COMMENT 

Office of the Comptroller of the Currency 

250 E Street, S.W. 

Mail Stop 1-5 

Washington, DC 20219 

Re: Docket ID OCC-2007-0003 

Mr. Robert E. Feldman 

Executive Secretary 

Attention: Comments 

Federal Deposit Insurance Corporation 

550 17th Street, N.W. 

Washington, DC 20429 

Re: RIN 3064-AD16 

Ms. Mary Rupp 

Secretary of the Board 

National Credit Union Administration 

1775 Duke Street 

Alexandria, Virginia 22314-3428 

Re: RIN 3133-AC84 

Ms. Nancy M. Morris 

Secretary 

Securities and Exchange Commission 

100 F Street, N.E. 

Washington, DC 20549-1090 

Re: File Number S7-09-07, Model Privacy 

Form 

May 29,2007 , , 'f 

Ms. Jennifer Johnson 

' ".:"' -- ~ 

., • I 

('I. -:• ('I 1• , J I 

Secretary -d:. C.- 1 .. .._ -- _:: ~ .. . :. 

Board of Governors of the Federal Reserve 

System 

20th Street and Constitution Avenue, N .W. 

Washington, DC 20551 

Re: Docket No. R-1280 

Regulation Comments 

Chief Counsel's Office 

Office of Thrift Supervision 

1700 G Street, N.W. 

Washington, DC 20552 

Attention: OTS-2007-005 

Re: Docket ID OTS-2007-0005 

Federal Trade Commission 

Office of the Secretary 

Room 135 (Annex C) 

600 Pennsylvania Avenue, N.W. 

Washington, DC 20585 

Received CFTC 

Records Section 

os/.:lo/o1 

Re: Model Privacy Form, FTC File No. 

P034815 

Ms. Eileen Donovan 

Acting Secretary of the Commission 

Commodity Futures Trading Commission 

Three Lafayette Centre 

1155 21st Street, N.W. 

Washington, DC 20581 

Re: RIN 3038-AC04 

RE: Interagency Proposal for Model Privacy Form; 72 Federal Register 14940, March 

29,2007 

Dear Sir or Madam: 

The Financial Services Roundtable and BITS appreciate the opportunity to comment on 

the proposed model privacy form. The Financial Services Roundtable represents I 00 of the 
Interagency Proposal for Model Privacy Form 

May 29,2007 

Page 2 of8 

nation's largest integrated financial services companies. Roundtable members provide banking, 

insurance, investment products and services to American consumers and businesses. Roundtable 

member companies manage over $18.3 trillion in assets, have revenues in excess of $670 billion, 

and employ over 2.1 million individuals. BITS is an affiliate of the Roundtable that serves as a 

forum for the financial services industry on e-commerce, risk management, payments and 

technology issues. 

General Comments 

Members of the Roundtable have been long-standing proponents of simplified privacy 

notices. In 2001, shortly after the culTent privacy notice requirements became effective, 

Roundtable members presented a series of recommendations on short-form privacy notices at a 

workshop sponsored by the Federal Trade Commission.' Subsequently, the Roundtable urged 

Congress to simplify privacy notices, initially as part of the renewal of the Fair Credit Reporting 

Act, and more recently as part of regulatory relief legislation. 

Our support for simplified, short-form notices has been based upon extensive market 

research on short~form notices by Roundtable member companies. Appendix A includes several 

versions of short-form privacy notices developed by our "Short-Form Notice Working Group." 

Many Roundtable member companies currently use these forms, or variations of them, in 

conjunction with more detailed forms that are available upon a customer's request. Our member 

companies also regularly solicit feedback from customers and refine their privacy notices based 

upon that feedback. 

Given this background, we obviously were pleased that Congress provided for the 

development of a model privacy form in Section 728 of the Financial Services Regulatory Relief 

Act of2006. We also appreciate the significant amount of time and effort your agencies have 

devoted to this matter, even before the passage of that Act. 

It is clear that Congress, your agencies, the financial services industry and consumers 

share a common goal -the creation of a simple, consumer-friendly privacy notice. The model 

form proposed by your agencies in response to Section 728 of the Financial Services Regulatory 

Relief Act of 2006 is a step toward the realization of this goal. 

However, we are concerned that, in its proposed form, few, if any members of the 

Roundtable will use the model. The prescriptive nature of the proposed model form will make it 

impossible for most institutions to explain their privacy policies and practices fully and 

accurately. Inconsistencies between the proposed model form and the terms of the Fair Credit 

Reporting Act will confuse and mislead customers. The lack of uniform requirements by 

different regulators will prevent affiliates in a diversified company from using the same form. 

The proposed size of the model form will require a new, separate mailing to customers, which 

will impose significant compliance costs for individual institutions, and the industry as a whole. 

1 Industry recommendations on short-form privacy notices were presented during the Federal Trade Commission's 

Industry Workshop on "Effective Financial Privacy Notices" on December 4, 2001 . 

2 
Interagency Proposal for Model Privacy Form 

May 29,2007 

Page 3 of 8 

Greater flexibility in content requirements is needed to better meet the variety of industry 

privacy policies and practices, and to help financial services firms comply with applicable state 

privacy laws. A less prescriptive format is needed to lower compliance costs for financial 

services firms. Uniform requirements among federal regulatory agencies are needed to enable 

diversified financial services firms to use just one form for all customers. Accommodating these 

concerns would greatly enhance the utility of the model form. 

We respectfully recommend that the agencies reissue the proposed model form for a 

second round of comments, after the form has been revised to take into account issues raised in 

this comment period and the results of additional testing. 

Furthermore, we recommend that the proposed model form be a compliance alternative 

for financial services firms, not a substitute for the model clauses contained in the existing 

regulation. This would permit individual financial services firms to determine the most 

appropriate means to comply with the privacy notice requirements of federal and state law. 

Our detailed comments on the format and content of the proposed model form follow. 

Format of the Proposed Model Form 

Cost Impact of Paper Size 

The format of the proposed model form is significantly different than the format currently 

used by most Roundtable members. Most Roundtable members send privacy notices as inserts 

in monthly statements, such as credit card statements. Typically, these inserts are printed on 

paper that is less than full-size (i.e., less than 8.5 x 11 inches), are printed on both sides of a 

single page, and are included in monthly statements that are smaller than 8.5 x 11 inches. In 

contrast, the proposal calls for the privacy notice to be printed on full-size (8.5x 11 inch) paper, 

with printing on only one side of the paper. Thus, the size requirement effectively will force 

institutions to send the form in a separate mailing, not as part of a monthly statement. 

Monthly statements have proven to be the most effective delivery mechanism for privacy 

notices, and customers have become familiar with this format. Sending the notices in a separate 

mailing may inadvertently cause customers to ignore the notices. Also, while the proposal 

suggests that the notice can be satisfied with two pages of paper, many Roundtable members 

share information in a manner that would require the use of a third page to explain a consumer's 

right to opt-out of information sharing. 

A separate, three-page mailing to customers would impose millions of dollars in 

production and postage costs on individual Roundtable member companies. One Roundtable 

firm has estimated that its total costs per customer to deliver the proposed model form would 

increase from $0.06 to $0.44, an increase of nearly 600 percent. Currently, that firm spends 

approximately $900,000 per year to deliver privacy notices. The company estimates that the 

costs to print and mail the proposed notice would be in excess of $6 million. Another 

Roundtable member estimates that a separate mailing to its 4 million customers would increase 

3 
Interagency Proposal for Model Privacy Form 

May 29,2007 

·Page 4 of8 

its costs by more than $2 million annually. When we extrapolate these costs to the entire 

financial services industry, we conclude that the overall cost to the industry to provide the 

proposed model form could easily approach $400 million.2 

We appreciate that the proposed model form was well-received in consumer tests. 

However, the potential benefits of the proposed model form are so overwhelmed by its cost that 

most firms will find it difficult, if not impossible, to justify the use of the form. We strongly 

urge you to test alternative formats that would be less costly. 

Type Size/Font/Color/Logo 

We do not believe that these requirements are necessary. Other clear and conspicuous 

disclosure requirements do not include such standards. In fact, when Regulation Z was modified 

in 1980, type size and font requirements were eliminated. We do support the limited use of color 

and corporate logos. Many Roundtable member companies are associated with particular colors 

and corporate logos. The use of colors and logos on the form will help consumer's identify the 

source of the form, and help to maximize our firms' accountability in the minds of our 

customers. 

Content of the Proposed Model Form 

Inclusion of Certain Supplemental Iriformation 

The proposed model form is more limited in scope than the notices currently used by 

many Roundtable member companies. While the scope of the form is consistent with the goal of 

creating a simple notice, flexibility in the content would allow firms to accurately describe their 

actual practices and thereby enhance the utility of the form for firms and consumers. "Yes" and 

"no" boxes simply are not sufficient to accurately describe the privacy policies and practices of 

most Roundtable member companies. Additional information is needed to provide consumers 

with a meaningful disclosure. Also, we are concerned about the risks that may arise under state 

unfair and deceptive practice laws if the form does not describe an institution's privacy policies 

and practices fully and accurately. 

We recommend that individual financial services firms be permitted to add certain types 

of supplemental information to the form to make the disclosure more meaningful and complete. 

Specifically, we reco'mmend that institutions be able to include information that (i) is related to a 

customer's privacy rights other than those established in the Gramm-Leach-Bliley Act 

("GLBA'') or the Fair Credit Reporting Act ("FCRA''); (ii) accurately explains privacy practices; 

and/or (iii) satisfies applicable state law requirements. 

2 Roundtable members have calculated that it will cost approximately $0.38 to mail each notice. Assuming that over 

one billion notices would be mailed, the total cost to the financial services industry would be approximate $400 

million. 

4 
Interagency Proposal for Model Privacy Form 

May 29,2007 

Page 5 of8 

Information related to a customer's privacy rights beyond GLBA or FCRA could include 

information about applicable state or federal do-not-call requirements, or information on how to 

prevent or respond to identity theft. Many institutions currently include such information in their 

notices. Typically, such information is extremely well received, and appreciated, by consumers. 

Information related to privacy practices could include information such as applying a 

customer's opt-out election to both affiliate sharing and affiliate marketing activities, the 

application of an opt-out for a period greater than five years, or the application of an opt-out to 

closed accounts. The inclusion of such information will permit institutions to disclose their 

privacy policies and practices more fully and accurately. 

Finally, firms should be able to include information required under state laws. This is 

particularly important for insurance firms. Insurers are subject primarily to state law, and in 

order for them to use the model, it is imperative that they be able to address various state 

requirements. For example, many state insurance authorities require privacy notices for 

insurance companies to include information on the collection and use of medical information. 

Without the ability to provide information about state law, insurers will find it impossible to use 

this form and to comply with state law. It also is important for all financial institutions to be able 

to include information about other state laws, such as the Vermont and California laws. 

Otherwise, consumers will not be able to receive all applicable privacy related information in a 

single notice. 

Expanding the notice to permit institutions to include such supplemental information will 

make the notice more accurate, useful, and less confusing to consumers, but should not detract 

materially from the goal of a simple, more uniform notice. 

Joint Use of Proposed Model Form 

The instructions to the proposed model form indicate that it is intended for use by 

individual companies or groups of affiliated companies. However, the prescriptive nature of the 

form does not allow a company to clearly identify affiliates. More specifically, it is not clear if 

the definition of affiliate on page two is intended to be a general definition of the term affiliate, 

or a list of the affiliated companies that are providing the form. Furthermore, if that box is 

intended to identify all of the companies that are providing the form, it may not be large enough 

for many Roundtable member companies. Roundtable member companies are among the 

nation's largest, most diverse financial services firms. As such, they typically have multiple 

affiliates, many more than may be listed in the space provided. We urge the agencies to clarify 

how a group of companies should be identified on the form when the form is intended to apply to 

such a group. 

FCRA 

The box in the table on page one and the optional check box on page three related to the 

sharing of information between affiliates for marketing purposes do not match the requirements 

of FCRA. Section 624 of FCRA does not limit the sharing of information among affiliates, only 

5 
Interagency Proposal for Model Privacy Form 

. May 29, 2007 

Page 6 of 8 

the use of such information for marketing purposes. Additionally, those sections of the model 

form do not acknowledge the various exceptions to Section 624, such as pre-existing business 

relationships. We recommend that the form be revised to conform to the requirements ofFCRA. 

Otherwise, the form could mislead and confuse consumers. Additionally, the utility of the form 

will be enhanced if institutions can use it to disclose both GLBA and FCRA privacy policies and 

practices. 

30-Day Waiting Period 

Page three of the form refers to a 30-day waiting period after which an institution may 

begin sharing information. No such waiting period is required in FCRA or GLBA. We 

recommend that this sentence be eliminated. 

Check Box 

The check box on page three is based upon a mail-in response by a customer. Some 

Roundtable member companies do not offer a mail-in option, but permit customers to 

communicate opt-out choices over the telephone or on-line. We recommend that the form permit 

institutions to acknowledge response options, and that the heading on the check box be labeled 

"Your Choices" rather than "Check Your Choices." 

Other Matters 

Sample Clauses 

We strongly recommend that the existing sample clauses not be replaced with the 

proposed model form. We make this recommendation for several reasons. First, retaining the 

existing clauses is consistent with Section 728 of the Financial Services Regulatory Relief Act of 

2006, upon which the model is based. When Section 728 was crafted, Congress was well aware 

of the existing sample clauses, and did not require that the model be a replacement for them. 

Instead, Section 728 expressly states that the model form is to be an "option" for financial 

services firms. Thus, the model should be a supplementary means to meet privacy notice 

requirements, not a substitute for existing compliance forms. 

Second, many firms, including some Roundtable member companies, have invested 

significant resources into their current privacy notices, and would prefer to use those forms, 

regardless of the safe harbor protections provided by the model form. Those firms should be 

able to continue to select the most appropriate means to comply with the notice requirements. 

Uniformity in Forms 

The model form proposed by the Securities and Exchange Commission ("SEC") is 

slightly different from the form proposed by the other federal agencies. In the form proposed by 

the SEC, the language in the "What" box on page one, and in the third box of "sharing practices" 

6 
Interagency Proposal for Model Privacy Form 

May z9, 2007 

Page 7 of 8 

on page two, is somewhat different than the other agency proposals. While the differences are 

relatively minor, they make it impossible for diversified firms to use a single form for all 

customers. We recommend that the basic requirements in the forms be harmonized, so that the 

form may be used by diversified firms. Alternatively, institutions that are part of diversified 

firms should be able to rely upon the SEC model or a model proposed by another relevant 

agency. 

Web-based Designs 

The Roundtable does not believe your agencies need to develop an on-line form or 

prescribe a specific on-line presentation for the proposed short-form notice. Most Roundtable 

member companies present the GLBA notice along with other information outside the scope of 

GLBA. We see no need to alter these presentations. 

Customer Identification 

Page three of the form proposes to use account numbers to identify customers. This 

approach would be appropriate if privacy preferences were maintained at the account level. · 

However, most Roundtable member companies maintain privacy preferences at the customer 

level. Thus, we recommend that institutions be permitted to determine the most appropriate 

identifier, including Social Security numbers. 

Conclusion 

Without exception, Roundtable members support the objectives of the proposed form. It 

is critical that consumers receive clear and concise information about how we protect and use 

information. However, we have substantial concerns with the form as proposed. The 

prescriptive nature of the proposed form will make it impossible for most institutions to explain 

their privacy policies and practices fully and accurately. Inconsistencies between the proposed 

form and the terms of the Fair Credit Reporting Act will confuse and mislead customers. The 

lack of uniform requirements by different regulators will prevent affiliates in a diversified 

company from using the same form. The paper size requirements will require a new, separate 

mailing to customers, and this will impose significant compliance costs for individual 

institutions, and the industry as a whole. Unless these concerns are addressed, few, if any, 

members of the Roundtable will use the form. 

Greater flexibility in content requirements is needed to better meet the variety of industry 

privacy policies and practices, and to help financial services firms comply with applicable state 

laws. A less prescriptive format is needed to lower compliance costs for financial services firms. 

Uniform requirements among federal regulatory agencies are needed to enable diversified 

financial services firms to use just one form for all customers. Additionally, the proposed model 

should be a compliance alternative for financial services firms, not a substitute for the model 

clauses contained in the existing regulation. 

7 
Interagency Proposal for Model Privacy Form 

May 29,2007 

· Page 8 of 8 

We respectfully recommend that the agencies reissue the proposed form for a second 

round of comments after the form has been revised to take into account issues raised in this 

comment period and the results of further testing. We also recommend that the proposed model 

be a compliance alternative for financial services firms, not a substitute for the model clauses 

contained in the existing regulation. 

ek.:::-1 

President 

BITS 

Sincerely, 

Richard M. Whiting 

Executive Director and General Counsel 

Financial Services Roundtable 

Attachment - Sample Information Sharing Notices & Forms 

8 
~ 

"" 

~ 

~ 

~ 

~ 

~ 

~ 

~ 

~ 

~ 

~ 

~ 

~ 

~ 

~ 

~ 

If\ 

.,., 

~ 

~. 

~ 

~ 

~ 

~ 

~ 

~ 

~ 

~ 

~ 

~ 

~ 

~ 

#; 

~ 

~ 

JiJA 

a 

.. 

• 

~ 

a 

a 

a 

ACME INFORMATION SHARING NoTICE 

Wtto \VE ARE 

This norice describes the privacy practices of ACME Corporation and its companies providing financial 

products and services governed by the laws of the United States of America. 

. •.. . 

INfOR..\ L\TION SHARED 

We share information about you with ACME companies to offer you new products and service$ that may be of 

value to you as well as to offer exclusive discounts on special merchandise and other offers. We share information 

about you with other companies so they can offer you their latest goods and services. along with special discounts 

and selected products and services. 

may not io about yOU our comparues or 

any information about you wjth other ccimP.ani~. To ~rdse any of these choic(s, you !pay mail back 

the artachecl.Information Sh:Ui~g Opr~ut Form below, dick on "choice" at www.xxxX.com, or 

call us at 1-800-xxx-xxxx. . . 

IMPORTANT INFORJivtATION 

Your opt out will apply to each account you specify and remains effective umil r&:Voked in writing. Federal law 

requires us to provide this short-from privacy notice on an annual basis, whether or not you pr&:Viously opted our. 

Pl~as~ remmzbfT that ifyou prroiously opud out an account, you do Mt nud to opt out that account again. 

HO\'\' To CoNTACT Us 

For a copy of AC E's . com fete . privacy notice, y~u may : t I •• ••• 

www.xxxxx.com, or ~ire ro: Consumer DePmmem, ACME Bank, P.O. Box XXXXX. 

Anytown, USA !98XX. The complete privacy notice; explains ce~tain exceptions applicable to yd\lr 

information sharing preferences. 

INFORMATION SHARING OPT-OuT FoRM . 

Jfyou choose not to have your information ihaml. check the appropriate box(es) bekw: 

0 Please do not share credit eligibility information 

about me with ACME companies. · 

0 Please do not share information about me 

with companies outside of ACME. 

I understand that by rmricting information sharing, 

I may not receiv~ infonnation on n~w products 

and urvices that maybe ofinte~st to me. 

Your Name ______________ -------------------------------- As it 11pptan ""your llt'CMlnl 

Your Address -----------------------------

Your Account Number __ ___ _ -______ - _ __ __ __ -__ ___ __ 

Please detach, place in an envelope, and m:Ul to: ACME, P.O. Box XXXX, Anycown, USA 198XX. Or, you may vi•it our· website at wwvi.XXXXcom 

or call us ar·J-800-X:XX-XXX:X. 
INFORMATION SHARING fACTS 

ACME Corporation 

U.S. Deposit, Credit Card, Consumer Finance, 

and Credit Protection Products for Consumers 

lnform_atiori.Gonebteda · • Identification and Contact 

• Transaction and Experience 

• Credit Eligibility 

~---------~--~-----------------~-----------

fn,form;JtiQn Sha·red • Identification and Contact 

wi:thin AOME n~ with 

Other Companies~ · 

• Transaction and Experience 

,·• Credit Eligibility 

... . 

-~-~----~-------------------------------- --

Information Shari:ngi · , • Keep receiving information on . 

Ghoioes~ · ' · :: :.'· special products and offers by · 

, , · , t · ; : not taking any action to opt out -; .• 

·· · · · ':~ . • Prohibit sharing of credit 

. ' r;. :d,_f, eligibility information within 

'::> ; ~; ACME .. ;·.·· 

··: .. · 

• Prohibit sharing of all 

information with other 

companies 

To extness your privacy preferences: 

You may prohibit eiU1er or both types of informat:on sl1aring by ca'ling 

ACME's toll-free automated response line at 1-866-757-1255. We v1ill ask 

you to verify your identity and tho speci~ ic accounts to which your choices 

apply. Please llave your account, membership, or reference numbers (and 

for deposit accounts, your SSN or TIN) available when you call. 

To obtain the complete privacy notice: 

Federal Law requires us to provide this short-form privacy notice 

on an annual basis and provides exceptions allow:ng information sharing 

notwi:hstanding your privacy preferences. You may ll2ve ot11er privacy 

protection under state law. lf you would like to receive a copy of ACME's 

complete privacy notice, please call toll-free 1-800-XXX-XXXX. 
. . 

'\ "'\\~ ~ ,_ '"' C C fi C C C \ C t C C C C t t L t t t t t t t i i i S S 1 t -- . 

•We collect information directly from you and from your transactions with us and others. 

•We obtain information, such as your credit report and demographic and lifestyle information, from 

infonnation providers. 

• We do not share information with others for purposes of marketing their products and services to you. 

• We share information about you within the Acme family both directly and through common databases to 

provide you with products and services, to service your accounts and to manage our business. We only 

share medical or health information with our companies for service. 

•We share information about you with our service providers, credit bureaus, law enforcement and others as 

necessary to perform transactions. 

• You may direct us to limit certain information sharing 

within our family of companies. 

• You may opt out of receiving direct mail, telephone 

and/or e-mail marketing offers from us. 

•To make any of these choices, call 800.xxx.xxxx, go to 

\Vww.xxxx.com or visit a Acme banking center. 

•Contact us for free resource materials on identity theft 

or for help if you become a victim. 

•Contact us for a copy of our full privacy policy. 

For more information about our 

privacy policy: 

•Go to www.xxxx.com., 

click "privacy & security" and 

click "contact us" 

• Call us at 800.xxx.xxxx 
These statements apply to the Acme 

family of companies owned by Acme. 

•We collect information directly from you and from your transactions with us and others; 

•We obtain information, such as your credit report, from information providers. 

• We manage information to serve you. 

• We share information about you within the Acme family to provide you with other products and services. 

•We share information about you \Vith other companies for offers of their products and services. 

• We share information about you with our service providers, credit bureaus and law enforcement. 

• You may direct us not to share information about 

you for non-financial offers. 

• You may direct us to limit certain information sharing 

within our family of companies. 

• You may direct us not to contact you with offers. 

•To make any of these choices, calll-800-XXX-XXXX. 

•Contact us for free resource materials on identity theft 

or for help ifyou become a victim . . 

•Contact us for a copy of our full privacy policy. 

• Go to www.chase.com., 

click "privacy & security" and 

click "contact us" 

• Call the Chase Privacy Hotline at 

I- 800- xxx~xxxx. 
rr-

~ 

r4 

~ 

~ 

4 

... 

.. 

... 

... 

... 

... 

.. 

... 

... 

~ 

... 

... 

... 

.... 

... 

_. 

.. 

... 

• A 

--

A 

A 

... 

.A 

A 

.,A 

..a 

..,. 

... 

-a 

.... 

...!a 

This statement applies to Acme 

Company and several members of the 

Acme family of companies . 

We collect information directly from you and maintain information on your activity with us, 

including your visits to our website . 

We obtain information, such as your credit report and demographic and lifestyle information, 

from other information providers . 

We use information about you to manage your account and offer you other products and services 

we think may interest you . 

We share information about you with our sister companies to offer you products and services. 

We share information about you with other companies, like insurance companies, to offer you a 

wider array of jointly-offered products and services . 

We share information about you with other companies so they can offer you their products and 

You may opt out of receiving promotional 

information from us and our sharing your 

contact information with other companies. To 

exercise your choices, call (800) 123-1234 or 

click on "choice, at ACME.com. 

You may request information on your billing 

and payment activities. 

For more information about our privacy 

policy, write to: 

Consumer Department 

Acme Company 

11 Main Street 

Anywhere, NY 1 01 00 

Or go to the privacy statement on our 

website at acme.com.