• 

~ IW 

r r:-c ·I ~ . - J - ...... - ·--

. . ' · 

American Insurance Association 

!'· ')6 . ) 

Received CFTC 

Records Section 

osl3o lo1 COMMENT 

Office of the Comptroller of the Currency 

250 E Street, S.W.; Mail Stop 1-5 

Washington, DC 20219 

Docket Number OCC-2007-0003 

Jennifer J. Johnson 

Secretary, Board of Governors of the 

Federal Reserve System 

20th Street and Constitution Avenue, N.W. 

Washington, DC 20551 

Docket No. R-1280 

Regulation Comments 

Chief Counsel's Office 

Office of Thrift Supervision 

1700 G Street, N.W. 

Washington, DC 20552 

Attention: OTS-2007-0005 

Mary Rupp 

Secretary of the Board 

National Credit Union Administration 

1775 Duke Street 

Alexandria, VA 22314 

1130 Connecticut Ave. NW 

Suite 1000 

Washington, DC 20036 

202-82!\-7100 

Fax 202-293-1219 

www.aiadc.org 

May 29,2007 

Federal Trade Commission/Office of Secretary 

Room 135 (Annex C); 600 Pennsylvania Avenue 

Washington, DC 20580 

FTC File No. P034815 

Robert E. Feldman 

Executive Secretary, 

Federal Deposit Insurance Corporation 

550 171h Street, N.W. 

Washington, DC 20429 

Attention: Comments 

Nancy M. Morris 

Secretary 

Securities and Exchange Commission 

100 F Street, N.E. 

Washington, DC 20549 

File Number: S7-09-07 

Eileen Donovan 

Acting Secretary of the Commission 

Commodity Futures Trading Commission 

1155 21 st Street 

Washington, DC 20581 

Re: Model Privacy Form - Interagency Proposal for Notice 

under the Gramm-Leach-Biiley Act 

Dear Ladies and Gentlemen: 

The American Insurance Association (AlA) is a trade association which represents property and 

casualty insurers doing business across the country and around the world. Although the proposing 

agencies are not the functional regulators of insurers, insurers are "financial institutions" under the 

Gramm-Leach Bliley Act (GLBA). Some integrated financial institutions do business across multiple 

sectors of the industry- banking, securities and/or insurance. As such, the Interagency Proposal for 

a Model Privacy Form (Proposed Model or Proposed Form) interests AlA members. 
It would be a disappointing irony for the same legislation that enabled the existence of truly 

integrated financial institutions not to provide safe harbor status to one single integrated privacy 

notice for such institutions. As drafted, the Proposed Model appears to be aimed mostly at 

depository institutions. For other sectors of the financial services industry to consider using the 

Proposed Form it must be modified to be meaningful for their business. While the insurance 

industry presents unique concerns given the manner in which it is regulated, there may be ways to 

take some of these concerns into account when drafting the text and when outlining the rules to 

govern the Proposed Model. These comments are organized in three sections: content concerns, 

formatting concerns and safe harbor status. They are followed by an Appendix showing suggested 

alternative language for your consideration. 

A. Content of Proposed Model Form 

1. Overview - Content of Model Form 

In order for various types of financial institutions to be able to take advantage of the safe harbor 

notice and for that notice to provide meaningful and accurate information to customers, the model 

notice should: 

• contain terms that are generic with applicability across sectors; 

• provide a limited menu of alternatives, from which the institution may select those that 

make sense for their business; 

• allow an institution to omit words or phrases that are inapplicable to its business or 

practices; and/or 

• allow the institution the freedom to tailor its notice as necessary, within the structure of the 

model notice form. 

For example, activities like "deposit[ing] money" or "apply[ing] for a loan" do not make sense in an 

insurance context. However, "applying for services" or "initiating transactions" are general 

descriptions that make sense for our industry as well as others. 

A more standardized format may aid the reader. However, to really meet the intent of GLB privacy 

provisions, the notice should allow financial institutions to convey information in a way that provides 

meaningful choice. Indeed, according to the House Committee Report from June 15, 1999, 

disclosure rules are to be aimed at permitting "customers to readily compare differences in the 

privacy practices and policies among financial institutions."1 Too much boilerplate language takes 

away some of the basis for customers to compare privacy practices. 

Of course, this approach cannot be effectively implemented under a take-it-or-leave-it safe harbor. 

A mandate that the entirety of the notice be taken verbatim from the Proposed Form disregards 

differences in sectors of the industry, in privacy and business practices and in ways of 

communicating with customers. Modifying the proposed safe harbor form to allow for greater 

flexibility is in everyone's best interest - customers get a better idea of the kind of sharing they are 

to expect and financial institutions can feel more secure that the notices they are sending more 

accurately reflect their business practices. 

2. Essential Suggested Revisions - Content of Proposed Model 

Below AlA discusses the most crucial concerns with the Proposed Model. 

1 See, H.R. Report No. 106-74, at 107 ( 1999). 

- 2 -
WHAT? Not all financial institutions collect customers' Social Security numbers or income 

information. To include them where they are not collected or shared would not only 

be inaccurate, but may cause customers undue concern. 

Not all financial institutions call their products "accounts." The term "transaction 

history" may be suitable to several sectors and cover the applicable activities. 

Similarly, reference to closing an account could be better phrased other ways like 

"when you are no longer a customer." The final sentence in this area could be simply 

put: 'We apply the same practices to current and former customers." 

Financial institutions are not required to give former ·customers annual notices. 

However, their privacy notice must indicate how they treat former customers -there is 

no requirement that they be treated identical to existing customers.2 

"Information from consumer reports" could replace "credit history and credit scores." 

Many financial institutions gather information from consumer reporting agencies. 

Such collected information may be broader than credit information. For example, in 

the property and casualty insurer context it may also include loss history reports and 

motor vehicle reports. 

As drafted, the Proposed Model contains no definition of "personal information." That 

term does not include data that is publicly available; the notice could indicate that the 

information at issue is nonpublic. Additionally, a financial institution should have the 

ability to specify that it is addressing only "financial" information in this notice. Or, it 

should have the ability to tailor this notice to address all its privacy notice 

requirements under state and federal law. Please see the safe harbor remarks below. 

HOW? The Proposed Model should not only address whether a customer may limit sharing, 

but also its use. An institution may want to go beyond addressing sharing to include 

collection and use in order to provide a complete description of its organization's 

practices regarding personal information. 

REASONS With respect to "For our affiliates to market to you," a complete response also needs 

to take "use" into account. 

The term "creditworthiness" does not apply across financial services sectors. Perhaps 

a number of alternatives could be available to institutions, including "insurability." Or, 

if a more generic term is preferred, maybe "transactional experience" is useful. Or, 

perhaps consider "information other than information about your transactions with us." 

Further, since "everyday business purpose" is defined, this may not be necessary. 

See below. 

With respect to the reference to nonaffiliates, the ability to limit does not extend to 

activities such entity engages in on behalf of the financial institution.3 The Proposed 

Form should be modified to make this clear. 

2 See NAIC Model Privacy Regulation Sections 6(8)(1 ) and 7(A)(4). 3 See Section 13(b) of the Federal GL8 Regulations and Section 14(8 ) of the NAIC Model Privacy of Consumer Financial and 

Health Information Regulation. 

- 3 -
CONTACT Not every financial institution grants its customers the opportunity to opt out via phone 

number. Federal law does not require financial institutions to accept requests to opt 

out in any particular medium. Also, some financial institutions may prefer to have 

customer information sharing decisions in writing. Therefore, the proposed notice 

form should not mandate the inclusion of telephone numbers, web addresses or any 

other particular mode of contact. 

The 30 day language assumes that is the "reasonable" amount of time under the law. 

The law does not require financial institutions to grant their customers any particular 

amount of time to exercise that opportunity. 

More importantly, the 30 day language could be read to apply to both the annual 

notice and the initial notice. However, it should apply only to initial notice because the 

law does not require a yearly moratorium. Therefore, it is neither appropriate that a 

model form mandate a moratorium against sharing information for any particular 

amount of time nor that it force financial institutions to cease sharing information when 

providing their annual notices if their customers did not previously opt out of the 

sharing. 

SHARING The term "account" will not be applicable for all financial products and services. With 

this in mind, the question of how often the notice is required should be rephrased, 

perhaps in terms of "when you first become a customer." 

The legal data security requirements are framed in terms of "administrative, 

procedural and physical safeguards." Therefore, rather than mention "secured files 

and buildings" it is more accurate to reference "physical safeguards." 

The information supplied relating to the timing for collecting personal information 

should allow for using the terms applicable across the financial services industry. For 

example, terms like "initiate transactions with us" or "apply for services with us" are 

more generic than "open an account or deposit money" which seem bank-oriented. 

Similarly, "applying for a loan" would not apply in the insurance context. 

If the field dealing with reasons all sharing cannot be limited is retained, despite 

concerns mentioned below, please consider the difference between sharing and use 

discussed in HOW above. 

DEFINITION On the one hand it looks like a financial institution may indicate the "categories of its 

affiliates," but on the other it seems that a specific format must be used. Flexibility is 

very important here. Consider, for example, an integrated financial services company 

which may want to describe the business of the kinds of affiliates with whom it may 

decide to share - securities, lending, life insurance, and/or property and casualty 

insurance. The currently proposed limited format for listing affiliates is too restrictive. 

In this way, the Proposed Model may disallow an approach that comes closer to 

fulfilling the intent of the GLB notice obligations. Through a description of the kind of 

internal sharing, the customer will get a better sense of the kinds of entities with whom 

its company is sharing (as compared to sample list of affiliate names). 

CHOICES The opt-out portion of the notice is over simplified. 

-4 -
The proposed model does not contemplate a partial opt out, where a financial 

institution may allow the customer to select a choice to limit some but not all kinds of 

sharing and some but not all kinds of nonpublic personal information. 

With respect to the first check box, "creditworthiness" alone does not take into account 

the non-lending activity of financial institutions. This entry also does not make it clear 

that transaction experience may be shared regardless. 

With respect to the second check box, consider that a customer may have 

relationships with multiple affiliates within a family of companies. The notice should 

not lead the customer to believe that it may choose to restrict in those instances, but 

rather only with those affiliates with whom it does not have a relationship. 

Also, current law does not require a "renewal notice" after 5 years. Rather, it indicates 

that the financial institution has the option to approach the customer with another 

privacy notice in 5 years. From an operational perspective, a financial institution may 

find it easier to treat a customer's opt out as a permanent election rather than to treat 

it as expiring in 5 years. The financial institution should not be forced to ask the 

customer her opt out decision again. 

With respect to the third check box, the nonaffiliated opt out should be limited to nonfinancial activity, since financial activity would fall within the joint marketing exception.4 

3. Other Important Suggested Revisions- Content of Proposed Model 

(a) Flexibility 

There are numerous instances throughout the form where it would be helpful for financial institutions 

to tailor their notices to emphasize features of their privacy practices. The form will allow customers 

to compare privacy policies while still giving them choice in the marketplace. Identical wording for 

notices provided by every financial institution is not required - or even necessarily contemplated -

by the federal law. Nor does identical wording provide customers any meaningful basis for 

comparing the privacy policies of the financial institutions. Some flexibility within the context of the 

safe harbor format would allow for the institution to convey non-prescribed information. This kind of 

adaptable template is not only less rigid, but it benefits everyone involved. 

Flexibility is not just a matter of preference; it may be needed for financial institutions to comply with 

state laws. For instance, approximately 16 states have privacy laws which mandate insurers to 

provide customers with notice of their "access and correction" rights.5 Other states require 

disclosures about practices relating to medical information. Additional!¥, there are small, but 

necessary, deviations in state-required language, as is the case in Montana. 

The need for adaptability does not all arise from substantive legal requirements addressing notice 

content. Also consider format requirements. For example, the California specific opt-in/out form 

4 See 15 U.S.C. Sec. l681 s-3. 5 See the NAIC Insurance Information and Privacy Protection Model Act (1 982). 6 See MCA 33-1 9-307. 

- 5 -
wording and envelope requirements do not match those contained in the Proposed Model.7 Further, 

the California form must have a readability score of 50.8 Other states have font requirements. 

Variable text, allowing for flexibility, is shown in the attached Appendix by brackets [ ). Also, please 

see discussion below about ali-or-nothing safe harbor approach. 

WHY? 

WHAT? 

This field is not mandated by GLBA, but it may provide a useful context about the 

reason for the notice. Some financial institutions may want to describe their 

relationship, the applicable law (perhaps including state law), their practices and the 

notice obligations to their customers in their own words. 

Notice should only be required to be provided to someone with whom an institution 

has a business relationship. For insurers, such people are "customers" as 

distinguished from "consumers." 

Allowing financial institutions the ability to tailor the bullet points to reflect their actual 

practices will make for more accurate notice and for more meaningful customer 

choice. For example, insurers may also want to refer to things like past insurance 

claims or reports of accidents as well as home inspections. By tailoring the 

information to better match the kind of sharing, the customer will have a fuller 

understanding of the information collected and shared. Within the structure of a 

common template, the financial institution should have the flexibility to describe its 

practices to those with whom it has a business relationship. 

Historically, a financial institution may have carefully crafted its notices to reflect the 

information gathering process to provide the customer with a context for the collection 

and use of nonpublic personal information. It should continue to be able to convey 

this kind of information- and with the peace of mind of being within a safe harbor. 

To the extent the Agencies are willing to allow for a menu approach for integrated 

financial services companies, the securities-related "assets and investment 

experience" should also appear on this list. 

WHAT/HOW Consider whether the statement about former customers more closely fits with the 

information conveyed in the HOW section of the Proposed Form. 

WITH WHOM A financial institution may decide it will be easier for the customer to understand why 

sharing would occur with any of the listed parties if there is further explanation. Since 

this may aid in their understanding, this option should be allowed. To illustrate, under 

the affiliate heading, a company might provide examples like "sharing with affiliates in 

order to provide the product or service best suited to your needs." Also, under the 

nonaffiliated heading, a company might include "sharing with other companies in order 

to process your payments, respond to government or other legal requests or provide 

other services you request." Finally, under joint marketing, examples may include 

"providing you the opportunity to investigate other products or services you may find of 

interest." (See DEFINITIONS comment below for more discussion of WITH WHOM.) 

7 See Cal. Code Regs. tit. 10, Sec. 2689.8. 8 See Cal. Code Regs. tit. 10, Sec. 2689.4(6). 

• 6 -
Personal lines property and casualty coverages are often written under separate 

policies through separate companies - customers may not just be placed into a 

particular tier within one company, but into one company within a group. An 

underwriter generally is not an employee of only one insurance affiliate. He typically 

looks at a whole package or range of options across the family of companies and not 

just at a particular writing company - the writing company is more of a technicality. 

This occurs for several reasons, but is in large part due to the nature of state 

regulation. Even very restrictive legislation such as California Senate Bill 1 

recognized sharing within the context of companies under common management (or 

companies sharing one managing group, with only one company having employees). 

To the extent there are not separate employees among affiliated insurance 

companies, there is no transfer of knowledge. A financial institution may want to 

explain the nuances of the issuing/managing company environment. For example, it 

may want to express that within the family of companies the same processing systems 

and employees are used to maintain coverage. 

REASONS Financial institutions should have the flexibility to provide more detail than a "yes" or 

"no" answer in order to provide customers with more accurate responses. Customers 

are more likely to get a better understanding of a financial institution's privacy 

practices if the institution is given the opportunity to provide more detail, making the 

notices more meaningful and understandable. 

SHARING The information relating to how information is collected is another area where it would 

be helpful for institutions to be able to provide the information that makes the most 

sense in the context of their business. Furthermore, it may be useful to insert a 

placeholder for optional additional questions and answers, which a financial institution 

feels aids it in describing its practices to its customers. 

DEFINITION To the extent the "everyday business purposes" definition is maintained, consider 

expanding the options to allow for "contract administration" as well as for a variable 

field. At present, the list does not necessarily include a broad sample of insurer uses. 

In terms of improving readability, consider adding a WITH WHOM area to the form 

and removing the DEFINITIONS all together. Customers may not pay as much 

attention to a seemingly technical "Definitions" section as they would a section that 

gets at where their information is going. The everyday business purpose is already 

addressed under HOW and REASONS and could be modified slightly in those areas. 

MULTIPLE References to affiliates and nonaffiliates appear in a number of places in the 

Proposed Model. See REASONS, DEFINITIONS and CHOICES. A financial 

institution may want to use words to describe the corporate ownership relationship 

that it may believe will be less technical for the customer. For example, it should have 

the flexibility to refer to sharing "with affiliates" as "among XYZ companies" and "with 

nonaffiliates" as "outside of the XYZ family of companies." 

CHOICES Under the Proposed Form, a financial institution may not offer its customers the ability 

to partially opt-out of sharing certain types of nonpublic personal information or certain 

nonaffiliated third parties. To the extent there is no place to accommodate a partial 

opt-out, the form lacks adequate flexibility. 

(b) Streamlining 

- 7 -
It will cost more money to produce a three page notice than to produce a two page notice (which a 

financial institution should be able to choose to print on the front and back of a single page). It 

would be an extremely useful exercise to go through the entire notice with an eye toward removing 

unnecessary words in order to bring the document down to two pages. Also, redundancies in the 

proposed model can be removed, shortening the document, while providing customers with the 

same substantive information. The difference between two and three pages, in the huge numbers 

of notices that will be sent, will be expensive. 

HOW The introductory phrase "in the section below" could be changed to "below," just as 

one example of a simple change to conserve space. 

Given the "everyday business purpose" suggestion under REASONS below, consider 

adding "such as" to describe the functions under HOW. 

CONTACT Consider whether there is really a need for two separate CONTACT US portions of a 

three page notice. 

SHARING Consider removing the block outlining why all sharing cannot be limited. The 

information provided here is redundant with the WHY entry as well as the final three 

items under REASONS. 

Many states also have data security requirements for at least some financial 

institutions; perhaps the word "federal" is not needed. 

This section deals with more than "sharing practices." Consider whether another title 

will better reflect the information provided. 

DEFINITION The definition of "everyday business purposes" should be clear that it relates to 

running the business and managing accounts/contracts. There is no need to provide 

examples here. There are already some provided within the text of HOW. 

B. Format & Operational Concerns with Proposed Model Form 

1. Overview - State Requirements 

For those subject to state notice laws who may be interested in trying to work with the proposed 

model, there needs to be the flexibility to develop a notice that will satisfy state requirements as well. 

For this reason, there may be instances where the format or other items should allow for some 

degree of flexibility. (See font size discussion below.) Given that deviations from the model may 

impact safe harbor status, thinking through these concerns ahead of time and allowing for flexibility 

going forward is essential. 

2. Format/Operational Concerns 

(a) Separate Pages 

Financial institutions should have the option of using both the front and the back sides of the pieces 

of paper used in the notice. To mandate otherwise will waste money - and, indirectly in at least 

some instances, customers' dollars. As indicated above, it would be cost efficient - and possible 

without jeopardizing notice content -to develop a two page notice instead of a three page notice. 

- 8 -
Consider environmental conservation. "Businesses should support a precautionary approach to 

environmental challenges; undertake initiatives to promote greater environmental responsibility; and 

encourage the development and diffusion of environmentally friendly technologies."9 Many U.S. financial 

institutions have ties to global organizations. They may not only commit to complying with these 

principles - by reducing the environmental impact of their business - but they may also communicate 

such commitment to their customers and shareholders. Printing privacy notices on only one side of a 

page contradicts these principles and commitments. 

(b) Separate Mailing 

To the extent the Agencies are considering requiring a separate mailing - and disallowing financial 

institutions from incorporating the Proposed Form into another document - costs will be higher. 

There is no reason to believe that customers will pay more attention to the contents of an envelope 

designated as containing privacy notices than they do to mailings containing documents relating to 

their business with the financial institution. 

(c) Logos & Color 

Financial institutions should be permitted the opportunity to include their logo on their privacy 

notices. The logo may help the customer better understand the corporate brand or the group of 

affiliated companies at issue. Indeed, in many instances, the customer may better identify the logo 

than the particular affiliate with whom it has a relationship. Because the opt out form asks for · 

personal information, customers may in fact be more comfortable if they are able to recognize the 

document as really coming from the financial institution with which they do business. Use of logo 

should not interfere with readability. 

(d) Font Size 

The Proposed Form specifies particular font sizes for the different parts of the text. Consider that a 

state may require institutions to supply their opt-out notices in a particular size. Rather than risk 

non-compliance, it would be helpful for the proposal to state the minimum text size. 

(e) Web Designs 

Financial institutions do not need guidance on privacy notice web design. 

(f) Paper size 

A financial institution should be permitted to use whatever size paper it decides is appropriate. 

(g) Downloadable Form 

It may be helpful for the Agencies to supply a downloadable form to facilitate use by financial 

institutions. 

C. Safe Harbor Status and Sunset of Existing Safe Harbor 

(a) Replacement of Existing Safe Harbor After One-Year Transition 

9 Principles of the United Nations Global Compact, pp. 2, 8. 

- 9-
Existing sample clauses serve as useful guidance to financial institutions and should be maintained 

as alternatives. The Proposed Model should serve as an additional option for institutions as they 

craft their privacy notices - safe harbor status for existing sample clauses should be maintained. 

This approach is consistent with the wording of Section 728 of the Financial Services Relief Act of 

2006. 

Further, under that law it would be possible for insurers to use the Proposed Form. This may be a 

real consideration for integrated financial services institutions. However, in no event should the 

Proposed Model be read to disqualify existing state sample clauses that apply to the insurance 

industry. This would raise serious jurisdiction questions. Indeed, an institution may feel that it 

needs to send multiple notices -this result does little to aid customer understanding or to enhance 

the perceived value of privacy notices. 

(b) Safe Harbor as Ali-or-Nothing 

The Proposed Model may be read as structuring the safe harbor as ali-or-nothing. Within the 

structure of the consistent format, a financial institution should be permitted to rely on safe harbor 

protection as it relates to particular response or portion of the Model Form - if it chooses to craft its 

notice in a way that deviates with respect to one response it should not lose protection with respect 

to all the others. This is an extremely important issue. 

Consider that GLBA establishes a floor and not a ceiling for information sharing limitations and for 

disclosure requirements. Different information will need to be communicated to customers residing 

in states that went beyond GLBA and different CHOICES will need to be afforded to them. Financial 

institutions that choose to modify their privacy notices to follow the general format and the applicable 

clauses from the Proposed Form, but that also need to insert different language to comply with state 

law, should not lose the entire safe harbor protection. Similarly, insurers in the more than 20 

jurisdictions that address health information with an additional opt-in should be afforded the safe 

harbor protection to the extent they follow either the existing safe harbor or the Proposed Form, 

understanding that certain deviations will be necessary. Risking non-compliance with state law or 

risking loss of safe harbor protection is not a fair choice for financial institutions seeking to develop 

the most appropriate privacy notice. 

Simolv stated. aiven differences in laws and in privacv and business practices and in ways of 

communicating, financial institutions electing to use the template of the Proposed Form should have 

the protection of the safe harbor for those aspects of the Proposed Model language that they use. 

The placeholders for variable language in the attached Appendix become all the more important if 

no deviations from the Proposed Model will be tolerated under an ali-or-nothing regulatory approach. 

* * * * * 

As the Agencies work toward the next version of a Proposed Model, AlA asks that financial 

institutions be included in discussions given their experience with laws surrounding privacy issues 

as well as their knowledge of operational issues. Thank you. 

- 10 -

Respectfully submitted, 

/s/ 
-11 -

Catherine I. Paolino 

Senior Counsel 

/s/ 

Angela Royko 

Research Analyst/Editor & 

Associate Counsel 
American Insurance Association Comments on 

Interagency Proposal for Model Privacy Form 

under the Gramm-Leach-Biiley Act 

Appendix Showing Suggested Revisions 

- 12 -
WHAT DOES [name of financial institution] DO 

WITH YOUR PERSONAL INFORMATION? 

[Financial companies choose how they share your personal information. 

Federal law gives customers consumers the right to limit some but not 

all sharing. Federal law also requires us to tell you how we collect, 

share, and protect your personal information. State laws may give you 

additional rights to limit sharing. Please read this notice carefully to 

understand what we do.) 

[The types of personal information we collect and share depend on the 

product or service you have with us. This non-public information can 

include: 

• [Social Security number] [and) [income] 

• [account balances or payment [or] [transaction] [history]] 

• [consumer reports] [credit history or credit scores] [things used to 

determine if you qualify for our product] 

• [assets and investment experience] 

•LJ] 

[When you close your account are no longer a customer, we may 

continue to share information about you according to our policies.] ~ 

for 

[Affiliates] [Among XYZ 

Companies] 

Companies related by common ownership or control. They 

can be financial and nonfinancial companies 

• [affiliate information] 

[Non affiliates] [Outside of the 

XYZ Family of Companies] 

Companies not related by common ownership or control. 

They can be financial or nonfinancial companies 

Joint marketing 

• [nonaffiliated information) 

A formal agreement between nonaffiliated financial 

companies that together market financial products or 

services to you 

• [joint marketing] 

All financial companies need to share and use customers' personal 

information to run their everyday business and to manage customer 

[accounts] [contracts].- including to process transactions, maintain 

customer accounts, and 1Q_report to credit bureaus consumer reporting 

agencies. n the section b .S,elow, we list tRe reasons financial 

companies can share tReif customers' personal information; tRe 

reasons [name of financial institution] chooses to share; and whether 

can limit this sharin 

. 13 . 
Reasons we can share or use your personal 

information 

For our every day business purposessuch as to process your transactions, 

maintain your account, and report to 

consumer re ortin a encies credit bureaus 

For our marketing purposes -

to offer our products and services to you 

For joint marketing with other financial 

com anies 

For [our affiliates'} everyday business 

purposes [among XYZ companies] -

information about your transactions and 

ex eriences with us 

For [our affiliates'} everyday business 

purposes [among XYZ companies]-

information [about your creditworthiness] 

[about your insurability] [other than 

information about your transactions with 

~ 

For [our affiliates] [other XYZ companies] 

to market to you 

For [nonaffiliates] [companies outside of 

the XYZ family] to market their products 

Does [name of financial 

institution] share? 

[Yes]U 

[Yes]U 

[Yes][No]U 

[Yes][No]U 

[Yes][No]D 

[Yes][No]U 

[Yes][No]U 

Can you limit sharing or 

use? 

[No]U 

[No]U 

[No][We don't share]U 

[No][We don't share]U 

[Yes (Check your choices, 

p.3)] [We don't share] U 

[Yes, you may limit use 

(Check your choices, p. 

3)][We don't share]U 

[Yes (Check your choices, 

p.3)] [We don't share]U 

[Call [toll-free telephone]] [or] [go to [web address]] [or] [write [address]] [] 

- 14-
How often does [name of 

financial institution] notify me 

about their practices? 

How does [name of financial 

institution] protect my personal 

information? 

How does [name of financial 

institution] collect my personal 

information? 

Why can't I limit all sharing? 

Everyday business purposes 

Affiliates 

Nonaffiliates 

Joint marketing 

We must notify you about our sharing practices when you 

open an account first become a customer and each year 

while are a customer. 

To protect your personal information from unauthorized . 

access and use, we use security measures that comply ~1th 

federal law. These measures include computer and phys1cal 

safeguards and secured files and buildings. 

We collect your personal information, for example, when you 

• [open an account or deposit money] [initiate transactions 

with us] [apply for services with us] 

• [pay your bills or apply for [insurance] [a loan] 

• [use your credit or debit card] 

•U 

We also collect your personal information from others such 

as consumer reporting agencies credit bureaus, affiliates, or 

other com ies. 

Federal la•.v gives you the right to limit sharing only for 

• affiliates' everyday business purposes [ information 

about your [creditworthiness] [transaction and experience 

with us]] 

• affiliates to market to you 

State laws and individual companies may give you additional 

rights to limit sharing. 

The actions necessary by financial companies to run their business 

and manage customer [accounts] [eeRtraets), Sl.ISR as: . . . 

• [FlreeessiRS traRsaetieRs [aRe elai~s) , feeRtFaet aEi~IRistratleR.] 

r:RailiR€11 aRe at.~EiitiR§ sewises] 

• [FJrevi€1iA~ iRferr:RatieR te [BeAsl>mer re@ertiAa aaeAsies] [ere€1it 

Bl>reat.~s]] 

• [resFleA€1iA~ te eet.~rt er€1ers aREile§al iFlvesti~atieAs] 

-H 

- !5-
Contact us 

Your choices will 

to everyone on your 

[account] [policvl 

WHAT DOES [name of financial institution] DO 

WITH YOUR PERSONAL INFORMATION? 

[By telephone [toll-free telephone] -our menu will prompt you through 

your choices.] 

On the web: [web address] 

By mail: mark your choices below, fill in and send from to 

[mailing address] 

biRiess we ~eer frem ye1e1 1 we eaR 8egiR sRariRg ye~;~r iRferFRatieR ag 

€1eys fFem our first notice providing you tho opportunity to limit our 

sharing t~e €lets ef t~is letter. ""ewever, You can contact us at any time 

to limit our sharin . 

Check any/all you want to limit: (see page 1) 

o Do not share information [about my [creditworthinessJ-J.!.!.==.:..:..:..:..z..l.ll 

[other than information about my transactions] with your [affiliates} 

[among XYZ companies) for their everyday business purposes. U 

understand that information about my transactions with [your 

affiliates] [the XYZ companies) is not limited by this choice.] 

o Do not allow your [affiliates] [other XYZ companies] [that I do not 

have a relationship with] [with whom I do not do business] to use 

personal information to market to me. +HVIIf-f86:ewre-e!-Fe'R81waJ~~ 

for this use for marketing in 5 years.) (This choice may need to be 

renewed in 5 or more years. but you will notify me first.) 

o Do not share my personal information [with nonaffil·-··--.... "'-===~ 

the XYZ family of companies] to market their nonfinancial products 

and seNices to me. 

0 l1 

Mail to: 

. 16.