COMMENT . . r_- · rn .l . L -·--

, . r.-. T. "':. 

. •• " \0 , • .;Jv 

CONSUMER MORTGAGE COALITllJN;:·.;,i:. 

May 29,2007 Received CFTC 

Records Section 

()Sf.Jo lo7 

Office of the Comptroller of the 

Currency 

250 E Street, SW 

Public Information Room 

Mail Stop 1-5 

Washington, DC 20219 

RE: Docket No. OCC-2007-0003 

regs.comments@occ.treas.gov 

Robert E. Feldman 

Executive Secretary 

Attn: Comments 

Federal Deposit Insurance Corporation 

550 1 ih Street, NW 

Washington, DC 20429 

RE: RIN 3064-AD16-Interagency 

Proposal for Model Privacy Form under 

Gramm-Leach-Bliley Act 

comments((_l1fdic.gov 

Mary Rupp 

Secretary of the Board 

National Credit Union Administration 

1775 Duke St. 

Alexandria, VA 22314-3428 

RE: Comments on Proposed Rule Part 

716 (Model Form for Privacy Notice) 

ree:comments@,ncua.gov 

Jennifer J. Johnson 

Secretary 

Board of Governors ofthe Federal 

Reserve System 

201

h St. and Constitution Ave, NW 

Washington, DC 20551 

RE: Docket No. R-1280 

re£s.comments@federalreserve.gov 

Regulation Comments 

Chief Counsel's Office 

Office of Thrift Supervision 

1700 G Street, NW 

Washington, DC 20552 

Attn: OTS-2007-0005 

regs.comments@.ots.treas.gov 

Federal Trade Commission 

Office of the Secretary 

Room 135 (Annex C) 

600 Pennsylvania Avenue, NW., 

Washington, DC 20580 

RE: Model Privacy Form, FTC File No. 

P034815 

Filed via 

https://secure.comment\\'orks.com/ftcmodelform 

101 Constitution Ave., NW, tjh Floor West; Washington, DC 20001 

TEL: (202) 742-4366 FAX: (202) 403-3926 
Eileen Donovan 

Acting Secretary of the Commission 

Commodity Futures Trading 

Commission 

Three Lafayette Centre 

1155 21st Street, NW. 

Washington, DC 20581 

RE: Interagency Proposal for Model 

Privacy Form under Gramm-LeachBliley Act 

secretarv@cftc.gov 

Nancy M. Morris 

Secretary 

Securities and Exchange Commission 

100 F Street, NE. 

Washington, DC 20549-1090 

RE: File Number S7-09-07- Model 

Privacy Form 

rule-comments@sec.gov 

Re: Interagency Proposal for Model Privacy Form under the Gramm-LeachBiiley Act, 72 Fed. Reg. 14940 (Mar. 29, 2007) 

Dear Sirs and Madams: 

The Consumer Mortgage Coalition (the "CMC"), a trade association of national 

residential mortgage lenders, servicers, and service-providers, appreciates the opportunity 

to submit these comments on the Interagency Proposal for a Model Privacy Form under 

the Gramm-Leach-Bliley ("GLB") Act (the "Proposal"), published in the Federal 

Register on March 29, 2007, by the Office of the Comptroller of the Currency, Board of 

Governors of the Federal Reserve System, Federal Deposit Insurance Corporation, Office 

of Thrift Supervision, National Credit Union Administration, Federal Trade Commission, 

Commodity Futures Trading Commission, and Securities and Exchange Commission 

(collectively, the "Agencies"). 

The Proposal implements Section 728 of the Regulatory Relief Act, Pub. L. 109-351 

(Oct. 13, 2006), which amends the GLB Act to add a new Section 503(e), 15 U.S.C. 

§ 6803(e). That provision requires the Agencies to "jointly develop a model form which 

may be used, at the option of the financial institution, for the provision of disclosures 

under [section 503 of the GLB Act]," i.e., the initial and annual disclosures of the 

financial institution's privacy policy. The statute states that the model form will provide 

a safe harbor from liability for violating the GLB Act for financial institutions that choose 

to use it. The amendments did not change the existing required disclosures or the 

exceptions to those requirements. 

The CMC commends the Agencies for producing the Proposal in the short time allotted 

to it under the Regulatory Relief Act. We agree that the existing model disclosures in the 

GLB Act implementing regulations have significant weaknesses and could be improved 

by the use of professionally-designed forms that are tested by consumers. We are 

concerned, however, that the Proposal does not meet the goals of the Regulatory Relief 

Act because it (1) requires many disclosures that are not mandated by the GLB Act and 

are not helpful to consumers; (2) does not permit institutions to comply with the GLB Act 

by disclosing their actual information-sharing practices; and (3) imposes rigid and 

unnecessary formatting and delivery requirements that would be very burdensome to 

industry. 

2 
CMC believes that the model forms must be substantially revised and republished as a 

new proposal for public comment so that they meet the goals of the Regulatory Relief 

Act in a way that is helpful to consumers and industry and consistent with the GLB Act. 

Disclosures Should Reflect GLB Act Disclosure Requirements 

The Regulator Relief Act provides: 

(1) The agencies referred to in section 504(a)(l) shall jointly develop a 

model form which may be used, at the option of the financial 

institution, for the provision of disclosures under this section 

[Section 503(c) of the GLB Act, 15 U.S.C. § 6803(e)]. 

(2) A model form developed under paragraph (1) shall-

(A) be comprehensible to consumers, with a clear format and 

design; 

(B) provide for clear and conspicuous disclosures; 

(C) enable consumers easily to identify the sharing practices of 

a financial institution and to compare privacy practices 

among financial institutions; and 

(D) be succinct, and use an easily readable type font. 

15 U.S.C. § 6803(e). 

The model form mandates disclosures beyond those required by Section 503(c) ofthe 

GLB Act, while at the same time failing to provide for, or even permit, some disclosures 

that are required. The Proposal does not, however, meet the goals stated in Section 

503( e )(2) as set forth above. The material is presented in an order that does not focus on 

the key consumer rights provided by the GLB Act. The use of defined terms that are 

explained on a separate sheet is inconsistent with basic principles of clear presentation; 

moreover, the definitions are not all accurate, they are used inconsistently, and they 

include elements that are unnecessary for consumers to understand an institution's 

privacy policies. The requirement to show information that is typically collected or 

shared by financial institutions, even if the institution making the disclosure does not 

collect or share that type of information, will result in confusing and misleading 

disclosures. 

The Proposal would require an institution that wants to take advantage of the safe harbor 

provided by the Regulatory Relief Act to disclose the consumer's right to opt-out from 

sharing with third parties under the GLB Act, which is a required disclosure under the 

GLB Act and the Agencies' privacy regulations. It would also go beyond the disclosures 

required by the Act and regulations in several ways, such as by requiring: 

• A description of the financial institution's policies of sharing of information "for 

everyday business purposes" such as processing transactions, account maintenance, 

3 
and reporting to credit bureaus. All institutions would also have to indicate that they 

do not allow consumers to opt-out of sharing such information. 

• Discussions of federal law, including explanations ofwhen the institution must 

provide privacy notices and of why the consumer cannot limit all sharing of 

information. 

General Issues 

Allow Institutions to Present Their Entire Privacy Policy in One Document 

At the same time that the Proposal requires disclosure of much information that is not 

required by the GLB Act, it does not allow institutions to go beyond federal law and 

present their entire privacy policy and it does not emphasize the aspects of financial 

institutions' privacy practices that are most important to consumers. 

The heart of the GLB Act's privacy rules is the requirement that a financial institution 

that wishes to share nonpublic personal information with unaffiliated third parties give 

consumers the right to opt-out of such sharing. State laws, such as California's S.B. 1, 

impose additional requirements before information can be shared with third parties. 

Many institutions also voluntarily provide a right to opt-out of sharing of information 

with affiliates. Institutions also often voluntarily allow consumers to opt-out of direct 

marketing by the institution through certain channels such as e-mail. 

All of these "opt-out" rights can be viewed as implicating "privacy" in some sense and 

many institutions currently use a single disclosure to present all of the consumer's opt-out 

alternatives. A single disclosure is also helpful to the consumer, who is unlikely to be 

interested in whether the institution allows opt-outs in certain situations because of 

federal or state law or voluntarily. But by strictly limiting variations from the standard 

disclosure, the Proposal would prohibit institutions from providing a comprehensive 

explanation of the institution's information-sharing policies and the consumer's right to 

prohibit sharing. 

CMC is concerned that the rigid format requirements of the proposed model form will 

result in consumers being provided an inaccurate or overly simplistic view of a particular 

financial institution's privacy policies. As the Agencies are aware, the privacy and 

information-sharing policies of financial institutions are often complex. The Agencies 

should allow non-deceptive modifications and additions to the form so that financial 

institutions can provide consumers with accurate and important details of their privacy 

policies. 

Safe Harbor 

Under the proposal, the current sample clauses would be deleted from the regulations, 

and financial institutions would lose the safe harbor provided by use of those clauses after 

a one-year transition period. CMC strongly opposes the elimination of the safe harbor for 

institutions that use the sample clauses. When the GLB Act was enacted and the 

Agencies issued the cmTent regulations, financial institutions invested significant 

resources in fine-tuning their privacy notices to comply with the federal law and 

regulations. They have also made a major effort to reconcile the federal requirements 

4 
with state privacy laws as well as other federal and state statutes. There is no reason that 

disclosures that the Agencies have previously found to be in compliance with the GLB 

Act, because they properly use the existing sample clauses, should lose their validity 

Therefore, CMC urges the Agencies to preserve the existing safe harbor for institutions 

that use the sample clauses. 

Paper Size, Number of Pages, and Use with Other Disclosures 

The Proposal would require financial institutions to print the Model Form on 8 W' by 11" 

paper. CMC believes that consumers will be able to understand the information 

presented in the model form on other sizes of paper. Many consumer disclosures are 

presented on smaller-sized paper. It appears that the reason for this requirement is that 

the Agencies used 8 Y2" by 11" paper to test the disclosures, not that testing showed that 

smaller-sized paper would be ineffective. CMC members have found that the size of the 

paper is not as significant as how information is presented and the nature of the 

information the document contains. Using smaller-sized paper also enables financial 

institutions to economize on paper costs, reducing the impact of compliance on natural 

resources. Therefore, the Agencies should not impose requirements as to paper size. 

Similarly, the rules should not require that the model form appear on two separate, singlesided pages, with any opt-out form on a third page. The Agencies stated that separate 

pages are required because testing has indicated that consumers have a preference for 

notices that enable them to view the information on pages one and two side-by-side. This 

evidence of consumer preference does not outweigh the significant increase in expenses 

financial institutions will incur as a result of increased costs for paper, handling, and 

processing. The Agencies' research apparently did not demonstrate a significant increase 

in consumer comprehension or usability from this burdensome requirement; on the 

contrary, the Federal Register notice states that the researchers concluded that page 1 of 

the model form alone was adequate for consumer comprehension and usability. See 72 

Fed. Reg. at 14944. Therefore, CMC opposes the requirement that the model form be 

printed on separate pages. 

Finally, the Proposal provides that institutions may not incorporate other information into 

the form, but does not make clear whether the form could be mailed with other material 

presented separately. The regulation should make it clear that the model form may be 

sent to customers in a mailing that contains other material, such as a periodic statement. 

The Agencies should also allow inclusion of the model form as part of an integrated 

document that also includes other information about the general features of the financial 

product or products that the consumer is obtaining. Customers review and retain these 

documents because they are important documents that conveniently summarize the 

customer's relationship with the institution. Therefore, CMC believes that institutions 

should be allowed to incorporate the model form into a document that includes other 

material relating to the customer's relationship with the institution. 

Affiliates 

The model form allows financial institutions to include the names of the financial 

institutions or a group of affiliated institutions providing the notice. CMC strongly 

5 
supports allowing affiliated institutions to provide a joint notice. In some cases, however, 

the form may not allow all of the affiliates to be shown on the form. Financial 

institutions should also be allowed to show the names of affiliates in connection with the 

definition of the term "affiliates" on page 2 of the model form. 

Logos and Color 

The Agencies ask whether financial institutions will use corporate logos and color in 

connection with the model form. Financial institutions use corporate logos to provide a 

consistent corporate identity that customers easily recognize and identify with. The use 

of color and logos increases the likelihood that customers will read the information the 

institution provides Accordingly, financial institutions should be allowed to use logos 

and color on the model form. 

Testing 

The Agencies indicate they plan to test the next version of the model form with 

consumers. CMC recommends that the Agencies also convene an advisory group 

composed of representatives of financial institutions with expertise in privacy matters, as 

well as other privacy experts, to review the model form and advise on whether the next 

version provides useful information to consumers, is understandable, is consistent with 

the disclosure requirements of the GLB Act, and conveys meaningful information in a 

clear manner. 

State Requirements 

Because several states have adopted additional privacy and disclosure requirements, 

institutions doing business with residents of those states have modified their privacy 

policies to accommodate the additional state requirements. The model form does not 

provide flexibility to permit financial institutions to address varying state requirements. 

The final rule should allow financial institutions to modify the model form to incorporate 

reflect differing state requirements. 

Specific Comments on Elements of the Model Form 

CMC believes that the form can be significantly improved by removing unnecessary . 

details that are not required to be disclosed under the GLB Act and giving institutions the 

flexibility to disclose their actual practices. 

Information Collected and Frequently Asked Questions on Sharing Practices 

On page 1 of the model form, the section entitled "What?" sets out the types of 

information financial institutions collect and share. Financial institutions are not 

permitted to change the language appearing in this section. This limitation will prevent 

institutions from complying with the GLB Act requirement that a financial institution 

disclose the information that it actually collects and is likely to confuse and mislead 

consumers. For example, the reference to depositing money has no relevance to a 

company whose only business is originating and servicing mortgage loans. It would be 

more useful to consumers to be provided information about the information an institution 

actually collects, which would also help them compare information-collection practices 

6 
of different institutions. Therefore, the "What?" section on Page 1 should be modified to 

allow institutions to indicate the types of information they actually collect and share. 

Similarly, institutions should be allowed to modify the language on page 2 of the form 

under "Sharing practices." For example, the question that states that a company collects 

personal information when the customer opens an account or deposits money will have 

little relation to the business of many mortgage lenders and servicers. This statement will 

only generate unnecessary inquiries from consumers who will have little understanding 

of how that response applies to their relationship with a mortgage lender. Institutions 

should be allowed to describe their actual practices under this heading. 

Disclosure Table 

Yes/No Answers 

As with the top of page 1, it is important that the information included in the disclosure 

table, "reasons we share your personal information," on page 1, also accurately reflect an 

institution's sharing practices. The column entitled "Does [name] share?" permits only a 

"yes" or "no" answer. The inflexible structure of the permitted responses does not allow 

financial institutions to inform consumers about important aspects of their privacy 

policies, as they are required to do under the GLB Act. For example, financial 

institutions may wish to inform consumers that they share nonpublic personal 

information with certain affiliates or types of institutions but not others. Therefore, the 

rules should allow an answer other than "yes" or "no" to the question of whether the 

institution shares information. This added flexibility will allow institutions to fully 

comply with the GLB Act and make the institution's policy clear to the consumer without 

compromising the goal of making disclosures clear and understandable. 

Everyday Business Purposes 

The line of the table that discusses "everyday business purposes" should be removed 

from the table. The GLB Act and the existing regulations specifically allow financial 

institutions to share information for these purposes. See 15 U.S.C. § 6802( e); Agency 

Privacy Regulations§§ _ .14, _.15. Disclosing that the institution shares such 

information, along with the fact that the consumer does not have the right to limit such 

sharing, does not enlighten the consumer about a particular institution's practices. In 

addition, the disclosure as drafted could be misleading because it does not include the 

myriad other situations in which a financial institution is allowed to share information 

without providing a disclosure or opt-out right for reasons other than "everyday business 

purposes" (such as, for example, in connection with secondary market transactions or to 

protect against actual or potential fraud), but it does include reporting to credit bureaus 

even when the institution does not do so. Finally, this routine type of sharing is already 

explained in the sentence in the "How?" row in the "key frame" on page 1. 

Therefore, institutions should be allowed to continue to disclose that they "make 

disclosures to other nonaffiliated third parties as permitted by law," as permitted under 

the current regulations. This language could replace the "everyday business purposes" 

language in the "How" section of the form on page 1. 

7 
Finally, the term "everyday business purposes" is used in two other places in the table on 

page 1, in the descriptions of the institution's sharing with affiliates of"transactions and 

experiences" information and of"creditworthiness" information. This use of the term 

relates to the Fair Credit Reporting Act ("FCRA") affiliate-sharing provisions, which are 

different from the GLB Act provisions. Specifically, a company may freely share 

transaction-and-experience information with its affiliates under both the GLB Act and 

FCRA, and the affiliate may use the information for any purpose, including marketing as 

well as "everyday business purposes." If a company provides an opt-out right and the 

consumer does not opt-out, then both the GLB Act and FCRA again authorize the 

company to share the information for any purpose. Until the regulations implementing 

the new FCRA affiliate-sharing provision are adopted, the affiliate will also be able to 

use the information for any purpose. The term "everyday business purposes" is not 

helpful in describing the complex rules for sharing information with affiliates under the 

GLB Act and FCRA and should be deleted. In fact, we recommend that the agencies 

defer action on finalizing the model privacy notices until the substantive regulations 

implementing the new requirements for use of consumer report information by affiliates, 

added by the Fair and Accurate Credit Transactions Act of 2003, are issued in final. 

Table Order 

The other lines of the table should be reordered so that the information that is most 

important to consumers-how the institution shares information with affiliated and nonaffiliated institutions-is presented first. The lines that refer to "For our own marketing 

purposes" and "For joint marketing with other companies" should be combined into one 

line. It is uncommon for companies to offer opt-outs from joint marketing and virtually 

unheard of for them to offer an opt-out from marketing through a vendor (unless they 

offer an opt-out from all marketing). Companies that do offer opt-outs from this type of 

sharing should be able to provide an answer in the "Does this company share?" that 

explains their marketing policies. 

Federal Law 

The model form contains many references to federal law. None of these references are 

required disclosures under the GLB Act. As noted above, including references to federal 

law makes it difficult to disclose privacy policies that are not mandated by the GLB Act 

but that the institution has adopted to comply with state requirements or voluntarily. 

Therefore, these references should be eliminated. 

The statement that the company will notify the consumer of its privacy policy annually is 

also not required by the GLB Act and detracts from the substantive disclosures of the 

company's policies. Therefore, it should also be removed from the model form. 

30-Delay 

Page 3 of the model form indicates that institutions must delay sharing for 30 days from 

the date specified on the model form. Although it is correct that the regulations generally 

treat a 30-day period as a sufficient time to allow an individual a reasonable opportunity 

to opt-out after receiving an initial notice, this language would also apply to annual 

notices. We do not believe that the Agencies intended to impose a new waiting period 

8 
every year when an institution sends the annual notice. Therefore, the form should be 

modified to indicate that the 30-day waiting period applies only to the initial opt-out 

opportunity provided to consumers, not to subsequent annual notices. 

Partial Opt-Out 

The Agencies' GLB Act regulations provide that financial institutions may allow a 

consumer to select certain nonpublic personal information or certain nonaffiliated third 

parties with respect to which the consumer wishes to opt-out. The model form should 

similarly allow institutions to give consumers the ability to select certain nonpublic 

personal information or certain nonaffiliated third parties with respect to which the 

consumer wishes to opt-out. 

* * * 

We appreciate the opportunity to present our views. Please do not hesitate to call (202) 

742-4366 with any questions. 

9 

Sincerely, 

Anne C. Canfield 

Executive Director