COMMENT 

NATIONAL ASSOCIATION OF MUTUAL INSURANCE COMPANIES 

May 29,2007 Received CFTC 

Records Section 

Office of the Comptroller of the Drl3olo7 

Currency 

250 E Street, S.W. 

Mail Stop 1-5 

Washington, DC 20219 

Re: Docket I D OCC-2007 -0003 

Mr. Robert E. Feldman 

Executive Secretary 

Attention: Comments 

Federal Deposit Insurance Corporation 

550 17th Street, N.W. 

Washington, DC 20429 

Re: RIN 3064-AD16 

Ms. Mary Rupp 

Secretary of the Board 

National Credit Union Administration 

1775 Duke Street 

Alexandria, Virginia 22314-3428 

Re: RIN 3133-AC84 

Ms. Nancy M. Morris 

Secretary 

Securities and Exchange Commission 

100 F Street, N.E. 

Washington, DC 20549-1090 

Re: File Number S7 -09-07. Model 

Privacy Form 

Ms. Jennifer Johnson 

Secretary 

Board of Governors of the Federal 

Reserve System 

20th Street and Constitution Avenue, 

Nw c . • - :'1 

Washington, DC 20551 c-; 

Re: Docket No. R-1280 

Regulation Comments 

Chief Counsel's Office 

Office of Thrift Supervision 

1700 G Street, N.W. 

Washington, DC 20552 

Attention: OTS-2007 -005 

Re: Docket I D OTS-2007 -0005 

Federal Trade Commission 

Office of the Secretary 

Room 135 (Annex C) 

600 Pennsylvania Avenue, N.W. 

Washington, DC 20585 

c 

.. 

Re: Model Privacy Form. FTC File No. 

P034815 

Ms. Eileen Donovan 

Acting Secretary of the Commission 

Commodity Futures Trading 

Commission 

Three Lafayette Centre 

1155 21st Street, N.W. 

Washington, DC 20581 

Re: Rl N 3038-AC04 

-..J 

.- i'j 

. CJ 

. :-:1 

.J 
Comments of the National Association of Mutual Insurance Companies 

Re: Interagency Proposal for Model Privacy Form 

May 29,2001 

RE: Interagency Proposal for Model Privacy Form 

Ladies and Gentlemen: 

Page 2 

The National Association of Mutual Insurance Companies ("NAMIC") is pleased 

to offer comments on the Interagency Proposal for Model Privacy Form ("Model 

Form") under the Gramm-Leach-Biiley Act ("GLBA"), Title V, Subtitle A, issued 

jointly by the Federal agencies. 1 

NAMIC is the largest full-service national trade association serving the 

property/casualty insurance industry with more than 1 ,400 member companies 

that underwrite more than 40 percent of the property/casualty insurance premium 

in the United States. NAMIC members are small farm mutual companies, state 

and regional insurance companies, risk retention groups, national writers, 

reinsurance companies, and international insurance giants. 

The Financial Services Regulatory Relief Act of 2006 ("Regulatory Relief Act") 

directed the Agencies to develop jointly a model form that may be used at the 

option of financial institutions to provide initial and annual privacy notices under 

section 503 of the GLBA.2 The Agencies on March 29 published a Notice of 

Proposed Rulemaking ("NPR") and solicited public comment on a prototype 

privacy notice to describe an institution's information sharing practices, and, for 

certain types of sharing, a consumer's right to opt out. 

The NPR proposes that use of the model form be optional, but that financial 

institutions that choose to use the model form would satisfy the disclosure 

requirements for the notices and could take advantage of a legal safe harbor. 

Under the NPR, after a transition period, institutions using notices based on 

sample clauses currently contained in most of the Agencies' privacy rules would 

lose their safe harbor protection. 

NAMIC supports the goal of simplification and we applaud the Agencies for their 

efforts in developing a simpler, more meaningful privacy notice form. While we 

support the goal of simplification, we have several significant concerns with the 

proposal as currently outlined. We urge the Agencies to work with NAMIC and 

1 72 Fed. Reg. 14940 (March 29, 2007). 2 Section 728 of the Financial Services Regulatory Relief Act of 2006, Pub. L. 109-351, 120 Stat. 

1966. 
Comments of the National Association of Mutual Insurance Companies 

Re.: Interagency Proposal for Model Privacy Form 

May 29,2007 

Page 3 

the insurance industry to improve the model form to meet the needs of insurers 

and consumers. 

Background 

Subtitle A of title V of GLBA requires each financial institution to provide a notice 

of its privacy policies and practices to customers that obtain financial products or 

services used primarily for personal, family or household purposes 

("consumers"). Financial institutions were first required to distribute privacy 

notices by July 1, 2001. Thereafter, notices required under GLBA must be 

delivered to consumers no later than when a customer relationship is formed and 

annually thereafter throughout the life of the relationship. The privacy notices 

must describe the institution's policies and practices with respect to disclosing 

nonpublic personal information about a consumer to both affiliated and 

nonaffiliated third parties. The notices must accord consumers with a reasonable 

opportunity to opt out of sharing of non public personal information with 

nonaffiliated third parties, other than as permitted by statute. 

The Fair Credit Reporting Act ("FCRA") also gave consumers the right to limit the 

sharing of information which would be characterized as non-transactional or nonexperience information.3 Section 624 of FCRA as amended by the Fair and 

Accurate Credit Transactions Act of 2003 ("FACTA") also permits consumers to 

opt out of sharing of information, including transaction and experience 

information, among affiliates for marketing purposes. 

The GLBA privacy rule does not prescribe any specific format or standardized 

wording; however, the Agencies have developed model language ("Sample 

Clauses") that institutions may use to satisfy the privacy rule. Institutions using 

the sample clauses are provided the benefit of a safe harbor for compliance with 

the privacy rules. 

GLBA provides that enforcement and regulatory authority is based on functional 

regulation and authority over insurers is vested in state insurance regulators. 4 

As such, insurers are not directly subject to the Agencies' regulations 

implementing the privacy requirements; however, individual insurers, their 

holding companies, affiliates and consumers have a stake in changes to the 

3 Section 603(d)(2)(A) Fair Credit Reporting Act; 15 U.S.C 1681 4 15 U.S.C. § 6805(a). 
Comments of the National Association of Mutual Insurance Companies 

R~: Interagency Proposal for Model Privacy Form 

May 29,2007 

Page4 

federal standards and safe harbors. Insurers have taken great care and 

expended significant time and financial resources to ensure that their privacy 

notices meet current GLBA requirements in all the states in which they conduct 

business and many utilize the sample clauses and rely on the safe harbor 

protections afforded by their use. 

The intent of Congress in adopting the GLBA was to provide a new framework for 

financial modernization to facilitate the provision of products and services to 

consumers on an integrated basis by affiliated financial institutions, including 

banking, insurance and securities firms. Title V, the "privacy article" of GLBA, 

address non-public personal information and requires financial institutions to give 

consumers notice of how such information may be used. Consumers are also 

given a new choice as to sharing their personal information with non-affiliated 

companies for marketing purposes. Financial institutions under Title V in Section 

506 were directed in that same notice to offer consumers choices in how to limit 

sharing information which would be characterized as non-transactional or nonexperience information under the Fair Credit Reporting Act ("FCRA"). The opt out 

notice respecting the sharing of such information within affiliate groups was 

addressed. 

The NPR goes far in its goal of achieving a simplified notice, but it fails to 

recognize in content and form the subtle and actual differences between banking, 

securities and insurance. NAMIC believes changes in the model form and 

flexibility in language is necessary to reflect the true purpose of financial 

modernization and to make the notice factually accurate for our member 

companies. 

The NPR proposes that use of the model form be optional for financial 

institutions. NAMIC is pleased that the agencies recognize the importance of not 

mandating the use of a particular form. However, since the use of the model 

form under the proposed rule would be the only path to safe harbor protection 

from private and regulatory enforcement actions, NAMIC believes that the model 

form must be improved and that it should supplement, but not replace, the 

sample clauses. Like other financial institutions insurers should to be able to 

utilize a notice that accurately reflects their business practices in terms of what 

information is gathered from consumers and customers, how that information is 

shared and what "opt outs" consumers or customers have with respect to the 

insurance "side" of financial services, while providing them safe harbor h3gal 

protection. . 
Comments of the National Association of Mutual Insurance Companies 

Re,: Interagency Proposal for Model Privacy Form 

May 29,2007 

Content Flexibility 

Page 5 

The Agencies requested comment on whether institutions can accurately 

disclose their information sharing practices using the standardized provisions in 

the model form. NAMIC believes that the model form does not provide sufficient 

flexibility to meet the needs of insurers and their consumers. 

The proposed model form permits very few deviations or modifications. Since 

insurers are subject to varied state requirements, NAMIC is concerned that the 

lack of flexibility to modify the form may inhibit the ability of insurers to reflect 

their actual policies and practices and to meet specific state requirements. 

Each of the 50 states and the District of Columbia has adopted guidance for 

insurers to implement the GLBA privacy requirements. Most of the state 

requirements are based on the Model Privacy of Consumer Financial and Health 

Information Regulation adopted by the National Association of Insurance 

Regulators; however, significant variations exist between jurisdictions. For 

example, the California legislature in 2003 enacted legislation which changes the 

GLBA third-party marketing disclosure standard from "opt-out" to "opt-in." The 

legislation also imposed new and different notice requirements. Insurers have 

developed and implemented privacy policies and notices to accommodate these 

different and/or additional state requirements, often using the sample clauses. 

NAMIC is concerned that the model form does not provide the requisite flexibility 

needed to meet varying state requirements. In addition, it is important to note 

that there is no guarantee that states will amend their notice requirements. As a 

result insurance consumers could receive two or more privacy notices. Such an 

outcome would prove confusing for consumers and contrary to the goal of 

simplification as outlined in the Regulatory Relief Act. 

NAMIC urges the Agencies to permit institutions to make appropriate 

modifications to the language of the model form. Specifically, we urge the 

Agencies to permit institutions to modify the model form to satisfy state law 

requirements. In addition, we urge the Agencies to permit additions or 

modifications to permit disclosure of privacy rights other than those established 

by GLBA or the FCRA or describe non-standard privacy practices. 
Comments of the National Association of Mutual Insurance Companies 

Re,: Interagency Proposal for Model Privacy Form 

May 29,2007 

Consolidated Notices/Insurance Notices 

Page 6 

Financial institutions affiliated with other financial institutions may desire to utilize 

a single notice form to cover the practices and policies of all covered entities. To 

facilitate the use of a single consolidated form, particularly where the covered 

institutions provide insurance, and banking or securities products or services, 

NAMIC proposes the following amendments to the proposed model form. The 

changes are necessary to ensure that the form is capable of being factual and 

accurate for insurance companies-rather than a form of notice that is bank or 

securities centric in scope and focus and is not reflective of the needs of 

insurance companies. We believe these changes can lead to a single form 

suitable for all financial services companies coming under the umbrella of the 

GLBA and its goal of communication of information sharing practices in a 

consistent manner under Title V. 

NAMIC urges that the proposed model form be comprehensive enough to 

describe insurance type transactions. Our suggested amendments to the threepage standard notice follow: 

The three bullets on Page 1 of the form under the heading of "What?" should be 

modified to reflect insurance practices permitted under the FCRA as well as 

relate to the sample clauses proposed by the NAIC in its model rule: 

• Information (from application or other sources) to establish your 

eligibility for our products or services. 

• Account balances or payments; transaction or loss history 

• Consumer report or credit score 

Under the heading "How?" we would recommend use of the term "consumer 

report" rather than "credit history." The term consumer report reflects the reports 

accessed by both banking and insurance institutions and results in a notice form 

that is factual and accurate as to insurance underwriting practices. 

In that portion of the notice listing "Reasons we can share your personal 

information" we recommend inclusion under the heading "For our affiliates every 

day business purposes" the following language: "information other than 

information about your transactions with us." This qualification will help make 
Comments of the National Association of Mutual Insurance Companies 

Re.: Interagency Proposal for Model Privacy Form 

May 29, 2007 

Page 7 

clear the FCRA opt out on Page 3 as it relates to insurers and their underwriting 

practices and sharing practices as financial institutions. 

In addition we recommend adding a bullet on Page 2 of the model form 

describing "Sharing practices" under the heading "We collect your personal 

information, for example, when you" as follows to better describe insurance 

practices. 

• Pay for bills or apply for insurance. 

Using loan, account or depository information as the only examples does not give 

insurance consumers a perspective to understand how the information sharing 

practices apply to them. A few additional product or transaction references in this 

area would provide better clarity to such consumers. 

As to the "Why can't /limit all sharing" it is important to again qualify how the 

transactions or experience rules relate to underwriting or loss history. We 

recommend amending the first bullet under the heading "Federal law gives you 

the right to limit sharing only for' as follows: 

• Affiliate's everyday business purposes-information other than 

information about your transactions or experience with us 

This clarification is important to give the consumer an opportunity to make an 

informed choice on the decision made on Page 3 of the notice. 

With respect to Page 3 of the notice we believe the FCRA opt out needs to be 

modified slightly to reflect insurance practices as follows: 

• Do not share with your affiliates for their everyday business purposes 

information other than information about my transactions or experience 

with you. 

As to the choice offered regarding the use of personal information for marketing 

between affiliates, Section 624(a)(4 )(a) of the FCRA provides that the notice and 

opt out requirements will not apply if the receiving affiliate has a pre-existing 

customer relationship with the consumer to whom the marketing solicitation has 

been sent or shared. Accordingly we believe the following modification is 

required: 
Comments of the National Association of Mutual Insurance Companies 

Rer Interagency Proposal for Model Privacy Form 

May 29,2007 

Page 8 

• Do not allow your affiliates with whom I do not do business to use my 

personal information to market to me. (I may receive a renewal notice 

for this use for marketing in 5 years.) 

We believe these changes are necessary to make the model form accurate and 

meaningful for insurance consumers and to afford insurance financial institutions 

to option to use the model form. 

Format Standardization 

The Agencies requested comment on whether each page of the proposed model 

form should be required to be on a separate piece of paper and what paper size 

would be appropriate for the model form. They also requested comment on 

whether financial institutions should be permitted to use color and/or logos on 

their privacy notices. 

The Agencies propose a number of requirements designed to standardize 

privacy notices. As outlined, NAMIC is concerned that several of these 

requirements will impose operational difficulties. Specifically, we are concerned 

over requirements that the notices be presented on two (three, if an opt-out is 

provided) 8.5" x 11" single-sided sheets of white or light colored paper with black 

or suitable contrasting color ink, and that the notice not be incorporated into any 

other document. 

Our member companies do not believe it is necessary, or appropriate, for the 

Agencies to specify either the size of the paper or the number of pages. 

Requirements for full size paper and multiple pages would significantly increase 

printing and mailing costs. In addition, many institutions include privacy notices 

in billings or other communications and the proposed requirements could require 

institutions to send privacy notices in separate mailings. While consumers may 

have expressed a preference for the format it is not clear that the full size and 

single side requirements increase understanding and the preference should not 

be used as a justification for the significant cost increase that would result. 

Similarly, not permitting the privacy notice to be included in other consumer 

communications needlessly reduces delivery options and may ironically hamper 

efforts of insurers to provide comprehensive policy and account information to 

consumers in a consolidated format. 

Many companies use logos or colors to identify their products to consumers. The 

use of these highly recognizable symbols helps consumers to identify the 
Comments of the National Association of Mutual Insurance Companies 

Re: Interagency Proposal for Model Privacy Form 

May 29,2007 

Page 9 

institution to which the notice is applicable. NAMIC believes that incorporation of 

corporate logos and colors will not interfere with the purpose and goals of the 

privacy notices and should be permitted. 

NAMIC urges the Agencies to remove requirements for specific paper sizes and 

document length and the requirement that the privacy notice be separated from 

other documents. 

Sample Clauses 

The Agencies requested comments on the proposal to replace the sample 

clauses with the proposed model form. Specifically, the Agencies seek comment 

on whether sample clauses should be retained and whether the transition period 

is appropriate. 

The NPR provides that the model form will replace the sample clauses for 

purposes of safe harbor protections. Under the proposed rule, the sample 

clauses contained in current privacy rules would be eliminated.5 Financial 

institutions would be permitted a one-year transition period, after which they 

would receive no safe harbor protection for use of the sample clauses. Privacy 

noticed delivered or posted electronically to meet the annual notice requirement 

would have a safe harbor for one year. Annual notices delivered or posted 

during the one-year transition period would continue to have safe harbor 

protection until the next annual privacy notice is due. 

NAMIC strongly objects to the elimination of the safe harbor for institutions that 

use the sample clauses. The Regulatory Relief Act requires that the model form 

to be an "option" for financial services firms, but does not specifically require that 

it be the sole source of safe harbor protection, nor does the Act require the 

elimination of the sample clauses. 

Financial institutions, particularly insurers, have invested significant resources in 

the development of privacy notices that meet GLBA and state-specific privacy 

and disclosure requirements. Many of these institutions and insurers utilize 

sample clauses and the safe harbor protections provide important legal 

safeguards for these institutions. 

5 The Securities and Exchange Commission's privacy rule does not provide safe harbor 

protection for financial institutions using the sample clauses. The sample clauses; however, 

provide guidance on the application of the rule in ordinary circumstances. During the one-year 

transition period the sample clauses would continue to provide guidance. 
Comments of the National Association of Mutual Insurance Companies 

Re: Interagency Proposal for Model Privacy Form 

May29, 2007 

Page 10 

These protections are particularly important for insurers. It is highly unlikely that 

states will conform their requirements to be consistent with the federal standard. 

Insurers will be faced with the prospect of not having safe harbor protections to 

rely upon at the federal level or having to issue separate notices to meet federal 

and state requirements. This issue is particularly important for smaller and midsized insurers who may not have resources in-house to revise privacy notices 

and ensure compliance in the absence of safe harbor provisions. 

NAMIC urges the Agencies to permit the continued use of sample clauses and 

the corresponding safe harbor protection for insurers. 

Form Content 

In addition to the areas on which the Agencies sought comment, NAMIC would 

like to raise two issues of particular concern to our members. The first issue 

concerns use of a single notice by affiliated institutions. The NRP notes that the 

model form may be used by individual companies or an affiliated group of 

companies; however, it is unclear how these companies would be identified on 

the model form. The limited amount of space on the form raises operational 

issues in listing all the affiliates of many large consolidated financial services 

groups. NAMIC believes that affiliated institutions should be permitted to utilize a 

single privacy notice and urges the Agencies to clarify how the notice can identify 

the covered institutions. 

NAMIC also has a concern with the proposed language on page three of the 

proposed form under "If you want to limit our sharing." The language of the 

proposed form states that "unless we hear from you, we can begin sharing your 

information 30 days from the date of this letter." Under GLBA financial 

institutions must give consumers 30 days from the initial notice to opt-out before 

they can share non-public personal information and to effectuate the opt-out 

within 30 days anytime an opt-out election is received. The language of the 

proposed form is consistent with that requirement. However, in annual notices, 

GLBA does not require financial institutions to suspend disclosure of the 

information if the consumer has not previously opted out and wait for 30 days 

before resuming disclosures. NAMIC members are concerned that the inclusion 

of the statement as written could convey a misimpression to consumers of their 

. opt-out rights and urges the Agencies to revise the language to reflect initial and 

annual notice requirements. 
Comments of the National Association of Mutual Insurance Companies 

Re: Interagency Proposal for Model Privacy Form 

- May 29, 2007 

Conclusion 

Page 11 

NAMIC fully supports the Agencies' efforts to simplify and streamline the privacy 

notice process and to increase consumer understanding. We appreciate that use 

of the model form would be voluntary, but are concerned about the proposal to 

remove the sample clauses. Likewise, we are concerned that the format of the 

form is not flexible enough to meet the different and additional state privacy law 

requirements applicable to insurers, and to permit insurers to appropriately 

disclose their privacy policies and practices. NAMIC also opposes proposals to 

stipulate paper size, the use of single-sided paper and separation from other 

policy and account documents. 

We look forward to working with the Agencies to improve the proposed model 

form and make it appropriate and effective for our nation's insurers and 

policyholders. 

Sincerely, 

Carl M. Parks 

Senior Vice President, Government Relations 

National Association of Mutual Insurance Companies 

122 C Street, N.W. 

Suite 540 

Washington, D.C. 20001 

202-628-1558