BankofAmerica ~ 

Received CFTC .~ Records Section 

oS(Jo lo7 Bank of America Corporation 

DES-00 1-05-07 

May 29,2007 BY ELECTRONIC MAIL 

Office of the Comptroller of the Currency 

250 E Street, S.W. 

Mail Stop 1-5 

Washington, DC 20219 

RE: Docket ID OCC-2007-0003 

Dear Sir or Madam: 

COMMENT 

Bracebridge I 

1100 N. King Street 

Wilmington, DE 19884 

0 

.. , ) ) I 

L' 

- - _, 

r·· N {. " 

I 

c. . ...., ..... - I' I - -: .r·:: 

:;.._-. 

. 

:: .. \.·.} 

Bank of America Corporation ("Bank of America") appreciates the opportunity to 

comment on the Interagency Proposal for Model Privacy Form under the Gramm-Leach-Bliley 

Act (the "Model Proposal") issued by the Office of the Comptroller of the Currency (OCC); the 

Board of Governors of the Federal Reserve System (Board); the Federal Deposit Insurance 

Corporation (FDIC); the Office of Thrift Supervision (OTS); the National Credit Union 

Administration (NCUA); the Federal Trade Commission (FTC); the Commodity Futures Trading 

Commission (CFTC); and the Securities Exchange Commission (SEC) and collectively, the 

"Agencies." 

Serving individual consumers, small and middle market businesses and large corporations 

with a full range of banking, investing, asset management and other financial and riskmanagement products and services, Bank of America is one of the world's largest financial 

institutions. The company provides unmatched convenience in the United States, serving more 

than 56 million consumer and small business relationships with more than 5,700 retail banking 

offices, more than 17,000 A TMs and award-winning online banking with nearly 22 million 

active users. 

We would like to compliment the Agencies on their desire to discern clarity of language; 

to better understand priorities in customer's use of information contained in the privacy notice; 

and to present content in an uncluttered format that is easy-to-read. These objectives are 

consistent with our priorities in sharing our privacy practices with consumers in a manner that 

bu_ilds trust and understanding. 

Bank of America has participated in industry organizations, peer forums and other similar 

events and it is clear that there is broad industry consensus on several of our views. As a leading 

financial institution in the privacy discussion, we want to add our voice to this issue. To the 

extent that a Model Form is adopted, a less prescriptive format that balances the needs of 

-~ 

) rr 

., 0 . ' 1'1 

·-: .. , .. .._ 

:J I'l 
Interagency Privacy Model 

May 29,2007 

·page 2 

financial institutions to accurately and clearly disclose practices with the customers' preference 

for brevity and readability would be more appropriate. Specifically, we believe there are four 

fundamental issues that warrant comment. 

• Model Form is not flexible enough to accommodate different sharing practices within the 

same legal entity. 

• Model Form limits the ability to clearly and accurately describe practices and/or forces the 

omission of information that customers say is important to them. 

• Model Form's scope would prevent the inclusion of other privacy-related disclosures 

beyond GLBA and FCRA. 

• Potential benefits of the Model Form design would be overwhelmed by the potential cost 

and environmental impacts. 

Model Form Flexibility 

Bank of America uses one privacy policy across a large number of affiliates, minimizing 

risks and costs associated with multiple policies. As proposed, the Model Form does not 

accommodate a variety of our privacy practices. For example: 

• Bank of America operates under both a "share" and "no share" practice with non-affiliates, 

depending on product. The Model Form, which prescribes only a "yes" or "no" position on 

information sharing practices, does not contemplate such situations and, as is, prohibits 

complex organizations from attaining safe harbor. 

• Our application of information sharing opt-outs varies between affiliate and non-affiliate 

sharing. To accommodate a customer base with multiple credit cards, some of which may 

be sponsored by an affinity or special interest organization, we observe third party sharing 

opt-outs at the account level; affiliate sharing preferences, however, are applied at the 

customer level. As drafted, the Model Form would not allow us to inform customers of 

such differing practices. 

• With one policy applying to a large number of affiliates, many with different names and 

specialties, the Model Form does not provide space to list all of the Bank of America 

affiliates for which the policy applies. 

We respectfully request the Agencies consider recommending a safe harbor solution that 

addresses the complexities and differing privacy practices common within the financial industry. 

Without such a safe harbor, widespread adoption of the Model Form is less likely to occur. 

Model Form Clarity 

We understand the motivation of making the language in the Model Form simpler based 

on research and general public studies. In fulfilling this desire, the Model Form may 

inadvertently be detrimental to consumers' understanding. It is ineffective in conveying some of 

the more subtle points of the law and has introduced new requirements that have not been fully 

explained or vetted. This is evidenced in the Model Form's section on affiliate sharing which 

incorrectly references a limitation on sharing amorig affiliates for marketing; FCRA limits the 

use of information for marketing, but it does not limit the sharing of all information. Also, the 

30-day waiting period referenced in "Contact Us" is a new requirement, and it is unclear how it 

will apply when used in an annual notice; thus creating potential variation in its application 

among financial institutions, and potentially leading to customer confusion. 
Interagency Privacy Model 

May 29,2007 

"Page 3 

In addition, the brevity, albeit directionally correct, restricts the ability to provide 

examples that drive clarity and help consumers make informed choices. The use of examples 

lengthens a privacy policy, but the trade-off is enhanced understanding. To help customers better 

understand our sharing practices, examples of the types of organizations and situations are 

provided with which information may be shared. Periodically, Bank of America receives 

reactions to our Privacy Policy from customers and many items not included in the Model Form 

are cited as valuable, such as information unique to Bank of America regarding how we protect 

and manage consumer sensitive information; tips for Guarding Your Own Information and 

privacy-related external information sources, e.g., National Do Not Call list and Credit Bureaus. 

All these issues are symptomatic of the prescriptive nature of the Model Form. It limits 

Bank of America's ability to accurately disclose information, may inhibit customer 

understanding and may remove the flexibility to include information our customers have 

indicated is useful. 

Model Form Disclosure Inclusion 

The Model Form makes no provision for including other disclosures. Currently our policy 

includes reference to specific state law requirements and serves as our "Do Not Call" policy. Of 

particular note, GLBA allows states to impose more restrictive sharing standards, yet the Model 

Form does not accommodate adequate disclosure of such requirements. If Bank of America were 

required to restrict privacy disclosures to just GLBA-related elements, we would be compelled to 

address several other disclosure requirements through additional customer communications, 

increasing costs due to print and distribution, increasing risk due to more and varying disclosures 

required at account opening and increasing customer dissatisfaction and confusion. 

Model Form Design 

The Model Form would impose increased operating costs for Bank of America while 

providing information in a manner that is likely to have negative environmental impacts in paper 

consumption. The use of 8 Y2 x 11 inch sheets mandates multiple one-sided pages which may 

exceed the Model Form's three pages if an institution has a large number of affiliates. 

In addition, Bank of America, similar to other financial institutions, meets the annual 

notification requirement by delivering the policy in customer statements; a practice which will 

not be possible to continue. This change would result in a separate mailing and increase the cost 

of annual notification by more than three-fold. 

If a separate SEC Model Privacy Form is required for financial institutions with SECregulated affiliates, many customers would receive two versions of the company's privacy policy 

which at best, would be potentially viewed as of little value or even confusing to customers. 

Alternative designs with less rigidity would meet the needs of an industry with diverse 

privacy policies and practices while still satisfying the information needs of customers. 
Interagency Privacy Model 

May 29,2007 

'Page 4 

Summary 

Bank of America concurs with the principles espoused in the Regulatory Relief Act* that 

have culminated in this privacy policy enhancement initiative. We believe that a better approach 

may be derived through additional thoughtful and diverse discussion. To that end, we urge the 

Agencies to both consider the comments they receive and the additional consumer research 

planned, and then issue a revised proposal for further comment. A less prescriptive format that 

balances the needs of financial institutions to accurately and clearly disclose practices with the 

customer's preference for brevity and usability would be universally beneficial. 

We also respectfully request that the Agencies retain the current safe harbor clauses. We 

think that those clauses will still be of value for institutions that cannot use the Model Form. 

We would be happy to discuss our views in greater detail or to discuss other ideas that the 

Agencies would like to pursue. 

Sincerely, 

Michelle Shepherd 

Senior Privacy Executive 

Bank of America Corporation 

302.432.1088 

*Regulatory Relief Act, Section 728 directs that the Model Form shall be comprehensible to consumers, with a clear 

format and design; provide for clear and conspicuous disclosures; enable consumers easily to identify the sharing 

practices of a financial institution and to compare privacy practices among financial institutions; and, be succinct, and 

use an easily readable type font. 

CC: 
Interagency Privacy Model 

May29, 2007 

'Page 5 

Mr. Robert E. Feldman 

Executive Secretary 

Attention: Comments 

Federal Deposit Insurance Corporation 

550 1 ih Street, N.W. 

Washington, DC 20429 

RE: RIN 3064-AD16 

Ms. Mary Rupp 

Secretary of the Board 

National Credit Union Administration 

1775 Duke Street 

Alexandria, Virginia 22314-3428 

Re: RIN 3133-AC84 

Ms. Nancy M. Morris 

Secretary 

Securities and Exchange Commission 

Commission 

100 F Street, N.E. 

Washington, DC 20549-1090 

Re: File Number S7-09-07, Model Privacy Form 

Ms. Jennifer J. Johnson 

Secretary 

Board of Governors of the Federal Reserve 

System 

20t11 Street and Constitution Avenue 

Washington, DC 20551 

Re: Docket No. R-1280 

Regulation Comments 

Chief Counsel's Office 

Office of Thrift Supervision 

1700 G Street, N.W. 

Washington, DC 20552 

Attention: OTS-2007 -005 

Re: Docket ID OTS-2007-0005 

Federal Trade Commission 

Office of the Secretary 

Room 135 (Annex C) 

600 Pennsylvania Avenue, N.W. 

Washington, DC 20580 

Re: Model Privacy Form, FTC File No. 

P034815 

Ms. Eileen Donovan 

Acting Secretary of the Commission 

Commodity Futures Trading 

Three Lafayette Centre 

1155 21st Street, N.W. 

Washington, DC 20581 

Re: RIN 3038-AC04