g 

Unless we hear from you, we <an begin sharing your information 30 days ftom the date of this letter. 

Howeve r, you can contact us at any time to limit our sharing. 

your account. 

Check any/all you want to limit: 

{Seepag< l} 

0 Do not share information about 

my creditworthiness with yo ur 

affiliates for their everyday 

business purposes. 

0 Do not allow your affiliates to use 

my personal information to market 

to me. (f will receive a renewal noric.e lor tllis use lor markering in 5 ye<Ys.) 

0 Do not share my personal information 

with nonaff1liates to rnarket their 

products and services to me. 

Mail to: 

Wells Fargo 

Privacy Oepar tmem 

PO Bo• 00000 

City, State ooooo 

-ir--

I + 
+ 

llOUU KJ.T XXXX VEil3:9JSll MXT 6784 5/10/07 

I 

F A C T S 

VJh i!t ? 

HO\'J? 

WHAT DOES WELLS FARGO 00 

WITH YOUR PERSONAL INFORMATION? 

f•nanci.ll companies choose how th~ stwre your persona l informuion. Federal law 

giws consumers the right to limit some but not .all sharing. Feder<~llaw als.o require-s us 

10 _.)IOU ho.ww. c.arllrcl, ~and PfOMCt your per-sonal infonnation..Piease read this 

notice c•uny to Uftd«s.t~ wtwtt • do. 

Tht t')lpK tiJ pet'SOnoll ~w ~ct ilnd share depend on the product or 

s..Mc::e 'lt:M ~ wilh us. l'hi$ inf"Of'ft'W.tton can inclucko: 

• Social ~ecurlty number and income 

• account balances and payment hinory 

• cre-dit history and credit scores 

When you c~c your account. we continue! to share informo1tion about you 

according to our policies. 

AU financial comp41nies need 10 share customers' personal informition lo n.m their 

evetydily business-to process 

transac1ions, maintain customer accounu, and repon 

to credit bureaus. In the section below. we list the reasons financial companies un sh;:u~ 

their customet"s' personal information; the rcasom Wells: fargo chooses to sl1are; and 

whether you can limit this sharing. 

Rt'usom we can o,hart- your pt•rsonJI.nform at•on Oops V.'t>ll'> Fnrgo o.,hare? Can you hmlt this s.ha rmg' 

,._.., ~----s purposes-- to ptGitftJ 'fO'Jifb~ions. maintain your 

Kc.ounl and tep0r1 to <'fed it bureaus 

For our marketing purpo$Hto offer our products and services to you 

For joint marketing with other finandiil companies 

For our ~ffifiiltts' fN«yday business purposHinfOI'mation about your transactions o.nd experience\ 

For our affiliate~' eYMydoly business purposes-

information about your creditworthine11 

For our ;affiliates to market to you 

For nonaffiliates to m;arket to you · 

Yes Yes 

Yos 

Yes 

Yes 

Yes 

Yes 

Contact Us Calll-80G-XXX

·XXXX or go to www.wellsfargo.com/privacy 

No 

No No 

No 

YH Ch«Jr.yourchoic~.p 1) 

Yes (Chedcyot.~rchoices.p.2) 

Yes {Chtdqourchoica,p..l) 

Shanng practices H.ow often does Wells Fargo notify m~ about We must notify 

you about our sharing praaices 

their practices? when you open an account a nd each year while 

you are a customer. 

How does Wells Fargo protect my To protect your personal information from 

personal information? unauthorized access and use, we use security 

measures that comply with federal law. These 

measures Include computer safeguards and 

secured files and buildings. 

How does Wells Fargo collect my We 

collect your personal information, for example, 

personal information? when you 

• open an account or deposit money 

• pay your bills or apply for a loan 

We 

oth~rs, also 

• 

such 

collect 

use 

as 

your c

you

red

cr

r 

edit 

personal 

bureau it or des,. 

bi

info

affi

t ca

lirma

rd 

tes. 

ation 

or 

f

other rom + 

companies. 

Why can't I limit all sharing? Federal law gives you the right to limit sharing 

only for 

• affiliates' ~veryday business purposesinformation about your creditworthiness 

• affiliates to market to you 

• nonaffiliates to market to you 

State laws and ind ivkluat companies may give 

you ~itional rights to limit sharing. 
+ 

110tU7 leiT llLD VJ:U SIU/01 hU AN h9"' l +-

WHAT DOES WELLS FARGO 00 

W1J1i YOUR PEASONAL 1NfORMATION7 

rll'litnd.lc~cMoie~ ~rowtper~lirlonutiGn.fedtf• 

ltw «w~tutntr11htrighliD ltnit wmt bl.lfAOI.VIIhM~~oll Uwo~ho 

~Itt e _.,OU how 'Nt COitctJNft,lnd l)fO&I<t yow prtt1oe11NI Wotmltio". 

~~-Chi~ noiU <.nfuiJ.., ..-s...mnd wNI..w do. 

h IY'P*S oi,_SONJ,.rOfmtiion - colttt and l.hlltckptitdon the.procb:t 

• ~TYke J'OU tw-"llllo'ilfl Ul.fm fnb~oltiol"t (., iMIUdt: 

• Soc~Stiw~pwmbtrJAd\oeomt 

• «<~t~lf'dJMYIIW!"I hi~l«)' 

• at<it Nllory .w Cltdit lt.Offt 

W.1wfl"f(N clowyo.. oll.( OUftt,.WI tOft~ to·S!urlt lnlarrtWtiun .ibouf~ 

McordWJQIOOWpol<iott.. 

.llfin..OO.I~rwed·l .... t"OAtomfll'PtJ~In(OrmolfiOntoRin 

.,_. ~~bus:~nHs-fOprOCH6 llo~~tJKt:iclt\l.INinc.-.. tldt~ -.c-a, 

ll'ld~toulllllk~iiiiS.Ifthwctionbeklw, WII'~t"'r.ol~~ .. 

~•<'M~rhHr~us~.,, l"fwn.lin~I.Oon;hte~l 

well. rarv9choowl• "*• llwfwhtthtr10Vc::M~ImittNI th..Vinf. 

...... ~~~JWPOSf'SIOJ"'CeH'JO\Ifttan5oi<UOnl,mafntWI~ 

«.cOUfti.Md Npodtoc.-burew. 

For our ru~e1 Jl9p~ltO o~r our prOduct• ;,nd ~rvices to )'0\1 

For jOint m.rbdn9 with other fi~WKI.I.I 

companies 

.... No 

YK No 

y., ,., fof our•ffiloltet'ft"''rycl¥fbwinPI• pvrpc»eSinlonn~tlon About your tf.)Mo~~tdom •nd v .. No 

For our •Hili•teJ" f!Ytf'/d"'! b\lsinMJ purpows:-

info~tion about )'OUt" cttditwonhiMU y,. 'm tcltotd. yo.Jr choi«J.p.ZJ 

y., Ye~ (CII«k)OUJ't:ho;cn,p.1} 

v .. Ye-s (Cht"Q. yout chokn, p.lJ 

How often cto.JWelbFM!JO notify.,_. Wt m~• noUI'y )JOUiboucO\H'it..r\ng ~~swhtn you 

abol.!t ~tirpractice.s1 open an accountandochyt:ar "f'h"fe)'OU•I"l' a customer. 

Howd~s Wtfh FM90 protKt my 

pffSOnal info!'TNUonl 

KowdM"SWelh f..-go collrKtmy 

p~rtonN lnfonn•tionP 

Why an't I limit allharWjl 

NouffillattJ 

Jolnl~etlng 

tf ,~ll {'l.l!l, 11 YT 1 <J 

ly •lephone~ 1-100-XXX·XXXX 

ow INnU ll'lift prompt 'tOio' t1vooth 

.,OIM"Ctlok.ti 

o,.,., .. _ _ wdlt':'lllgo..comtpttv.xy 

a oo~~Wonnation.llbout 

mr<rH!t..o."*wsswith'f'IJW 

.--.'" ror NJr ...,.-ry6,o ~pwpow .... 

(J DoltOI*Iow'fVV'I.IIatfl.IDU.~ 

-t ~'nlotmatlofl to tiwke« 

IOfM frwilllfttlw•~...,.t!Ofia 

lot iNJ.-ItHm~•S)IIQn..} 

!] OorotWw~'"'~~­

..., noNtmi.ll8 ·~-· ltw-ir pwductl and wnk"tlR:I me. 

To pro let! ya~..:r pei'IONII i nlofm.ltiOn from ul'lolluthorin-d 

o~ec~u and u~. ~ UM St"Curity me•uuts tNt com~ wilh 

ftder.11llaw. Thne me~urtilndude rompl.l ~ wt.gu.rds 

and St"CI.!red ftlei .11od bUidiog1. 

Wf!coftKtyour J)':'f~linf~~forex mp4t.whttlyou 

• opertM ICCOIJnl Olfdfopolif: ~ 

• p.yyourb!IIJor-w~fot"li lo.llf'l 

•ll~'fOVIUeditorchbitcW 

'IH.IMCoiiKI'f0VtP""~Infomvtion fromothtft,1 lH 

<'"1f bun ~~1l'-te1.CW oOWf ompo~nin. 

Ftdertllilw~"}OUftwnghf ~ linit INfinvon~far 

• tffir.a~· ~ bu~Mws• purpcnu-\nlomw.rion 

.11bou1 ~ <I"'Mt'*Otihintu 

IOmark.et~)OU 

• nONI6ll.tM>.1 eo na;w\,et to )QI 

S~lt~andlndlvldu~c~IN)'~}'OU~I 

rights to lmfC 'NriniJheactiOnt~~·tt.M(wcornp.nlln to riln...., 

~JI..ndrNNfeCYMOtneJ~ Mt'l ti 

• ptom.Wig lr~SKUoAJ,f"'\oo~_... at.uflllfl.9 Wf'M.~ts 

• prQYiding ttter.N~ 10 ,, .. lai~ ... , 

• reip<)nd~ 1111 C'WI't Ortdtn and leC)II irM'tUg. tirc~u 

Com~ rdilltd byC"OmlfWft ownen~OJ cot~eol 

Thrty an b. tiNncll!llnd f'Of\l'iNnd•l<otnp.ar1it'l. 

• OclomJirftl'f"<Ju~~Mf/t·

~~

N.~IXlmC 

MIO'!Of 0rMnit!Mir'lln(~ OnJ/'IOr.· 

fi/"VJtldoi ~~AKhllfScrtwnMarUf~ tnc"Y· 

(omp.;v!its ~~ rtlafed by common 0"-Nnenhip 01 contml 

Thrty 011 tMo An,lrKi.llt .1111d nonfinHl(i., companiet. 

lfor.G/UiornwtUwztfwiflt(omi>lcl.dt'rr~ 

co~ llrdn(tcor~tlt«.tmrJdwting 

tompo~andfJ!Mpf'Oflt~ "' 

Afotm.ll.~g~l bef\Vell!nnon.#IN~fiNnda <ompM~it's 

ll"wttopthtr markltl~ produ<ts or5-'tf'lic.,lc>W"')U. 

• Ou..}'Mt~IW'fpatf~ nc.,..Jdr rrJitUitd 

ccmportln. 

lymiiU ukyGU~ chok.~JIKktw ftll in .lllld !o<!ndiOtm to: 

Vloelk r.tllJo. Priv.tey Cep unenlPO 9o-.. 00000 

C1ty, Sr~te 00000 

Un~u we hHr frorT'I )'01.1. we un be9in Jh.Jring -,our 

l11fonMtion JO days from~ dol(t ol tt\.iJ .. ttcr.HOWf'ier, 

)'0\'Ci n conll.,ttu at any timeo to limit our in<). 

MM\to: 

WdkruCJQ 

PriY.Ky~ l 

PO SoJ1 00000 

Ot)l. sr.ue 00000 

Pr\ntsK 

...... 

bsere6(rl6. 

+ 
+ 

1109267 MI<T XXXX VERI 5/10/07 8:37 AM Page I+ 

F A C T S 

Why? 

How? 

WHAT DOES WELLS FARGO DO 

WITH YOUR PERSONAL INFORMATION? 

Financial companies choose how they share your personal information. Federal 

law gives consumers the right to limit some but not all sharing. Federal law also 

requires us lo tell you how we collec~ share, and protect your personal information. 

Please read this notice carefully to understand what we do. 

The types of personal information we collect and share depend on the product 

or service you have with us. This information can include: 

• Social Security number and income 

• account balances and payment history 

• credit history and credit scores 

When you close your account, we continue to share information about you 

according to our policies. 

All financial companies need to share customers' personal information to run 

their everyday business-to process transactions, maintain customer accounts, 

and report to credit bureaus. In the section below, we list the reasons financial 

companies can share their customers' personal information; the reasons 

Wells Fargo chooses to share; and whether you can limit this sharing. 

Re.;sons we can share your personal information Does Vlells Fargo share? Can you limit this sharing? 

For our everyd'aybuslness purposesto process your transactions, maintain your Yes No 

account, and report to credit bureaus 

For our marketing purposesto offer our products and services to you 

Yes No 

For joint marketing with other financial Yes No companies 

For our affiliates' everyday business purposesinformation about your transa·ctions and Yes No 

experiences 

For our affiliates' everyday business purposes- Yes Yes (Check your choices, p. 2) information about your creditworthiness 

For our affiliates to market to you Yes Yes (Check your choices,p. 2) 

For nonaffiliates to market to you Yes Yes (Check yourchoices, p. 2) 

Contact Us Calll-800-XXX-XXXX or go to www.wellsfargo.com/privacy 

MKTXXXXVER I (4·07 109267) 

Prints K 

Bleeds 

-+ 
+ 

1109267 MilT XXXX VER1 S/10/07 9 : 37 AA Page 2 + 

F A C T S WHAT DOES WELLS FARGO DO 

WITH YOUR PERSONAL INFORMATION? 

Sharing practices 

How often does Wells F;ugo notify me 

about their practices? 

How does Wells Fargo protect my 

personal information? 

How does Wells Fargo collect my 

personal information? 

Why can't I limit all sharing? 

Defrmtions 

Everyday business purposes 

Affiliates 

Nonaffiliates 

Joint marketing 

If you want to limit our sharing 

Contact us 

By telephone: 1-800-XXX-XXXXour menu will prompt you through 

your choices 

On the web: www.wellsfargo.com/privacy 

your account. 

Check any/all you want to limit: 

(Seepage 1) 

0 Do not share information about 

my creditworthiness with your 

affiliates for their everyday 

business purposes. 

0 Do not allow your affiliates to use 

my personal information to market 

to me. (I will receive a renewal notice 

for chis use for marketing in 5 years.) 

0 Do not share my personal information 

with nonaffiliates to market their 

products and services to me. 

We mu$t notify )'QV about our sharing practices when you 

open an account and each year while you are a customer. 

To protect your personal information from unauthorized 

access and use, we use security measures that comply with 

federal law. These measures include computer safeguards 

and secured files and buildings. 

We collect your personal information, for example, when you 

• open an account or deposit money 

• pay your bills or apply for a loan 

• use your credit or debit card 

We also collect your personal information from others, such as 

credit bureaus, affiliates, or other companies. 

Federal law gives you the right to limit sharing only for 

• affiliates' everyday business purposes-information 

about your creditworthiness 

• affiliates to market to you 

• nonaffiliates to market to you 

State laws and individual companies may give you additional 

rights to limit sharing. 

The actions necessary by financial companies to run their 

business and manage customer accounts, such as 

• processing transactions, mailing, and auditing services 

• providing information to cledit bureaus 

• responding to cOJ.1rt orders and legal investigations 

Companies related by common ownership or control. 

They can be financial and nonfinancial companies. 

• Our affiliates include companies with a Neptune name; 

financial companies, such as Orion Insurance, and nonfinancial companies, such as Saturn Marketing Agency. 

Companies not related by common ownership or control. 

They can be financial and nonfinancial companies. 

• Nonaffiliates we share with can include mortgage 

companies, insurance companies, direct marketing 

companies, and nonprofit organizations 

A formal agreement between nonaffiliated financial companies 

that together market financial products or services to you. 

• Our joint marketing partners include credit card 

companies. 

By mail: mark your choices below, fill in and send form to: 

Wells Fargo, Privacy Department. PO Box 00000 

City, State 00000 

Unless we hear from you, we can begin sharing your 

information 30 days from the date of this letter. However, 

you can contact us at any time to limit our sharing. 

Mail to: 

Wells Fargo 

Privacy Department 

POBoxOOOOO 

City, State 00000 

-+