ffACLI 

Received CFTC 

Records Section 

Financial Security. For Life. t/~/!J7 Roberta Meyer 

Vice President Et Associate General Counsel 

(202) 624-2184 t (202) 572-4808 f 

robbiemeyer@acli. com 

May 20,2009 

Via Electronic Submission 

Mr. Robert E. Feldman 

Executive Secretary 

Federal Deposit Insurance Corporation 

550 17th Street, N.W. 

Washington, DC 20429 

Attention: Comments 

Federal Trade Commission 

Office of the Secretary 

Room H-135 (Annex C) 

600 Pennsylvania Avenue, N.W. 

Washington, DC 20585 

FTC File No. P034815 

Regulation Comments 

Chief Counsel's Office 

Office of Thrift Supervision 

1700 G Street, N.W. 

Washington, D.C. 20552 

Attention: OTS-2007-0005 

Eileen Donovan 

Secretary ofthe Commission 

Commodity Futures Trading Commission 

Administration 

Three Lafayette Centre 

1155 21 51 Street, N.W. 

Washington, D.C.20581 

. ~-·· ............. --............. . '!··.-- .. · .•.. 

c· p·r·c~ 

OFFICE OF THE SE.CRETARlAT 

ZD09 PlRV 22· PM ~ 19 

Ms. Jennifer Johnson 

Secretary of the Board 

Federal Reserve System 

201

h Street and C Streets, N.W. 

Washington, DC 20551 

Docket No. R-1280 

Office of the Comptroller of the Currency 

250 E Street, S.W. 

Mail Stop l-5 

Washington, D.C. 20219 

Docket Number OCC -2007-0003 

MaryRupp 

Secretary ofthe Board 

National Credit Union 

1775 Duke Street 

Alexandrian, Virginia 22314 

Proposed Rule Part 716 

Re: File Number S7-09-07 

Ladies and Gentlemen: 

The American Council of Life Insurers ("ACLI") is pleased to provide you with its comments it 

has filed with the Securities and Exchange Commission (the "Commission") in response to the 

Commission's reopening of the period for public comment on proposed amendments to 

American Council of Life Insurers 

101 Constitution Avenue, NW, Washington, DC 20001-2133 

www.acli.com 
Regulation S-P, 1 which implements the privacy provision ofthe Gramm-Leach-Biiley Act, 

originally published in the Federal Register on March 29, 2007.2 

ACLl requests that its comments be included in your record concerning your request for 

commeQtS on the Gramm-Leach-Biiley Proposed Model Privacy Form. 

Attachments 

1 74 Fed. Reg. 17925 (April 20, 2009). 2 72 Fed Reg. 14940 (March 29, 2007). 

American Council of Life Insurers 

101 Constitution Avenue, NW, Washington, DC 20001·2133 

www.acli.com 

Sincerely, 

Roberta Meyer 

2 
ffACLI 

Financial Security. For life. 

Roberta Meyer 

Vice President Et Associate General Counsel. 

(202) 624-2184 t (866) 953-4096 f 

robbiemeyer@acli. com 

May 20, 2009 

Elizabeth M. Murphy 

Secretary 

Security and Exchange Commission 

100 F Street, N.E. 

Washington, D.C. 20549 

Re: File Number 57-09-07 

Ladies and Gentlemen: 

The American Council of Life Insurers ("ACLI") is pleased to provide comments to the 

Securities and Exchange Commission (the "Commission") in response to the Commission's 

reopening of the period for public comment on proposed amendments to Regulation S-P, 

which implements the privacy provisions of the Gramm-Leach-Bliley Act ("GLB Act), 3 

originally published in the Federal Register on March 29, 2007. 4 ACLI is the principal trade 

association of life insurance companies, whose 340 life insurance companies account for 93 

percent of the industry's total assets, 94 percent of life insurance premiums and 94 percent 

of annuity considerations. ACLI member companies are also major participants in the 

pension, long term care insurance, disability income insurance, and reinsurance markets. 

In addition, many of ACU member companies manufacture variable annuities and variable life 

insurance products that are registered under the federal securities laws and. distributed 

through broker-dealers. Over 50% of FINRA's 653,000 registered representatives work for 

broker-dealers affiliated with life insurance companies. Some life insurance agents also 

operate as registered investment advisers. Licensed insurance agents that sell variable 

insurance products are subject to the requirements of both the federal securities laws and 

state insurance laws. The proposed amendments to Regulation S-P, therefore, will have a 

significant and distinct impact on life insurers, their distributors, and their agents. 

LIFE INSURANCE INDUSTRY'S INTEREST 

The Financial Services Regulatory Relief Act of 2006 (the "Regulatory Relief Act") amended 

section 503 of the GLB Act to direct the Federal agencies, specified in GLB Act Section 

3 74 Fed.Reg. 17925 (April20, 2009) 4 72 Fed.Reg. 14940 (March 29, 2007) 

American Council of Life Insurers 

101 Constitution Avenue, NW, Washington, DC 20001-2133 

www.acli.com 

3 
504(a)(1 )

5 ("Agencies"), to jointly develop a model form ("Model Form") that may be used at 

the option of financial institutions to provide initial and annual privacy notices under section 

503 of the GLB Act. 6 7 The Regulatory Relief Act further amends section 503 of the GLB Act 

to provide that any financial institution that elects to use the Model Form developed by the 

Agencies shall be deemed to be in compliance with the disclosures required under that 

section. 8 

Section 503(a) of the GLB Act requires financial institutions to provide initial and annual 

privacy notices to customers. 9 Life insurers are financial institutions under the GLB Act 

because they are engaged in financial activities as defined in§ 4(k) of the Bank Holding 

Company Act. 10 Accordingly, if a life insurer uses the Model Form developed by the Agencies, 

as provided for in the amendments to the GLB Act, made by the Regulatory Relief Act, the 

insurer will be deemed to be in ·compliance with the initial and annual disclosure 

requirements of the GLB Act. Moreover, many life insurers are affiliated with other financial 

institutions, such as broker-dealers regulated by the SEC and depository institutions regulated 

by the Federal bank supervisory agencies. The Agencies' proposed Model Form, therefore will 

directly affectACLI member companies. Also, many of these affiliated companies find it 

efficient to send customers one uniform privacy notice that reflects the privacy policies of 

the affiliated group of companies. For these reasons, ACLI believed it was appropriate to 

comment on the proposed Model Form, originally published in the Federal Register on March 

29, 2007. These comments were set forth in an ACLiletter to the Agencies, dated May 29, 

2007, a copy of which is attached. For the same reasons and for the additional reasons 

explained below, ACLI believes it appropriate to respond to the Commission in connection 

with its reopening of the public comment period relating to the Model Form. 

CONCERNS WITH THE QUALITATIVE TESTING 

The Commission indicates that it is reopening the comment ·period before final action is taken 

on the Model Form to provide all interested parties an opportunity to comment on the 

additional quantitative testing documents placed in the comment file for the proposed rule. 11 

Of critical importance to ACLI member life insurance companies, our review of the "Consumer 

Comprehension of Financial Privacy Notices -- A Report on the Results of the Quantitative 

Testing" (the "Report on the Results of the Quantitative Testing") and the "Mall Intercept 

Study of Consumer Understanding of Financial Privacy Notices: Methodological Report" (the 

"Mall Study Report") revealed that the documents tested and the analysis performed focused 

almost exclusively on banks and their customers. The sample notices were bank notices; 12 

5 15 U.S.C. Section 6804(a)(1) (Securities and Exchange Commission, Comptroller of the Currency, 

Board of Governors of the Federal Reserve System, Federal Trade Commission, Office of Thrift 

Supervision, Federal Deposit Insurance Corporation, National Credit Union Administration, and the 

Commodity Futures Trading Commission) 6 Section 728 of the Financial Services Regulatory Relief Act of 2006, Pub.L. 109-351, 120 Stat. 1966 7 15 U.S.C. Section 6803(e)(1 ). 8 15 U.S.C. Section 6803(e)(4) 9 15 U.S.C. Section 6803(a) 10 12 U.S.C. Section 1843(k)(4)(B) 11 74 Fed.Reg. 17925 (April29, 2009) 12 Mall Intercept Study of Consumer Understanding of Financial Privacy Notices: Methodological Report, 

Appendix C: Model Privacy Notices Used in Testing 

American Council of Life Insurers 

101 Constitution Avenue, NW, Washington, OC 20001-2133 

www.acli.com 

4 
and most of the survey questions related to those sample notices and banks. 13 The sole 

references to insurance companies appear to have been in the sample bank notice forms that 

included an insurance company as an affiliate. There appears to be no evidence of any 

testing to determine how customers of insurance companies would have viewed these sample 

notices. 

ACLI submits that the failure to include insurance company notices and insurance customers 

reflects a significant weakness in the study and its findings, and gives rise to significant 

question as to whether the conclusion, that "the KCG Table rates the highest on a diverse set 

of communication effectiveness measures" 14 would have been true if insurance customers 

had been surveyed. It also gives rise to significant concern as to whether any of the sample 

bank notices tested would be understandable and meaningful to insurance customers, or 

enable them to identify and compare different insurers' and other financial institutions' 

sharing practices, as required under the Regulatory Relief AcL 

Moreover, as indicated above, the overall conclusion that the KCG Table Notice significantly 

outperformed all the other notices, is undermined by the fact that it is not entirely clear that 

the KCG Table Notice significantly outperformed the Sample Clause Notice. This is 

particularly true as a result of the ambiguity as to the outcome in connection with the opt-out 

question, characterized as an "anomaly" on page 12 and discussed a~ain in the "Conclusion" 

on page 17 of the Report on the Results of the Quantitative Testing. 5 Also, while the KCG 

Table Notice generally scored somewhat higher than the Sample Clause Notice, as reflected in 

Table 1, 16 where the KCG Table Notice has a "True low sharing score" of 40.6% and the 

Sample Clause Notice has a score of 25.9%, the KCG Table Notice's·score of 40.6% still is 

relatively low, indicating that most of the respondents, who saw the KCG Table Notice, did 

not provide correct fact-based reasons for choosing the lower sharing bank. 

LIFE INSURERS' UNIQUE INFORMATION PRACTICES 

ACLI continues to believe that the goal of providing financial institutions the opportunity to 

simplify privacy notices is a worthy objective; and we continue to appreciate the 

Commission's and other Agencies' efforts to develop a more meaningful model privacy form, 

as required under the Regulatory Relief Act. A Model Form should facilitate the ability of 

consumers to better comprehend and compare financial institutions' privacy policies and 

practices. 

However, in view of the weaknesses in the findings of the study described above, most 

significantly, the lack of evidence that any of the tested bank forms would be understandable 

and meaningful to the customers of life insurance companies, ACLI strongly urges that, in 

finalizing the Model Form, the Commission and the other Agencies take into account the 

suggestions made in ACLI's May 29, 2007letter, regarding the proposed Model Form, 

13 Mall Intercept Study of Consumer Understanding of Financial Privacy Notices: Methodological Report, 

Appendix A: Final Interview Protocol 14 Consumer Comprehension of Financial Privacy Notices -A Report on the Results of the Quantitative 

Testing, p. 17 15 Consumer Comprehension of Financial Privacy Notices, p. 12 and p. 17 16 Consumer Comprehension of Financial Privacy Notices, p. 9 

American Council of Life Insurers 

101 Constitution Avenue, NW, Washington, DC 20001·2133 

www.acli.com 

5 
published by the Commission and the other Agencies in the Federal Register on March 29, 

2007. 

To enable life insurers to use the proposed Model Form, ACLI believes that the Agencies need 

to take into account the unique aspects of life insurers' information collection and sharing 

practices as well as the fact that life insurers must accommodate various state privacy and 

disclosure requirements, that may differ from the GLB Act requirements. ACLI also submits 

that the privacy notices required under Section 503(a) of the GLB Act should not create 

barriers to affiliated financial institutions working together, in an efficient manner, to 

provide a single uniform notice to customers of all the affiliates. Therefore, ACLI urges that 

privacy notices that accommodate financial institution holding companies, permitted under 

the GLB Act, should be given safe harbor under the Commission's and other Agencies' rules, 

so that life insurers, that are part of diversified financial institution holding companies, are 

permitted to use a single uniform privacy notice, that reflects the privacy policies of the 

affiliated group of companies. 

In view of the above, ACLI again urges the Commission and the other Agencies to permit life 

insurers that use the Model Form with the prescribed format: (i) to make limited 

modifications to the language, by omitting inapplicable provisions, or adding additional 

bullets, boxes, or footnotes; or (ii) to include supplemental materials with the Model Form to 

make their notices accurately reflect life insurance industry's practices and comply with 

state insurance privacy laws, without losing the safe harbor. 

In addition, ACLI urges the regulators to modify certain parts of the Model Form to make 

specific generic changes, generally applicable to financial institutions, to also make the form 

more reflective of life insurance industry practices and state insurance privacy laws. By 

permitting limited modifications and making certain language changes to the Model Form, the 

Agencies will enable life insurers to make use of the Model Form and facilitate the ability of 

life insurers that are part of diversified holding companies to use a single notice, in line with 

the clear intent of the GLB Act. 

ACLI's views regarding parts of the Model Form in connection with which life insurers should 

be permitted to make modifications and our specific recommended language changes are 

explained in detail on pages 4 -12 of the attached May 29, 2007 ACLiletter. ACLI's 

recommended language changes are also reflected in the mark-up of the Model Form, 

attached to the May 29, 2007 letter. 

Under the Commission's and other Agencies· current GLB Act privacy regulations, finanCial 

institutions obtain a safe harbor by using the sample clauses set forth in the regulations. The 

Agencies propose to eliminate this safe harbor after a one-year transition date. As indicated 

previously, ACLI strongly objects to the elimination of the safe harbor for institutions that 

use the notices with the sample clauses -- particularly in view of the weaknesses in the 

conclusion of the study and lack of clarity as to whether the KCG Table Notice really did 

outperform the Sample Clause Notice, as discussed above. 

As the Commission and other Agencies are aware, the GLB Act assigns jurisdiction over 

insurers to the state insurance authorities. A majority of states have adopted laws and 

regulations that are substantially similar to the language adopted by the Agencies in their GLB 

Act regulations. Generally, state regulations provide a safe harbor similar to that provided by 

the Agencies in their current regulations. 

American Council of Life Insurers 

101 Constitution Avenue, NW, Washington, DC 20001-2133 

www.acll.com 

6 
Life insurers and other financial institutions have invested significant resources in fine-tuning 

their privacy notices to comply with the GLB Act, the Agencies' rules, and related state laws, 

where applicable. If the Commission and other Agencies have deemed notices to be in 

compliance with the GLB Act, because they included the sample clauses the Agencies 

developed, it seems that the notices should continue to be deemed to be in compliance --

regardless of the fact that the Agencies have developed a Model Form. 

Moreover, given the fact that use of the Model Form is voluntary, there is no reason why the 

Commission and other Agencies should punish an insurer, or other financial institution, that 

chooses not to use the Model Form. Nor should an insurer be forced to choose between a safe 

harbor under federal regulations and compliance with state privacy laws. In view of the 

above, including the lack of clarity as to whether the KCG Table really did outperform the 

Sample Clause Notice in the study, ACLI again strongly urges that the Commission and the 

other Agencies maintain the existing safe harbor for institutions, particularly life insurers, 

that use notices with the sample clauses. 

PROPOSED CHANGES TO REGULATION 5-P TO CREATE AN EXCEPTION TO THE 

GLB ACT NOTICE AND OPT-OUT REQUIREMENTS 

In March, 2008, the Commission published proposed changes to Regulation S-P, to establish an 

exception to permit disclosure of certain limited customer information to a broker, dealer or 

investment adviser, when he or she. leaves the company to join another organization, without 

the need to provide the customer with notice and an opportunity to opt-out from the 

disclosure. 17 This change will have a significant and distinct impact on life insurers, their 

distributors, and their agents, as explained in ACLI's May 1 Z, 2008 comment letter to the 

Commission, a copy of which also is attached. 

Given the importance and controversial nature of this proposed amendment to Regulation 

S-P, ACLI submits that the Model Form cannot be appropriately finalized until a decision has 

been made as to whether this exception should be adopted. If the exception is adopted, the 

language of the Model Form should be modified to reflect the exception. Some of the 

"boxes" in the proposed Model Form that may need to be modified include the following: (i) 

Reasons we can share your personal information -- For nonaffiliates to market; (ii) Sharing 

practices -- Why can't I limit all sharing; and (iii) Check your choices -- Do not share my 

personal information with nonaffiliates to market their products and services to me. 

Also, if the Commission does decide to adopt the proposed exception, as indicated in our 

May 12, 2008 letter, the ACLI believes that as written, the exception could be misconstrued 

to require a company to disclose the information specified in the exception to departing 

representatives. Accordingly, we again strongly urge that Regulation S-P be clarified to 

indicate that the exception is not intended to impose any requirement that information be 

disclosed to departing brokers, dealers or investment advisers. In addition, we urge the 

Commission to underscore that: (i) in any event, the customer information a company's 

representative may take when departing is governed by the contract between the 

representative and the company; and (ii) a company's disclosure policies and practices may 

be subject to other laws or regulations, such as state GLBA privacy laws applicable to 

17 73 Fed. Reg. 13692 (March 13, 2008) 

American Council of Life Insurers 

101 Constitution Avenue, NW, Washington, DC 20001-2133 

www.acli.com 

7 
insurers, that also govern permitted disclosures by the company. These clarifications are 

particularly important to our member company life insurers that have registered 

representatives that are also licensed insurance agents, subject to the requirements of both 

the federal securities laws and state insurance laws, as well as to obligations and 

responsibilities under contracts between the parties. 

CONCLUSION 

Finally, in view of the efficiencies and desirability of use of a single uniform privacy notice 

that reflects the privacy policies of an affiliated group of financial institutions, and to ensure 

that the Model Form takes into account the needs of all the different types of financial 

institutions, the ACLI urges the Commission to continue to coordinate with the other Agencies 

in the finalization of the Model Form, as required under Section 503 of the Gramm-LeachBliley Act, as amended by Section 728 of the Financial Services Regulatory Relief Act. 

ACLI appreciates and thanks the Commission for the opportunity to comment and the 

consideration of its views regarding the quantitative testing documents and the proposed 

Model Form. If you have any questions, please do not hesitate to contact me. 

Sincerely, 

Roberta Meyer 

Attachments 

cc 

Robert E. Feldman 

Executive Secretary 

Federal Deposit Insurance Corporation 

550 17th Street, N. W. 

Washington, D.C. 20249 

Attention: Comments 

Federal Trade Commission 

Office of the Secretary 

Room H-135 (Annex C) 

600 Pennsylvania Avenue, N.W. 

Washington, D.C. 20580 

FTC File No. P034815 

Regulation Comments 

Chief Counsel's Office 

Office of Thrift Supervision 

American Council of Life Insurers 

101 Constitution Avenue, NW, Washington, DC 20001-2133 

www.acli.com 

8 
1700 G. Street, N.W. 

Washington, D.C. 20552 

Attention: OTS-2007-005 

Eileen Donovan 

Secretary of the Commission 

Commodity Futures Trading Commission 

Administration 

Three Lafayette Centre 

1155 21st Street, N.W. 

Washington, D.C. 20581 

Jennifer Johnson · 

Secretary of the Board 

Federal Reserve Board 

20th and C Streets, N.W. 

Washington, D.C. 20219 

Docket No. R-1280 

Office of the Comptroller of the Currency 

250 E Street, S.W. 

Mail Stop 1-5 

Washington, D.C. 20219 

Docket Number OCC-2007-0003 

Mary Rupp 

Secretary of the Board 

National Credit Union 

1775 Duke Street 

Alexandria, Virginia 22314 

Proposed Rule Part 716 

American Council of Life Insurers 

101 Constitution Avenue, NW, Washington, DC 20001-2133 

www.acli.com 

9 
!IACLI 

Financial Security. For Life. 

Roberta Meyer 

Vice President a Associate General Counsel 

(202) 624-2184 t (202) 572-4808 f 

robbiemeyer@acli. com 

May 12, 2008 

Via Electronic Filing 

Nancy M. Morris 

Secretary 

Securities and Exchange Commission 

100 F Street, N.E. 

Washin.gton, D.C. 20549 

Re: File Number S?-06-08; Regulation S-P: Privacy of Consumer 

Financial Information and Safeguarding Personal Information 

Ladies and Gentlemen: 

The American Council of Life Insurers ("ACLI") is pleased to provide comments to the 

Securities and Exchange Commission (the "Commission") on its proposed amendments to 

Regulation S-P, Privacy of Consumer Financial Information and Safeguarding Personal 

Information. 1 ACLI is the principal trade association of life insurance companies, whose 353 

life insurance companies account for 93 percent of the industry's total assets, 93 percent of 

life insurance premiums and 94 percent of annuity considerations. Many of our member 

companies manufacture variable annuities and variable life insurance products that are 

registered under the federal securities laws and distributed through broker-dealers. Over 

50% of FINRA's 672,000 registered representatives work for broker-dealers affiliated with life 

insurance companies. Some life insurance agents also operate as registered investment 

advisers. Licensed insurance agents that sell variable insurance products are subject to the 

requirements of both the federal securities laws and state insurance laws. The proposed 

amendments to Regulation S-P, therefore, will have a significant and distinct impact on life 

insurers, their distributors, and their agents. 

The life insurance industry has long recognized the importance of protecting its customers' 

nonpublic personal information and strongly supports the confidentiality and safeguarding 

provisions of the Gramm-Leach-Bliley Act ("GLBA") and implementing state laws and 

regulations. Our member companies work hard to ensure the confidentiality and security of 

customer information in accordance with these laws. ACLI appreciates the Commission's 

1

73 Fed.Reg. 13692 (March 13, 2008) 

American Council of Life Insurers 

101 Constitution Avenue, NW, Washington, DC 20001-2133 

www.acli.com 
efforts to review and revise Regulation S-P standards for safeguarding customer records and 

responding to data security breaches. 

ACLI strongly agrees with the Commission's view that an information security program should 

be appropriate to the firm's size and complexity, nature and scope of activities and 

sensitivity of personal information at issue. ACLI believes it is important that a diversified 

financial organization that includes life insurers be permitted to adopt an information 

security program that applies to all companies within the organization. This will ensure that 

the security of the nonpublic personal information of all of the organization's customers is 

subject to the same level of security protection; and it will appropriately enable the 

organization to take advantage of economies of scale by adopting information security 

programs across the entire consolidated organization. 

For the reasons just described, ACLI also believes that the proposed requirements for an 

information security program and response program in the event of security breaches should 

not conflict with or extend beyond the requirements of Section 501 of the GLBA, the federal 

interagency guidance, and applicable state laws and regulations. Accordingly, ACLI urges 

the Commission to modify the proposed rule as discussed below and as otherwise necessary 

to achieve this goal. ACLI also requests that the proposed rule be modified to make it clear 

it is only applicable to information of customers with securities products and does not apply 

to insurance files maintained separately. 

Propos'ed GLBA Exception tor Disclosures to Departing Brokers. Dealers or Investment 

Advisers 

The Commission proposes to establish an exception to the GLBA to permit disclosure of 

certain limited customer information to a broker, dealer or investment adviser, when he or 

she leaves the company to join another organization, without the need to provide the 

customer with notice and an opportunity to opt-out from the disclosure. This exception 

would permit the former representative to solicit customers to whom the representative 

personally provided a financial product or service on behalf of the company. The 

information that may be disclosed is limited to the customer's name, contact information 

(address, telephone number and e-mail address) and a general description of the type of 

account and products held by the customer. The information may not include the 

customer's account number, Social Security number or securities positions. 

ACLI believes that as written, the exception could be misconstrued to requ;re a company to 

disclose the information specified in the exception to departing representatives. 

Accordingly, we strongly urge that the rule be clarified to indicate that the exception is not 

intended to impose any requirement that information be disclosed to departing brokers, 

dealers or investment advisers. In addition, we urge the Commission to underscore that: (i) 

in any event, the customer information a company's representative may take when 

departing is governed by the contract between the representative and the company; and (ii) 

a company's disclosure policies and practices may be subject to other laws or regulations, 

such as state GLBA privacy laws applicable to insurers, that also govern permitted 

American Council of Life Insurers 

101 Constitution Avenue, NW, Washington, DC 20001-2133 

www.acfi.com 

2 
disclosures by the company. These clarifications are particularly important to our member 

company life insurers that have registered representatives that are also licensed insurance 

agents, subject to the requirements of both the federal securities laws and state insurance 

laws, as well as to obligations and responsibilities under contracts between the parties. 

American Council of Life Insurers 

101 Constitution Avenue, NW, Washington, DC 20001-2133 

www.acli.com 

3 
Proposed Requirements for Information Security Programs 

Extension of Scope 

ACLI objects to the proposed extension of the requirements with respect to information 

security programs to employees' information. Section 501 of the GLBA provides that 

financial institutions have an affirmative and continuing obligation to protect the security 

and· confidentiality of their customers' non public personal information. 2 Section 501 (b) 

authorizes the Commission, certain other Federal agencies, and State insurance authorities 

to establish appropriate standards for financial institutions to insure the security of 

customer information. State laws and regulations that provide guidance for insurers' 

implementation of the security requirements of GLBA § 501 are based on the Standards for 

Safeguarding Customer Information Model Regulation, adopted by the National Association of 

Insurance Commissioners ("NAIC"). Neither the NAIC Model Regulation nor the state laws 

that track the NAIC Model Regulation apply to employee information. Similarly, there is 

nothing in § 501 of the GLBA that applies to employee information. Moreover, the guidance 

of the Federal banking agencies and the Federal Trade Commission does not extend to 

employee information. 3 

In view of the express language of GLBA § 501, and in order to be consistent with the 

requirements of the other Federal agencies and the state insurance authorities, ACLI 

believes the Commission should not extend the scope of the proposed rule to employee 

information. Accordingly, the ACLI requests the Commission to adjust the proposed 

amendment to the definition of "personally identifiable financial information" in § 

248.3(u)(1 )(iv) and the proposed language of 

§ 248.30(a)(2)(iii), relating to the objectives of an information security program, and to 

make any other necessary corresponding adjustments to the proposed rule to eliminate any 

extension of the rule to employee information. 

Definition of Sensitive Information 

The proposed definition of "sensitive personal information" is overly broad and is 

inconsistent with the definition adopted by the Federal banking agencies. In the proposed 

rule "sensitive personal information" is defined to mean "personal information." "Personal 

information" is defined as "any record containing consumer report information, or 

"nonpublic personal information" as defined in 

§ 248.3(t). As a result, virtually all information a company maintains will be "sensitive 

personal information." Since the triggers for notice to consumers and regulators are tied to 

breaches in the security of sensitive personal information, companies will be required to 

notify customers when misuse of essentially any information is reasonably possible and to 

notify examining authorities when there is a significant risk of substantial harm or 

inconvenience or an authorized person has intentionally obtained access to or use of 

essentially any information. This is a significant departure from the standards for notice 

under state security breach laws and used by the other Federal banking agencies, which 

2 15 U.S.C. § 6801 (a). 

3 70 Fed. Reg. 15736 (March 29, 2005). 

American Council of Life Insurers 

101 Constitution Avenue, NW, Washington, DC 20001·2133 

www.octi.com 

4 
define "sensitive personal information" in a manner that is far more meaningful to 

customers. 

In addition, ACLI is concerned that the Commission's proposed definition of "sensitive 

personal information" also includes a person's Social Security Number ("SSN") and the 

maiden name of the person's mother. The Federal banking agencies regard an SSN as 

sensitive customer information only if it is used in combination with the individual's name, 

address or telephone number. ACLI believes that a SSN should be regarded as "sensitive · 

personal information" only if it is obtained in combination with other information that would 

permit access to a customer's account. Moreover, a mother's maiden name should not be 

regarded as sensitive personal information unless the name is used as a password for access 

to a person's account. 

In view of the above, ACLI requests the Commission to modify the definition of sensitive 

personal information in the proposed rule to reflect the definition adopted by the Federal 

banking agencies. 4 

Further, because the risk of misuse of information that is encrypted or otherwise rendered 

unreadable through other methods is nonexistent, ACLI believes that information that is 

rendered unusable through encryption, redaction, or other methods should not be regarded 

as sensitive personal information unless the confidentiality of the encryption key or other 

technology has been compromised. Accordingly, ACLI requests that the definition of 

sensitive personal information also be modified to make it consistent with numerous state 

security breach laws, that do not treat information as sensitive personal information if the 

information is encrypted or rendered·unusable through redaction or other methods and 

neither the encryption key nor other.technology has been compromised. 5 

Substantial Harm or Inconvenience ·, 

The Commission proposes that a firm's information security program be reasonably designed 

to protect against unauthorized access to or use of personal information that could result in 

substantial harm or inconvenience. The proposed rule states that the term "substantial 

harm or inconvenience" is defined as "personal injury, or more than trivial financial loss, 

expenditure of effort or loss of time." ACLI believes that the proposed definition of the 

term "substantial harm or inconvenience" is appropriate. ACLI agrees with the statement in 

the proposal that a firm's decision to change to an account number or password is not 

"substantial harm." ACLI also supports the Commission's statement that unintentional 

delivery of an account statement to an incorrect address is not substantial harm if the 

information was unlikely to be misused. ACLI agrees that accidental access by an employee 

to a customer's records woutd not constitute substantial harm or _inconvenience if there is no 

significant risk of misuse. ACLI recommends that these examples be modified so that they 

also apply to employees of affiliates and service providers. 

Designation of Responsible Employee 

4 70 Fed. Reg. 15736 (March 29, 2005 5 E.g., see ORS §646A.602(11 )(a) (Oregon). 

American Council of Life Insurers 

101 Constitution Avenue, NW, Washington, DC 20001·2133 

www.acli.com 

5 
The proposal requests comment on whether companies should be required to designate an 

employee or employees by name to coordinate the information security program or whether 

companies should be required to designate a coordinator by position or office. ACLI believes 

that companies should have the flexibility to decide which option to choose and should be · 

able to have consolidated information security programs. Accordingly, ACLI requests that 

the Commission permit companies to determine the procedure for designating the 

appropriate person, position, or area within or across the organization that will have 

responsibility for coordinating the company's 

information security program. 

Service Providers 

Proposed Regulation 5-P provides that a company's information security program must 

require service providers by contract to implement and maintain appropriate safeguards. 

The definition of service provider includes any entity that is permitted acc~ss to personal 

information through its provision of services to the firm. As a result, the proposed rule 

appears to require firms that have services provided by affiliates to enter into contracts with 

their affiliates to implement and maintain safeguards. 

ACLI believes that the Commission should riot require formal contracts between companies 

and affiliates that are providing services to·them. Requiring formal contractual agreements 

between affiliates ignores the reality that :affiliates generally are subject to company-wide 

policies and standards relating to safeguarding personal information. Moreover, affiliates 

typically provide services on an informal basis without a formal contract. In view of the 

nature of these arrangements, contracts requiring affiliates to implement and maintain 

appropriate safeguards would appear unlikely to provide additional security protection and 

unnecessarily burdensome. According, ACLI recommends that the Commission clarify the 

proposed rule so that contracts are not required under these circumstances. 

ACLI agrees that firms should be permitted to use third-party reports, such as a review of a 

service provider's SAS-70 or SysTrust reports, in order to assess the adequacy of service 

provider information safeguards. ACLI suggests that the Commission also indicate that: (i) 

other methods for evaluating service provider information safeguards are acceptable as long 

as they are reasonable, and (ii) formal audits of service providers are not necessary. 

Procedures for Respondjng to Unauthodzed Access or Use - Notke and Form SP-30 

The proposed rule requires companies to provide written notice to their designated 

examining authority on Form SP-30 as soon as possible after becoming aware of an incident 

of unauthorized access to, or use of, personal information in which: (i) there is a significant 

risk of substantial harm or inconvenience to the individual, or (ii) an unauthorized person 

has intentionally obtained access to or used sensitive personal information. 

American Council of Life Insurers 

101 Constitution Avenue, NW, Washington, DC 20001-2133 

www.acli.com 

6 
ACLI believes that notice to the designated examining authority should be required only if 

there is a significant risk that the individual will experience substantial harm or 

inconvenience; and recommends that the proposed rule be modified accordingly. If an 

unauthorized person has obtained access to or used sensitive personal information, but there 

is no significant risk of substantial harm or inconvenience to the individual, no enhanced 

consumer protection will result from requiring the provision of notice to examining 

authorities and undue burden will be unnecessarily imposed on companies. Alternatively, 

the Commission should clarify that "intentionally obtained access to or used sensitive 

personal information" means to have obtained access to or used the information with intent 

to commit identity theft or for other unlawful purpose. 

ACLI also believes that the proposed Form SP-30 is excessively complex and that its use 

should not be required The proposed rule requires companies to submit Form SP-30 as soon 

as possible after becoming aware of an incident of unauthorized access to or use of personal· 

information. Because the form is required to be submitted shortly after the incident has 

occurred, it is unlikely a company will have all of the information requested in the form. 

At a minimum, ACLI urges the Commission to adjust the proposed rule to reflect the 

approach taken by the Federal banking agencies -- which do not require financial institutions 

to use a specific form and do not specify the details of the filing. ACLI believes that the 

only information companies should be required to submit to examining authorities is: the 

name of the company, the date of the incident, a brief description of the incident, the 

number of persons affected and whom to contact for more information. ·,r 

ACLI requests that the Commission clarify that: (i) the owner of the information subject to a 

breach of security is responsible for providing the requisite notices; (ii) only one entity is 

required to provide the notices; and (iii) a service provider shall provide notice of a breach 

to the owner of the data. Clarification to this effect is important because in an insurance 

company offering variable products, there may be one or more investment companies, one 

or more broker dealers, a transfer agent, and possibly other regulated entities. There is 

concern that the proposed rule could be construed to require all these entities to provide 

notice. 

ACLI also recommends that the proposed rule be modified to require examining authorities 

to keep confidential and to protect from public disclosure any information they receive in 

connection with notice of a security breach. ACLI believes that companies should not be 

required to request confidential treatment with each notice, and that the proposed rule 

should adjusted to indicate that information provided in filings made with an examining -

authority, including the Commission, in accordance with Regulation 5-P, shall be accorded 

confidential treatment under relevant laws and rules regarding public availability of 

information. 

Disposal of Personal Information 

The proposed rule expands the scope and substance of the current provision in Regulation SP regarding disposal of personal information. ACLI is concerned by the proposed expansion 

of the Commission's disposal rule well beyond the scope of the Fair and Accurate Credit 

American Council of Life Insurers 

101 Constitution Avenue, NW, Washington, DC 20001-2133 

www.acli.cam 

7 
Transactions Act of 2003 ("FACT Act"). and the rules of the other Federal financial 

institution regulatory agencies. Section 216 of the FACT Act amended the Fair Credit 

Reporting Act ("FCRA") to require the Federal financial institution agencies to adopt 

regulations requiring any person that possesses consumer information derived from consumer 

reports to properly di~ose of such information. 6 A consumer report, of course, is a defined 

term under the FCRA. 

When the Commission adopted its disposal rule implementing § 216 if the FACT Act, it 

applied the rule only to "consumer report information," defined as any record about an 

individual that is or is derived from a consumer report. 8 The same approach was taken by 

the other Federal agencies when they adopted rules implementing FACT Act§ 216. 9 

However, the Commission's proposed rule would extend coverage of its current disposal rule 

to personal information, which, under the proposed rule, includes not only consumer report 

information, but also any nonpublic personal information about a consumer. 10 Extension of 

the coverage of the Commission's disposal provisions beyond the scope of the FCRA and the 

other agencies' requirements will cause the Commission's requirements to be inconsistent 

with those of the other agencies and will likely impose significant additional burdens on 

financial institutions without commensurate enhanced consumer protection. 

The proposed rule also requires companies to document in writing the proper disposal of 

personal information. ACLI is concerned that the current language of the proposed rule may 

be construed to require written documentation of every disposal of documents containing 

personal information. Again, such a requirement would impose a significant burden and 

provide questionable additional consumer protection. 

In view of the above, ACLI requests that the proposed rule's disposal requirements be 

modified. to be consistent with the federal banking regulators' rules that extend only to 

"consumer report information." ACU also requests that the proposed rule be adjusted to 

reflect a more reasonable approach that would: (i) require companies to: (a) have 

appropriate disposal policies and procedures; and (b) periodically review their disposal 

practices to ascertain whether there is compliance with their policies and required 

procedures; and (ii) permit companies to rely on certification from their agents or other 

third parties to the effect that the company is in compliance with its disposal policies and 

procedures. 

Use of Examples 

ACLI believes that the examples of acceptable practices contained in the Federal Register 

preamble to the proposed rule can be of considerable value to companies because they 

present real practical situations that firms may encounter. Accordingly, rather than leaving 

them in a Federal Register preamble, ACLI requests that the examples of acceptable 

6 15 U.S.C. § 1681w. 7 15 U.S.C. § 1681 a( d). 

8 17 C.F.R. § 248.30(b)(ii). 9 69 Fed. Reg. 77610, 77612 (December 28, 2004). 10 Proposed Rule§ 248.30(d)(8) 

American Council of Life Insurers 

101 Constitution Avenue, NW, Washington, DC 20001·2133 

www.acli.com 

8 
practices be incorporated into the final rule as nonexclusive, illustrative examples, that are 

not prescriptive. 

Internet Authentication and Red Flag Requirements 

The Commission also asks whether the rule's requirements should specify factors such as 

those identified in the Federal banking agencies' guidance regarding authentication in an 

Internet environment, or include policies and procedures such as those in the banking 

agencies' final "red flags" requirements. ACLI does not believe it is necessary for the 

Commission to adopt these additional requirements and requests that the Commission take 

no action in this area 

Effective Date 

ACLI believes that member companies may not have sufficient time to implement the rule in 

an orderly fashion within 60 days after it is adopted. Member companies are likely to need 

at least eighteen months after the rule is adopted to implement all of the necessary systems 

changes. Accordingly, we request that the final rule provide that companies will have at 

least eighteen 

months after the effective date to implement and comply with the requirements of the rule. 

* * " 

ACLI appreciates the opportunity to provide its comments on.the Commission's proposed 

amendments to Regulation 5-P and appreciates your consideration of its views. If you have 

any questions, please do not hesitate to contact me 

American Council of Life Insurers 

101 Constitution Avenue, NW, Washington, DC 20001-2133 

www.acli.com 

Sincerely, 

Roberta Meyer 

9 
IACLI 

Financial Security. For life. 

Roberta Meyer 

Vice President fr Associate General Counsel 

(202) 624-2184 t (202) 572·4808 f 

robbiemeyer@ac/i. com 

May29, 2007 

Via Electronic Submission 

Robert E. Feldman 

Executive Secretary 

Federal Deposit Insurance Corporation 

550 17th Street, N.W. 

Washington, D.C. 20429 

Attention: Comments 

Federal Trade Commission 

Office of the Secretary 

Room H-135 (Annex C) 

600 Pennsylvania Avenue, N.W. 

Washington, D.C. 20580 

FTC File No. P034815 

Regulation Comments 

ChiefCounsel's Office 

Office ofThrift Supervision 

1700 G Street, N.W. 

Washington, D.C. 20552 

Attention: OTS-2007-0005 

Eileen Donovan 

Secretary of the Commission 

Commodity Futures Trading Commission 

Administration 

Three Lafayette Centre 

1155 21st Street, N.W. 

Washington, D.C. 20581 

Nancy M. Morris 

Secretary 

Securities and Exchange Commission 

100 F Street, N.E. 

Washington, D.C. 20549 

File No. S7-09-07 

Jennifer Johnson 

Secretary of the Board 

Federal Reserve Board 

201

h and C Streets, N.W. 

Washington, D.C. 20551 

Docket No. R-1280 

Office ofthe Comptroller of the Currency 

250 E Street, S.W. 

Mail Stop 1-5 

Washington, D.C. 20219 

Docket Number OCC-2007-0003 

Mary Rupp 

Secretary of the Board 

National Credit Union 

1775 Duke Street 

Alexandria, Virginia 22314 

Proposed Rule Part 716 

Re: Proposed Model Privacy Form 

American Council of Life Insurers 

101 Constitution Avenue, NW, Washington, DC 20001·2133 

www.acli.com 
Ladies and Gentlemen: 

The American Council of Life Insurers ("ACLI") is pleased to provide these comments in connection 

with the Interagency Proposal for Model Privacy Form (the ''Model Form") under the Gramm-LeachBliley Act ("GLB Act") jointly issued by the Federal agencies 1 (the "Agencies"). 2 ACLI is the principal 

trade association oflife insurance companies, whose 373 life insurance companies account for 93 

percent of the industry's total assets, 91 percent oflife insurance premiums and 95 percent of annuity 

considerations. ACLI members are also major participants in the pension, long term care insurance, 

disability income insurance and reinsurance markets. 

The Financial Services Regulatory Relief Act of2006 (the "Regulatory Relief Act") directs the 

Agencies to jointly develop a model form that may be used at the option of financial institutions to 

provide initial and annual privacy notices under section 503 of the GLB Act. 3 The Regulatory Relief 

Act amends section 503 of the GLB Act to require that the model form must be comprehensible, with a 

clear format and design, provide for clear and conspicuous disclosures, and enable consumers to easily 

identify the sharing practices of financial institutions and compare privacy practices among financial 

institutions. 4 The Regulatory Relief Act further amends section 503 of the GLB Act to provide that any 

financial institution that elects to use the model form develored by the agencies shall be deemed to be in 

compliance with the disclosures required under that section. . . 

LIFE INSURANCE INDUSTRY'S INTEREST 

Section 503(a) of the GLB Act requires financial institutions to provide initial and almual privacy 

notices to customers. 6 Life insurers are financial institutions under the GLB Act because they are 

engaged in financial activities as defined in§ 4(k) of the Bank Holding Company Act. 7 Accordingly, if 

a life insurer uses the Model Form developed by the agencies, as provided for iri the amendments to the 

GLB Act made by the Regulatory Relief Act, the insurer will be deemed to be in compliance with the 

initial and annual disclosure requirements of the GLB Act. Moreover, many life insurers are affiliated 

with other financial institutions such as broker-dealers regulated by the SEC and depository institutions 

regulated by the Federal bank supervisory agencies. The Agencies' proposed Model Form, therefore 

will directly affect ACLI member companies. Many of these affiliated companies find it efficient to 

send customers one uniform privacy notice that reflects the privacy policies of the affiliated group of 

companies. Accordingly, we believe that it is appropriate for us to comment on the Model Form 

because of the possible effect it will have on life insurers. 

INTRODUCTION 

ACLI believes that the goal of providing financial institutions the opportunity to simplify privacy 

notices is a worthy objective. Consumers should find simplified notices more understandable and more 

useful by enabling them to make more informed choices. We appreciate the Agencies efforts to develop 

a more meaningful model privacy form. ACLI believes that the development of a model form 

1 72 Fed. Reg. 14940 (March 29, 2007). 2 Comptroller of the Currency, Board of Governors of the Federal Reserve System, Federal Trade Commission, Office of 

Thrift Supervision, Federal Deposit Insurance Corporation, Securities and Exchange Commission, National Credit Union 

Administration and the Commodity Futures Trading Commission. 3 Section 728 ofthe Financial Services Regulatory Relief Act of2006, Pub. L. 109-351, 120 Stat. 1966. 4 15 U.S.C. § 6803(e)(2). 5 15 U.S.C. § 6803(e)(4). 6 15 U.S.C. § 6803(a). 7 12 U.S.C. § 1843(k)(4(B). 

American Council of Life Insurers 

107 Constitution Avenue, NW, Washington, DC 20007·2133 

www.acli.com 

2 
represents a positive step toward achieving the goals Congress established in the Regulatory Relief Act. 

A model form should facilitate the ability of consumers to better comprehend and compare financial 

institutions' privacy policies and practices. 

To enable life insurers to use the Model Form proposed by the Agencies, ACLI believes that the 

Agencies need to take into account unique aspects of life insurers' information collection and sharing 

practices as well as the fact that life insurers must accommodate various state privacy and disclosure 

requirements that differ from the GLB Act requirements. The Model Form and proposal currently do not 

provide flexibility to permit life insurers to address their unique practices or varying state requirements. 

In addition, the GLB Act eliminated the walls between banking, securities, and insurance by allowing 

the merger of these types of businesses under a single holding company. The privacy notices required 

under Section 503(a) of the GLB Act should not create barriers to these entities working together, since 

the GLB Act was clearly intended to permit and foster such activity. Therefore, privacy notices that 

accommodate this type of holding company should be permitted, and given safe harbor under the 

Agencies' rules, so that life insurers that are part of diversified financial institution holding companies 

are permitted to use a single uniform privacy notice that reflects the privacy policies of the affiliated 

group of companies. 

Accordingly, ACLI urges the Agencies to permit life insurers that use the Model Form with the 

prescribed format: (i) to make limited modifications to the language, by omitting inapplicable 

provisions, or adding additional bullets, boxes, or footnotes; or (ii) to include supplemental materials 

with the Model Form to make their notices accurately reflect life insurance industry•practices and 

comply with state insurance privacy laws, without losing the safe harbor. In addition, ACLI urges the 

regulators to modify certain parts of the Model Form to make specific generic changes, generally 

applicable to financial institutions, to also make the form more reflective of life insurance industry 

practices and state insurance privacy laws. ACLI's views regarding parts of the Model Form in 

connection with which life insurers should be permitted to make modifications and our specific 

recommended language changes are explained below. The recommended language changes are also 

reflected in the attached mark-up of the Model Form. By permitting limited modifications and making 

certain language changes to the Model Form, the Agencies will enable life insurers to make use of the 

Model Form and facilitate the ability oflife insurers that are part of diversified holding companies to use 

a single notice, in line with the clear intent of the .GLB Act. 

In addition, ACLI believes that in certain instances, the proposal imposes operational burdens that 

appear to be unnecessary to achieving the goals Congress established in the Regulatory Relief Act. 

Providing life insurers and other financial institutions with additional operational flexibility, as 

discussed below, will enhance the usefulness of the Model Form without diminishing its importance and 

value to consumers. 

Under the Agencies' current GLB Act privacy regulations, financial institutions obtain a safe harbor by 

using the sample clauses set forth in the regulations. The Agencies propose to eliminate this safe harbor 

after a one-year transition date. ACLI strongly objects to the elimination of the safe harbor for 

institutions that use the sample clauses. 

As the Agencies are aware, the GLB Act assigns jurisdiction over insurers to the state insurance 

authorities. A majority of states have adopted laws and regulations that are substantially ~imilar to the 

language adopted by the Agencies in their GLB Act regulations. Generally, state regulations provide a 

safe harbor similar to that provided by the Agencies in their current regulations. 

American Council of Life Insurers 

101 Constitution Avenue, NW, Washington, DC 20001·2133 

www.acli.com 

3 
Life insurers and other financial institutions have invested significant resources in fine-tuning their 

privacy notices to comply with the GLB Act, the Agencies' rules, and related state laws, where 

applicable. If the Agencies have deemed notices to be in compliance with the GLB Act because they 

used the sample clauses the Agencies developed, it seems that the notices should continue to be deemed 

to be in compliance-- regardless of the fact that the Agencies have developed a Model Form. Because 

use of the Model Form is voluntary, there is no reason why the Agencies should punish a financial 

institution that chooses not to use the Model Form. Nor should companies be forced to choose between 

a safe harbor under federal regulations and compliance with state privacy laws. Accordingly, ACLI 

urges that the Agencies maintain the existing safe harbor for institutions that use the sample clauses. 

MoDEL FoRM 

uWHATDOES{ ]Do WJTHYOURPERSONALINFORMATION?" 

Page one of the Model Form permits a financial institution to include the name of the financial 

institution or the group of affiliated institutions providing the notice. ACLI strongly agrees that 

affiliated institutions should be permitted to adopt a single privacy notice. However, in view of the 

limited space provided and the fact that in many instances the names of affiliates are not similar, ACLI 

believes that consumers may not understand which institutions are sending the Model Form. To reduce · 

the likelihood of this occurring, ACLI believes that financial institutions should be permitted to indicate 

on the Model Form the names of the affiliated institutions covered by the policy without losing the safe 

harbor. This could be accomplished through the use of a footnote or a listing on the "reverse side of the 

Model Form. 

nWHAT?" 

Information Collected 

On page one of the Model Form, the section entitled "What?" sets out the types of information financial 

institutions collect and share. Financial institutions are not permitted to change the language appearing 

in this section. In order for this section to accurately reflect the types of information life insurers coiiect, 

ACLI urges that they be permitted to include additional builets that reflect types of information they 

collect and to delete inapplicable bullets without losing the safe harbor. For example, life insurers 

should be permitted to add a bullet relating to medical information since life insurers collect medical 

information to perform fundamental life insurance business functions, such as underwriting and claims 

evaluations. 

In order to reflect the practices of the insurance industry, ACLI also recommends the foiiowing specific 

adjustments to this section: 

A new builet should be added to read as follows: 

• information to establish your eligibility for our products and services 

The current second bulleted phrase should be changed to read as follows: 

• account balances or payment or transaction history 

American Council of Life ln~urer~ 

101 Constitution Avenue, NW, Washington, DC 20001·2133 

www.acll.com 

4 
In addition, ACLI suggests that the term "credit history," used in this section, be replaced by the term 

"consumer report." Credit history is a narrow term and does not convey the range of personal 

information that institutions may collect and share. ACLI believes that use of the term consumer report 

will better reflect the practices of the life insurance industry than credit history. 

Closed Accounts 

On page one of the Model Form, the section entitled "What?" also contains a statement to the effect that 

the institution continues to share information about a customer after the customer closes the account. 

Because customers generally do not have "accounts" with life insurers, ACLI recommends that the 

phrase be changed to read as follows: 

When you are no longer a customer close yoHF account, we continue to share 

Additionally, ACLI believes that the statement relating to former customers is in the incorrect place on 

the Model Form. We suggest that it is more appropriate that the statement be included in the section 

entitled "How?" That section relates to information-sharing practices rather than the type of information 

collected and shared. Finally, ACLI urges that life insurers and other financial institutions not be 

required to provide the statement regarding sharing of information relating to former customers ifthe 

company does not share information after a customer relationship is terminated. 

ACLI suggests that "such as" be used in the section entitled "How?" as follows: 

All financial companies need to share customers' personal information to run their 

everyday business - such as to process transactions ... 

Use of the phrase "such as" will indicate to consumers that not all companies use personal information 

for all the purposes presented. 

In addition, in the section entitled "How" and throughout the balance of the Model Form, ACLI believes 

that the term "credit bureaus" may be too limiting. Instead, we suggest use of the term "consumer 

reporting agencies" which would include entities that maintain personal information that is not related to 

credit, such as medical information that life insurers share with the Medical Information Bureau. 

"REASONS WE CAN SHARE YOUR PERSONAL INFORMATION" 

ACLI believes it is very important to ensure that the information contained in the disclosure table, on 

page one of the Model Form, accurately reflects a life insurer's sharing practices. However, life insurers 

and other financial institutions are not permitted to change the language appearing in this disclosure 

table. ACLI is concerned that the current list of reasons for sharing personal information and the 

permitted "yes" or "no" responses, in the columns relating to whether the company shares and whether 

the consumer can limit the sharing, will not permit life insurers to inform consumers about important 

aspects of their particular privacy policies or to reflect unique state requirements with respect to the 

disclosure of consumer information. 

American Council of Life Insurers 

101 Constitution Avenue, NW, Washington, DC 20001·2133 

www.acli.com 

5 
- For example, the disclosure table does not take permit life insurers to inform consumers of special 

disclosure practices they may have in connection with medical information or to take into account 

unique state opt-in or opt-out requirements with respect to certain sharing of personal information. Also, 

the column entitled "Does [name] share?" permits only a "yes" or "no" answer. However, a life insurer 

may wish to inform consumers that it shares nonpublic personal information with certain affiliates or 

types of institutions rather than with all affiliates or an types of institutions. 

Accordingly, ACLI urges that life insurers be permitted to modify the disclosure table so that it 

accurately reflects life insurers' practices and unique state privacy laws without losing the safe harbor. 

Providing added flexibility will result in additional clarity for consumers and will not weaken the goal of 

making privacy disclosures clear and understandable. 

In addition, ACLI believes that certain specific minor changes to the language of the disclosure table 

will enhance consumer understanding of the information presented and more accurately reflect the 

information sharing practices of the life insurance industry. Accordingly, we suggest that the first block 

be adjusted read as follows: 

For our everyday business purposes- such as to proce:;s your transactions, maintain 

your account, and report to consumer reporting agencies. 

Again, use of the phrase "such as" is suggested to clarify that not all companies use personal information 

for all the purposes presented. 

In addition, for the reasons discussed above, ACLI believes that the term "consumer reporting agencies" 

should be substituted for the term "credit bureaus" in the first block. 

In the fourth block of the disclosure table, relating to disclosures to affiliates for everyday business 

purposes, ACLI believes that the use of the term "creditworthiness" may not accurately reflect the type 

of information that may be shared by life insurers with affiliates. ACLI recognizes the term -

"creditworthiness" is a short-hand way of describing information other than information relating to the 

customer's transactions and experiences with the institution. However, ACLI suggests that the term 

"creditworthiness" may be too expansive and may prove confusing to consumers, because it may 

connote information relating to the customer's transactions, such as payment history. Accordingly, we 

recommend that the language be changed to the following: 

For our affiliates' everyday business purposes- information other than information 

about your transactions and experiences with us creditworthiness 

In the fifth and sixth blocks ofthe disclosure table, relating to sharing of personal information 

with affiliates and nonaffiliates for marketing purposes, it is not clear that the blocks are 

intended to be applicable to sharing for purposes of marketing the affiliates' and nonaffiliates' 

products only. Accordingly, we suggest that the language of the fifth and sixth block be adjusted 

respectively to read as follows: 

For our affiliates to market their products to you 

For our nonaffiliates to market their products to you 

American Council of Life Insurers 

101 Constitution Avenue, NW, Washington, DC 20001·2133 

www.acU.com 

6 
ucoNTACT Us" 

The section on the bottom of page one of the Model Form entitled "Contact Us" provides for financial 

institutions to enter a telephone number or an Internet web address. In some instances, institutions wish 

consumers to contact them only by mail or by electronic means. In addition, many institutions wish also 

to provide a physical or electronic mailing address for consumers. Accordingly, ACLI urges that the 

Agencies not require life insurers or other financial institutions to provide a telephone number or 

Internet web address if these options are not offered and that institutions also be permitted to provide a 

physical or electronic mailing address as a point of contact. 

"SHARING PRACTICES,, 

Notification 

The Agencies indicate that the language contained on page two of the Model Form under "Sharing 

practices" may not be changed. However, life insurance companies issue policies to customers. They 

do not typically open accounts. Modification of the language in the first section, entitled "How often 

does [ ] notify me about their practices?" to reflect insurance industry practices will not alter the 

meaning of the section and will take into account life insurers' practices. Accordingly, ACLI suggests. 

that the language be modified to read as follows: 

We must notify you about our sharing practices when you become a customer open an 

· account and each year while you are a customer • 

Protection 

The response required for the question relating to how a financial institution protects personal 

information may not reflect actual practices oflife insurers and other financial institutions. Accordingly, 

ACLI recommends that the provision be modified to read as follows: 

To protect your personal information from unauthorized access and use, we use security 

measures that comply with federal law. These measures include computer and physical 

safeguards~ aad seoored files aad buildings 

Collection 

ACLI is concerned that the responses to the question "How does [ ] collect my personal information?" 

do not reflect the reasons for which life insurers collect personal information. For example, one of the 

responses states that a company collects personal information when the customer opens an account or 

deposits money. It is likely that consumers will have little understanding of how that response applies to 

a customer's relationship with a life insurer because customers do not open accounts or deposit money 

with life insurers. 

Accordingly, ACLI urges that, without losing the safe harbor, life insurers be permitted to delete bullets 

that do not describe reasons for which life insurers collect personal information and to add bullets that 

accurately reflect the reasons for which life insurers do collect personal information. The following are 

examples of bullets that life insurers should be permitted to use: · 

American Council of Life Insurers 

101 Constitution Avenue, NW, Washington, DC 20001·2133 

www.acli.com 

7 
• request or use a'product, service, or account 

• apply for insurance or benefits 

Limitation of sharing 

Use of the term "creditworthiness" in the first bullet in response to the question "Why can't I limit all 

sharing" is potentially confusing and may cause consumers to believe that federal law grants them the 

right to limit a life insurer's ability to share information relating to their transactions and experiences 

with an affiliate. Accordingly, in ·order to more accurately reflect the types of information that come 

within this category, we recommend modification ofthe bullet to read as follows: 

• affiliates' everyday business purposes- information other than information 

about your transactions and experiences with us. credit\Yorthiaess 

Also, the next two bullets in response to the question "Why can't I limit all sharing?" are not entirely 

correct since federal law permits a life insurer or other financial institution to use an affiliate or a 

nonaffiliate to market its products and services. Accordingly, ACLI urges that these bullets be clarified 

to read as follows: 

• affiliates to market their products to you 

• nonaffiliates to market their products to you 

. ACLI also points out that it may be confusing to consumers to have a F AQ entitled "Sharing practices" 

that addresses a number of other .issues. In particular, the collection of information would appear to be 

inappropriately placed in the "sharing practices" ~ection. Accordingly, ACLI recommends that the 

section be given another name, or at a minimum, that the FAQ regarding information collection be 

moved to a more appropriate section. 

"IF YOU WANT TO LIMIT OUR SHARING" 

30-Day Delay 

The sentence on page three of the Model Form, at the bottom ofthe box entitled "Contact Us," may be 

read to require institutions to delay sharing a consumer's personal information for 30 days from the date 

specified on the Model Form. Because the Model Form will be sent each year, this would require life 

insurers and other financial institutions to cease sharing nonpublic personal information for 30 days each 

year. ACLI believes that this is neither what the Agencies' regulations require, nor what the Agencies 

intended in the Model Form. 

Accordingly, ACLI requests modification to indicate that the 30-day waiting period applies only to the 

initial GLB opt-out opportunity provided to consumers. ACLI suggests the following language: 

Unless we hear from you, we can begin sharing your information 30 days from the 

date of this letter our first notice providing you the opportunity to limit our sharing. 

However, you can contact us at any time to limit our sharing. 

American Council of Life Insurers 

101 Constitution Avenue, NW, Washington, DC 20001·2133 

www.acti.com 

8 
"CHECK YOUR CHOICES" 

ACLI again is concerned that the inflexible structure of the opt-out choices will not provide life insurers 

the ability to provide opt-out choices that reflect their particular sharing policies and unique state laws. 

For example, a life insurer may wish to provide a partial opt-out, as explained below. Accordingly, 

ACLI urges that life insurers and other financial institutions be permitted, without losing the safe harbor, 

to adjust the opt out choices as necessary to accurately reflect an institution's particular practices. This 

will enhance, not weaken, the goal of making the opt out choices more clear and accurate. 

Sharing with affiliates for everyday purposes 

Further, ACLI is concerned that the opt out choices presented on page 3 of the Model Form may not 

accurately reflect the opt out opportunities provided by the FCRA. ACLI believes that the use of the 

term "creditworthiness" in the first choice is potentially confusing because customers may believe that 

the opt out choice also applies to information relating to their transactions with the company. ACLI 

suggests that the first opt out choice be changed to read as follows: 

Do not share with your affiliates for their everyday business purposes 

information other than information about my transactions and experiences 

with you. with yom= affiliates for their eYeryday business purposes 

Sharing with affiliates for marketing 

ACLI is concerned that the second opt out choice is not accurate because it does not indicate that a 

company may use information obtained from an affiliate for marketing puyposes if the consumer is a 

customer of both companies and for other reasons specified in the Fair Credit Reporting Act. As 

proposed, consumers may believe that the opt out permits them to prevent all affiliates from using 

information for marketing purposes. Accordingly, ACLI believes that the option should be modified to 

read as follows: 

Do not allow your affiliates with whom I do not do business to use my 

personal information to market to me. 

Many financial institutions maintain the policy that if a customer chooses not to permit an 

affiliate to use personal information for marketing purposes, the opt out will continue until 

rescinded by the customer and need not be renewed. Accordingly, ACLI requests that the 

Agencies clarify that the sentence on page 3 of the Model Form regarding the need to renew 

this opt out after five years need not be provided if the institution's policy is to continue the 

opt out until the customer chooses to withdraw it. 

Partial Opt-out 

The Agencies' GLB Act regulations provide that financial institutions may permit a consumer to select 

certain nonpublic personal information or certain nonaffiliated third parties with respect to which the 

consumer wishes to opt-out. The Model Form does not appear to permit institutions to offer partial optouts to consumers. In view of the fact that the Agencies' existing regulations permit suchan option, 

ACLI requests that the Model Form permit life insurers and other financial institutions to provide 

consumers with the opportunity to select certain nonpublic personal information or certain nonaffiliated 

third parties with respect to which the consumer wishes to opt-out. 

American Council of Life Insurers 

101 Constitution Avenue, NW, Washington, DC 20001·2133 

www.acli.com 

9 
Account Number 

ACLI suggests that the reference to "Account Number" at the bottom of the opt out form be adjusted to 

reference an identifying number, that would include either an account or a policy number, since life 

insurers' customers are issued policies rather than accounts. 

OPERATIONAL CONSIDERATIONS 

FLESCH SCORE/FONT SIZE 

ACLI is concerned that the Model Form does not meet the Flesch Score of 50 required in the state of 

California with respect to insurers' privacy notices. There also is concern that the Model Form may not 

meet certain state requirements relating to font size. Accordingly, ACLI urges that the Agencies adjust 

the Model Form so that it meets the California Flesh Score requirement or that insurers be granted the 

flexibility to adjust the form as necessary to meet the requirement. ACLI also urges that insurers be 

permitted to adjust the font size to meet any applicable state requirements. 

PAPER SIZE 

The Agencies require financial institutions to print the Model Form on 8 Yz" by 11" paper. ACLI 

believes that specification ofthe paper size is not necessary to accomplish Congress's objectives with 

respect to the Model Form as set forth in the Regulatory Relief Act. To date, ACLI member companies 

have not received complaints regarding the size of the paper on which their privacy"policies are printed. 

Accordingly, ACLI recommends that the Agencies permit financial institutions to print the Model Form 

on whatever size paper they believe is appropriate given an institution's particular circumstances. 

NUMBER OF PAGES 

The Agencies require that the Model Form must appear on two separate pages. If an opt-out is provided, 

the opt-out form must be on a third page. The Agencies indicate that separate pages are required 

because testing has indicated that consumers have a preference for notices that enable them to view the 

information on pages one and two side-by-side. ACLI believes that the evidence regarding. consumer 

preference does not outweigh the significant increase in expenses life insurers and other financial 

institutions will incur as a result of increased costs for paper, handling and processing. The Agencies' 

research did not indicate any significant increase in consumer comprehension and usability. Indeed, the 

Agencies' notice states that their research concluded that page one of the Model Form alone was 

adequate for consumer comprehension and usability. 8 Accordingly, ACLI requests that the Agencies 

not adopt the requirement that the Model Form be printed on separate pages. 

DELIVERY 

The Agencies indicate that institutions will not be permitted to incorporate the Model Form into any 

other document. It is unclear whether the Model Form may be sent to customers in a mailing that 

contains other material. Nonetheless, ACLI believes that such limitations are inappropriate and 

unnecessary. The Agencies cite no evidence to support the position that including the Model Form with 

other material in a mailing will dilute its effectiveness. Moreover, as indicated above, ACLI believes it 

is very important that life insurers to be permitted to include supplemental materials with. the Model 

8 72 Fed. Reg. at 14944. 

American Council of Life Insurers 

101 Constitution Avenue, NW, Washington, DC 20001-2133 

www.acli.com 

10 
Form if necessary to make the notice accurately reflect life insurance industry practices and to comply 

with state privacy laws that differ from the GLB Act requirements. Also, including the Model Form 

with another important document, such as a periodic statement, will underscore the importance of the 

Model Form to consumers. Requiring that the privacy notice be sent in a separate mailing will add 

considerable expense with no demonstrable and possible diminution of its benefit to consumers. 

Accordingly, ACLI urges that the Agencies permit financial institutions to include other information in 

the mailing that contains the Model Form without losing the safe harbor. 

Insurers often provide customers with privacy notices as part of a document or brochure that describes 

the terms and features relating to the customer's insurance policy or annuity. Customers review and 

retain these documents because they are important documents. For example, companies that are 

required to provide a prospectus to customers in connection with certain types of insurance products 

generally include the privacy notice in the prospectus. Because of their importance and 

comprehensiveness, consumers typically review and retain these booklets or documents. Permitting the 

Model Form to be part of a comprehensive relationship document will not adversely affect the goals set 

forth in the Regulatory ReJief Act. Indeed, permitting the form to be part of an important relationship 

document will focus attention on the notice and help ensure that it will be read by customers. It also 

ensures that the Model Form will be delivered to customers and will not inadvertently be omitted from 

among other documents provided to consumers at the time they become customers. Accordingly, ACLI . 

requests that the Agencies permit institutions to incorporate the Model Form into a document that 

includes other material relating to the customer's relationship with the institution. 

NOTICE OF CHANGES 

Life insurers and other financial institutions typically notify consumers of changes to their privacy 

policies in annual privacy notices. The Agencies have requested comment on whether they should 

require financial institutions to highlight changes in their policies as part of the Model Form. ACLI 

believes that such a requirement will result in consumer confusion and is unnecessary. Requiring 

institutions to highlight changes in their privacy policies would be meaningful only if consumers are 

informed as to what the previous policies were. Moreover, requiring that this additional information be 

provided is inconsistent with the objective of providing privacy policies in a clear, straightforward 

manner that consumers can easily understand. Highlighting changes will make the Model Form 

unnecessarily complex and confusing to customers. 

LOGOS AND COLOR 

The Agencies ask whether financial institutions will use corporate logos and color in connection with 

the Model Form. Financial institutions use corporate logos to provide a consistent corporate identity 

that customers easily recognize and identify with. The use of color and logos increases the likelihood 

that customers will read the information the institution provides. Accordingly, ACLI supports the ability 

of life insurers and other financial institutions to use logos and color on the Model Form. 

TESTING 

The Agencies indicate they plan to test the next version of the Model Form with consumers. ACLI 

recommends that the Agencies also convene an advisory group composed ofrepresentath!es of life 

insurers and other financial institutions with expertise in privacy matters to review the Model Form and 

advise on whether the next version provides useful information to consumers, is understandable, and 

conveys meaningful information in a clear manner. 

American Council of Life Insurers 

101 Constitution Avenue, NW, Washington, DC 20001·2133 

www.acli.com 

11 
NOTICES ON WEBSJTES 

The Agencies indicate that if an institution posts a pdf version of the Model Form on its Internet 

websites it may come within the Agencies' safe harbor. The Agencies ask whether a web-based design 

should be developed. ACLI believes that a web-based Model Form would prove convenient to 

consumers because it would not require them to open a pdf document to View an institution's privacy 

policy. Consumers can review a web-based privacy policy by clicking on the appropriate web page. 

Accordingly, ACLI requests that life insurers and other financial institutions be pemritted to develop and 

use a web-based design on their websites. 

* * * 

To enable life insurers to use the Model Form, the unique aspects of their information collection and 

sharing practices as well as various state privacy and· disclosure requirements must be taken into 

account. This is particularly the case for life insurers that are part of diversified holding companies. 

Accordingly, ACLI urges: (i) the Agencies to permit life insurers to make limited modifications to the 

Model Form or to inch.ide supplemental materials with the Model Form, to reflect the unique aspects of 

the life insurance industry and state privacy laws, without losing the safe harbor, and (ii) that the 

Agencies make specific language changes to the Model Form, as discussed above, so that diversified 

holding companies that include life insurers may use a single notice, in line with the clear intent of the 

GLB Act. 

ACLI appreciates the opportunity to provide its comments on the proposed Model Form and appreciates 

your consideration of its views. If you have any questions, please do not hesitate to contact me 

Attachment 

American Council of Life Insurers 

101 Constitution Avenue, NW, Washington, DC 20001·2133 

www.acli.com 

Sincerely, 

Roberta Meyer 

12 
:FACTS . 

Why? -: . ·: 

:· ' ( ' 

,/ . ' ' . r· ~~- . . - . _ 

'~bpw? ·: ·. · ·:· - ·- · . : 

; _: ... · - :- ' ; 

; .. . 

' I'-:. I o ' • 

1-'-' .· :·_ . . !• •• •' • < • ' -

ATTACHMENT 

WHAT DOES [name of financial institution] DO 

WITH YOUR PERSONAL INFORMATION? 

Financial companies choose how they share your personal information. Federal law 

gives consumers the right to limit some but not all sharing. Federal law also requires 

us to tell you how we collect, share, and protect your personal information. Please read 

this notice careful! to understand what we do. 

types personal information we collect and share or 

service you have with us. This information can include: 

• information to establish your eligibility for our products and services; 

• Socia!' Security number and income 

• account balances or payment or transaction history 

• consumer report sre~it historyor credit scores 

All financial companies need to share customers' personal information to run their 

everyday business, such as to process transactions, maintain customer accounts, and 

report to consumer reporting agenciessredit 13"'rea~,Js. In the section below, we list the 

reasons financial companies can share their customers' personal information; the 

reasons [name of financial institution] chooses to share; and whether you can limit this 

sharin . 

:~.::.\,·,· ·,·:-._~-' .. ~~(: '--~~-- .·.····:_ .. ·.,·. •.' ·-~;·.~·~:· .. :.··~,, ~.:-:·. ~:;_;--~-: ·. _· !:-\;'_.:: ·· .... : . ,. Reasof:ls we cal') share y9ur personal information. '. . ;· Does [naiT)e of_ financial. · Can you limit sharing?· · 

,\,. _:.:-_;' ~···· ·. · ~. : · . . . ':·;: . .': ··_·!jn~tit.uttq_nrs~ar~?,,-.· ... ,-· _. · _ .- ·._ ... 

For our every day business purposes - -

~ to process your transactions, maintain your 

accoun , and report to cresit D~,JFea"'s consumer 

reporti 1C!81!encies · 

For our marketing purposes - -

to offer our products and services to you 

For joint marketing with other financial companies 

For our affiliates' everyday business purposesinformation about your transactions and experiences 

For our affiliates' everyday business purposes -

Inform tion other than information about your 

transactions and experiences with us 

Forou affiliates to market their groducts to you 

For no1 affiliates to market their products to you 

~- ~ . -- ~.;, . - , ' • : .• 'I 

, 'Go.~tacJ: U~ · · ... - . . . [applicable means of contact] Caller go te (wee aadress] 

:.< ·: j<:' :' '_, •• :-- ··.: '·- ••••• ~ ~: 

American Council of Life Insurers 

101 Constitution Avenue, NW, Washington, DC 20001·2133 

www.acli.com 
FACTS 

WHAT DOES [name of financial institution) DO 

WITH YOUR PERSONAL INFORMATION? 

_-Sharirig practices ' .. · . · · -. · 

How often does [name of financial 

institutipn] notify me about their 

practices 

How does [name of financial 

institution] protect my personal 

inform~tion? 

How d~es [name of financial 

institution] collect my personal 

;~oor . 

I 

Why can't I limit all sharing? 

Everyday business purposes 

Affiliates 

Non affiliates 

Joint marketing 

American Council of Life Insurers 

We must notify you about our sharing practices when you become a 

customer open an aosmmtand each year while you are a customer. 

To protect your personal Information from unauthorized access and .use, 

we use security measures that comply with federal law. These measures 

include computer and physical safeguards and sesllred files and b~o~ildings. 

[Option for life insurers! 

We collect your personal information, for example, when you 

• apply for insurance or benefits 

• request or use a product, service or open an account or deposit 

rnaReY • buy or sell securities, pay yollr bills or apply for a loan 

• use yollr credit or debit sard 

We also collect your personal information from others such as consumer 

reoortirm aoencies, sredit llllrealls, affiliates, or other companies. 

Federal law gives you the right to limit sharing only for • 

• affiliates' everyday business purposes - information other than 

information about your transactions and experiences with us 

creditworthiness 

• affiliates to market their products to you 

• nonaffiliates to markettheir products to you 

State laws and individual companies may give you additional rights to limit 

sharing. 

The actions necessary by financial companies to run their business and 

manage customer accounts, such as: 

• processing transactions, mailing, and auditing services 

• providing information to consumer reporting agencies sredit bureaus 

• responding to court orders and legal investigations 

Companies related by common ownership or control. They can be 

financial and nonfinancial companies. 

• [affiliate infonnation] 

Companies not r~lated by common ownership or control. They can be 

financial or nonfinancial companies. 

• [nonaffiliated information] 

A formal agreement between nonaffiliated financial companies. that 

together market financial products or services to you 

• lioint marketing] · 

2 

101 Constitution Avenue, NW, Washington, DC 10001-2133 

www.acli.com 
FACTS WHAT DOES [name of financial institution] DO 

WITH YOUR PERSONAL INFORMATION? 

)fyQu.waritto)imi(ourstiarlng · ... : .. · · _:- -· · _: .-~- · · · . - -. -. --· ·· ·: 

Contact us 

Your choices will apply 

to ·~ron'""' 

By telephone [toll-free telephone]- our menu will prompt you through your choices 

On the web: [web address] 

By mail: mark your choices below, fill in and send from to 

[mailing address] 

Unless we hear from you, we can begin sharing your Information 30 days from the date of 

our first notice providing you the opportunity to limit our sharingthis Iefier. However, you can 

contact us at an time to limit our sharin . 

Check any/all you want to limit: (see page 1) 

0 Do not share with your affiliates for their everyday business purposes information, 

other than information about my transactions and experiences with 

Y2J:!CFeditworthiness with your affiliates klr tl:leir everyday busihess raurpose. 

0 Do not allow your affiliates with whom I do not do business to use my personal 

information to market to me. 

(I will receive a renewal notice for this use for marketing in. 5 years.) 

D Do not share my personal information with nonaffiliates to market their 

products and services to me. 

Mail to: 

--------------! [mailing address] 

3 

American Council of Life Insurers 

101 Constitution Avenue, NW, Washington, DC 20001-2133 

www.acli.com · ·