,. 

May 29, 2007 '?!Jj7 I A Y 3D A:1 IG: I 2 

By Electronic Delivery 

Jennifer J. Johnson 

Secretary 

Board of Governors of the 

Federal Reserve System 

20th Street and Constitution A venue, NW 

Washington, DC 20551 

Attention: Docket No. R-1280 

Robert E. Feldman 

Executive Secretary 

Federal Deposit Insurance Corporation 

550 17th Street, NW 

Washington, DC 20429 

Attention: Comments 

MaryRupp 

Secretary of the Board 

National Credit Union Administration 

1775 Duke Street 

Alexandria, VA 22314-3428 

Regulation Comments 

Chief Counsel's Office 

Office ofThrift Supervision 

1700 G Street, NW 

Washington, DC 20552 

Attention: OTS-2007-0005 

U ·c. OF '1E SL-:Ct\ET, Hlf:.f 

Eileen Donovan 

Acting Secretary of the Commission 

Commodity Futures Trading Commission 

Three Lafayette Centre 

1155 21st Street, NW 

Washington, DC 20581 

Federal Trade Commission 

Office ofthe Secretary 

Room H-135 (Annex M) 

600 Pennsylvania A venue, NW 

Washington, DC 20580 

Attention: Model Privacy Form, 

FTC File No. P034815 

Office of the Comptroller of the Currency 

250 E Street, SW 

Mail Stop 1-5 

Washington, DC 20219 

Docket Number OCC-2007-0003 

Nancy M. Morris 

Secretary 

Securities and Exchange Commission 

100 F Street, NE 

Washington, DC 20549-1090 

Model Privacy Form, 

File Number S7-09-07 

VISA 

w 

Russell W. Sdlrader 

Senior Vice President 

Assistant General Counsel 

Re: Interagency Proposal for Model Privacy Form Under the Gramm-Leach-Bliley Act 

Ladies and Gentlemen: 

This letter is submitted on behalf of Visa U.S.A. Inc. in response to the proposed rules 

("Proposal") by the Board of Governors ofthe Federal Reserve System, the Commodity Futures 

Trading Commission, the Federal Deposit Insurance Corporation, the Federal Trade Commission 

("FTC"), the National Credit Union Administration, the Office of the Comptroller of the 

Currency ("OCC"), the Office of Thrift Supervision, and the Securities and Exchange 

Commission ("SEC") (collectively, the "Agencies"), published in the Federal Register on 

March 29, 2007.1 The Proposal requests public comment on proposed amendments to the 

1 Interagency Proposal for Model Privacy Fonn Under the Gramm-Leach-Bliley Act, 72 Fed. Reg. 14,940 (Mar. 29, 2007). 

Visa U.S.A Inc. 

P.O. Box 194607 

San Francisco, CA 94119-4607 

U.S.A. 

t 415 932 2178 

f 415 932 2525 
, May 79, 2007 

Page2 

existing privacy rules (collectively, "Privacy Rule"i implementing the Gramm-Leach-Bliley Act 

("GLBA"),3 as recently amended by section 728 of the Financial Services Regulatory Relief Act 

of2006 ("Regulatory Relief Act" or "Act").4 More specifically, the Agencies essentially 

propose to mandate that financial institutions use a highly stylized "model form" privacy notice 

("proposed model form") in order to comply with the notice content requirements of the Privacy 

Rule. Visa appreciates the opportunity to comment on this important matter. 

Section 728 of the Regulatory Relief Act was enacted to allow financial institutions to 

use a model form to satisfy the notice content requirements of the GLBA. By providing 

institutions the option of using either the model form or their own privacy notices, Congress 

intended to encourage financial institutions to use simpler and clearer privacy notices while 

retaining flexibility, and thereby minimize their compliance burden under the GLBA. Congress 

also sought to promote benefits to consumers by allowing institutions to use a model form that is 

"comprehensible to consumers, with a clear format and design" and "succinct, [using] an easily 

readable type font," among other prescribed criteria, some or all of which might be adopted by 

financial institutions to improve their existing privacy notices. 5 Yet, under the Proposal, the safe 

harbor provisions of the Privacy Rule would be limited to the use of the proposed model form, 

subject to strict language limitations and a requirement that it be printed on single sides of 

multiple pieces of 8.5 by 11-inch paper. Thus, financial institutions must navigate between the 

Scylla of providing their own privacy notices which, although accurate, might be found by the 

Agencies not to comply with the GLBA, and the Charybdis of providing the proposed model 

form, the cost of which would sink their resources for compliance with the GLBA and might 

even give rise to claims that statements included in the notice are misleading or deceptive. 

Congress clearly did not intend, through regulatory relief legislation, for financial institutions to 

be required to follow such a treacherous course. 

Visa supports the goals of continuing to improve the language and formats of privacy 

notices, including through the use of an optional model form consistent with the Regulatory 

Relief Act, so that consumers are better informed about their choices. But Visa respectfully 

urges the Agencies to keep the existing safe harbor provisions ofthe Privacy Rule, to minimize 

costs and promote flexibility for compli~ce with the GLBA, and to allow the proposed model 

form to function as the model Congress intended--one that can be adopted in whole or in part so 

that financial institutions can more clearly, yet still accurately, describe their own particular 

information-sharing practices. 

THE CURRENT SAFE HARBOR PROVISIONS MUST BE RET AJNED 

The current Privacy Rule provides a safe harbor to financial institutions to use "Sample 

Clauses"6 in their privacy notices if the clauses accurately describe the privacy policies and 

2 As the Agencies note, 72 Fed. Reg. at 14,942, their respective GLBA rules are consistent and comparable. For the 

sake of brevity, references to the Privacy Rule are to the rule adopted by the OCC. 12 C.F.R. pt. 40. 3 15 u.s.c. §§ 6801-6809. 4 Pub. L. No. 109-351, 120 Stat. 1966 (2006). 

s /d. at 120 Stat. 2003 (to be codified at 15 U.S.C. § 6803(e)(2)(A)-(D)). 6 See 12 C.F.R. pt. 40, App. A. 
May 29,2007 

Page} 

practices that the institutions use, or reserve the right to use. 

7 In addition to serving as a safe 

harbor for financial institutions seeking such shelter, the Sample Clauses have provided guidance 

on the level of detail required to comply with the notice content requirements under the GLBA. 

Even though privacy notices initially posed challenges for consumers, in part because of 

the language, varying formats, and novelty of the notices themselves, financial institutions have 

steadily revised their notices to make them better. The Agencies' efforts to reach out to 

consumers and test disclosures have been, and will continue to be, important for improving 

privacy·notices. Financial institutions also have reached out to their customers and tested their 

own privacy notices, but often found the results to be ambiguous. Still, financial institutions 

have complied with the notice content requirements of the Privacy Rule, including through use 

of the Sample Clauses, and the Agencies do not suggest otherwise in the Proposal. As the 

techniques that make notices easier to read continue to be refmed, the Agencies should allow 

financial institutions to use their own privacy notices or a model form developed under the 

Regulatory Relief Act to satisfy the GLBA. 

Financial institutions have worked diligently to develop and improve their privacy 

notices to accurately describe their own policies and practices because providing accurate 

notices-which comply with the GLBA and the Privacy Rule-is an important element of 

customer relations and of dealing fairly with consumers. If the Agencies remove the safe harbor 

for using the Sample Clauses, one pillar supporting a fmancial institution's existing privacy 

policies and procedures would fall. In practice, for example, bank examiners are likely to 

question how a bank's continued use of a notice that is based on one or more of the Sample 

Clauses, and may incorporate elements from the proposed model form, can still constitute 

compliance with the Privacy Rule. The bank then will be forced to defend that notice or 

overhaul it, even though its underlying privacy policies and practices remain exactly the same, or 

may even have been simplified. Under such a GLBA enforcement scheme, which apparently is 

contemplated by the removal of the safe harbor, financial institutions that choose not to use the 

proposed model form would be uncertain as to whether their existing privacy notices may still be 

found to be in compliance with the GLBA, even though they have made no change in their 

privacy practices. In addition, a financial institution that has developed, and improved, its 

privacy notice by availing itself of the current safe harbor under the Privacy Rule, would 

suddenly bear the risk of claims that the notice is "unfair" under section 5 of the FTC Act,8 and, 

by extension, under similar state laws proscribing unfair or deceptive acts or practices ("state 

UDAP laws") solely because the language of that notice would no longer be deemed by the 

Agencies to warrant a safe harbor under the Privacy Rule. 

The Regulatory Relief Act, which permits a financial institution to use, "at [its] option," a 

model form developed under the statute, should not be construed to force a financial institution 

that continues to use its existing privacy notice to fall out of compliance with the GLBA, even 

7 12 C.F.R. pt. 40, App. A; 12 C.F.R. § 40.6(e). The SEC's Privacy Rule, however, includes the Sample Clauses to 

"provide guidance concerning the SEC [P]rivacy [R]ule's application in ordinary circumstances," rather than a safe 

harbor, per se. 72 Fed. Reg. at 14,955. Nevertheless, the SEC also proposes to rescind the Sample Clauses and "no 

longer provide guidance regarding the [SEC Privacy Rule's] application to financial institutions subject to the SEC's 

[P]rivacy [R]ule." !d. 8 15 U.S.C. § 45. 
May79, 2007 

Page4 

though there has been no change in the institution's privacy practices. Instead of flatly 

eliminating the existing safe harbor, the Agencies should take into account the benefits of an 

easy-to-read model form, as well as the benefits of allowing financial institutions various options 

to comply with the notice content requirements of the GLBA-dual goals that Congress itself 

has recognized should be promoted and are not mutually exclusive. Visa respectfully urges the 

Agencies to retain the existing safe harbor provisions of the Privacy Rule and permit the use of a 

new model form as an additional alternative as a model for compliance with the GLBA, as 

contemplated by the Regulatory Relief Act. 

THE PROPOSED MODEL FORM WOULD IMPOSE SIGNIFICANT COSTS 

The compliance. difficulties posed by the removal of the existing safe harbor are 

magnified by the significant costs that would be incurred in using the proposed model form. The 

proposed model form would result in delivery costs that will greatly exceed the costs of 

delivering the current privacy notices. Apart from these costs, a financial institution will need to 

invest substantial resources to serve its customers in connection with the use of the proposed 

model form, including responding to customers who are trying to understand the changes to the 

institution's privacy practices and who find the highly stylized proposed model form to be 

confusing when compared to past privacy notices. 

Increased Delivery Costs 

The proposed model form will require financial institutions to bear the costs of printing 

the proposed model form on only one side of multiple sheets of 8.5 by 11-inch pieces of paper 

and mailing these forms. Documents printed on one side of 8.5 by 11-inch sheets of paper are 

commonly used for many purposes, but not for this one. Because of its size, the proposed model 

form typically will not be able to be provided with an account statement. Rather this form will 

typically require a separate mailing in a "business" sized envelope. Mandating a single-sided, 

multi-full-page privacy notice is inconsistent with the Regulatory Relief Act, which requires the 

model form to "be succinct, and use an easily readable type font"9 and, in virtually all cases, will 

increase the costs of providing the notices. 

In addition, the page-size and printing requirements may actually reduce the likelihood 

that a financial institution's customer will view a model form because that type of privacy notice 

typically will not accompany account information that the customer recognizes as important. A 

model form should be adaptable so that the page size and printing have features in common with 

other important documents that a financial institution provides to its customers; moreover, the 

financial institution itself is in the best position to determine the page-size and print format that 

would cause the model form to be noticed by its customers. Accordingly, Visa urges the 

Agencies to develop reasonable page-size and printing parameters that would allow financial 

institutions to provide the form with account statements to increase the likelihood that it will be 

read by its customers. 

9 Pub. L. No. 109-351 , § 728, 120 Stat. 1966,2003 (to be codified at 15 U.S.C. § 6803(e)(2)(D)). 
May 29,2007 

Page's 

Customer Confusion 

The new, strictly limited language of the proposed model form could well confuse 

customers abou.t the existing information-sharing practices of their fmancial institutions. 

Financial institutions using the proposed model form would confront the added cost of losing the 

trust of their customers who are likely to feel, when faced with deciphering entirely new privacy 

notices, that their institutions are changing their underlying privacy policies. Financial 

institutions would also confront the high costs of responding to questions from their customers 

who see the privacy notice as a contract or promise that is being changed in ways that they 

cannot understand. 

More fundamentally, the mandated language of the proposed model form does not 

accommodate the policies and practices that thousands of financial institutions currently have in 

place. 10 In the Proposal, the Agencies recount the difficult experiences of institutions, 

"particularly those with com~lex information-sharing practices," in complying with the GLBA 

notice content requirements. 1 The plain fact is that the language contained in the proposed 

model form does not adequately capture these complex privacy policies and practices, and the 

Agencies would prohibit fmancial institutions from modifying the form to do so.

12 To be clear 

on this point, use of the proposed model form actually would prevent a financial institution using 

the model form contemplated by the Regulatory Relief Act to accurately describe its own 

particular privacy policies and practices. 

THE PROPOSED MODEL FORM IS NOT ACCURATE 

Unless the Agencies preserve the existing safe harbor of the Privacy Rule, financial 

institutions may lose the ability to provide accurate privacy notices. For example, the proposed 

model form prohibits financial institutions from describing various disclosures of information as 

being "permitted by law," even though that.succinct statement accurately describes their actual 

practices and is expressly permitted by the Privacy Rule. 13 Instead, financial institutions would 

be required to describe a wide range of disclosures, as being "actions necessary by financial 

companies to run their business and manage customer accounts,"14 which does not encompass all 

of the exceptions in the GLBA. 

The proposed model form also requires institutions to describe a customer's right to opt 

out, under section 624 ofthe Fair Credit Reporting Act ("FCRA"),15 of the use (mischaracterized 

as sharing) of information by affiliates for marketing purposes, but nowhere includes a statement 

that affiliates are still permitted by statutory exceptions to do so under certain circumstances. As 

a result, if a customer checks the box on the proposed model form stating "Do not allow your 

10 See 72 Fed. Reg. at 14,956-57 (describing the thousands of "small" financial institutions that would be subject to 

the Proposal). 

ll 72 Fed. Reg. at 14,943. 12 72 Fed. Reg. at 14,952 (The Agencies explain the use of"simplified phrases describing information sharll].g 

practices" that, despite certain virtues, might not be accurate for particular financial institutions.). 13 See 12 C.F.R. § 40.6(b). 14 72 Fed. Reg. at 14,950. 15 15 U.S.C. § 1681s-3. 
. May,29, 2007 

Page6 

affiliates to use my personal information to market to me,"16 the language of the form would 

suggest that all ofthe financial institution's affiliates will stop marketing to him or her; and that 

all information sharing among affiliates relating to marketing, as described on the first page of 

the proposed model form, will stop. Yet even a financial institution like Neptune (one of the 

hypothetical entities used in the Proposal), and its affiliates, would be permitted-under both the 

GLBA and the FCRA-to disclose certain information about its customer and market to that 

customer, under certain circumstances, such as when the customer has a pre-existing business 

relationship with a Neptune affiliate. 17 By using the proposed model form, however, Neptune 

and its affiliates, including those that also have relationships with the same customer, might be 

viewed as having waived the right to share information, as permitted by the GLBA, and to use 

the information to market to the customer, as permitted by the FCRA, because that form flatly 

states: "[f]ederallaw gives you the right to limit sharing only for ... affiliates to market to 

you[.]"18 And if Neptune or its affiliate does share or use information about its customer as 

permitted by law, it will engage in a practice that is inconsistent with the customer's decision to 

opt out as described in the proposed model form. 

Financial institutions that provide the proposed model form to their customers yet 

continue to make disclosures or use information about their customers, as allowed under the 

GLBA and the FCRA, would be making disclosures that are inconsistent with principles that the 

FTC has relied upon in implementing the unfair and deceptive acts and practices prohibition in 

section 5 of the FTC Act and, by extension, state UDAP laws, as well as guidance provided by 

the banking agencies for avoiding unfair and deceptive practices. Moreover, the Agencies' new 

safe harbor only relates to compliance with the GLBA. Accordingly, Visa respectfully urges the 

Agencies to retain the current safe harbor of the Privacy Rule in order to allow financial 

institutions to be able to continue to provide accurate privacy notices to their customers and to 

obtain the benefits that Congress intended under the Regulatory Relief Act. 

THE PROPOSED AFFILIATE-MARKETING NOTICE IS PREMATURE 

The proposed model form includes elements of a notice to be required under section 624 

of the FCRA, which regulates the use of information received by an affiliate for marketing 

purposes. 19 However, the fmal rule implementing the affiliate-marketing requirements of the 

FCRA has not been adopted. 20 The sections of the proposed model form that are designed to 

apply to an affiliate's opt-out notice to meet the affiliate-marketing requirements will be 

separately regulated by a final rule under the FCRA. As a result, even though the use of the 

model form developed under the Regulatory Relief Act should allow a financial institution to 

comply with the notice content requirements of the GLBA, there is no basis to determine 

whether, or to what extent, affiliated institutions will need to use the proposed model form to 

comply with the FCRA. Accordingly, Visa believes that, at this stage, the public does not have a 

reasonable opportunity to comment on this aspect of the Proposal and respectfully urges the 

16 72 Fed Reg. at 14,948 (The same issue is raised by the reprinted version of this proposed model form, which 

appears at 72 Fed. Reg. 16,875, 16,876 (Apr. 5, 2007)). 17 15 U.S.C. § 168ls-3(a)(4). 

18 72 Fed. Reg. at 14,947. 

19 15 U.S.C. § 168ls-3. 20 72 Fed. Reg. at 14,952 n. 29. 
May _29, 2007 

Page7 

Agencies to re-propose appropriate parts of the model form under the Regulatory Relief Act, 

consistent with the final affiliate-marketing rule eventually adopted under the FCRA. 

THE REQUIREMENTS OF THE APPENDIX SHOULD BE CLARIFIED 

To assure that financial institutions have a bona fide option to use their own privacy 

notices or the model form, consistent with the mandate of the Regulatory Relief Act, the 

Agencies should clarify that institutions using their own privacy notices are permitted to pick and 

choose elements of the model fonn. Accordingly, the Agencies should expressly state in the 

Appendix that a financial institution, at its option, may include in its own privacy notice 

elements of the model fonn, including the format and language. Correspondingly, the Appendix 

should expressly state that the use of some, but not all, of the elements of the model fonn shall 

not be a basis for determining that the privacy notice used by a particular financial institution 

does not satisfy the notice content requirements of the Privacy Rule. 

In addition, the proposed model form is, in several respects, inconsistent with the 

requirements ofthe Privacy Rule itselfbecause it adds new disclosure requirements that are not 

contained in the Rule. To avoid creating the inference that the language and format that must be 

used in the model form also must be included in a financial institution's own privacy notice, the 

Appendix should expressly state that the requirements contained in the Appendix shall not be 

construed as modifying any other requirement of the Privacy Rule. 

THE MODEL FORM SHOULD BE SIMPLE AND INFORMATIVE 

The Proposal highlights an inherent tension between educating consumers so that they 

can make informed choices about the information-sharing practices of financial institutions and 

simplifying those choices. Where the initial privacy notices provided by financial institutions 

were often overly detailed and complex, the proposed model form errs on the other side by 

oversimplifying the information-sharing practices that institutions actually use. Visa believes 

that by eliminating the existing safe harbor of the Privacy Rule and mandating the use of a highly 

stylized model form, the Proposal sacrifices the benefits of promoting greater consumer 

understanding about information-sharing practices through accurate privacy notices. Nothing in 

the Regulatory Relief Act requires a strict tradeoff between simplicity and accuracy. Rather, · 

Congress intended a model form that can be adapted to suit varied information-sharing practices 

so that a particular institution may, at its option, use the model form in whole or in part to 

comply with the notice content requirements of the GLBA. 

* * * * 

We appreciate the opportunity to comment on this important matter. If you have any 

questions concerning these comments or if we may otherwise be of assistance in connection with 

this matter, please do not hesitate to contact me, at ( 415) 932-2178. 

Sincerely, 

Russell W. Schrader 

Senior Vice President and 

Assistant General Counsel