First, the FTC is to be commended for its overall efforts in seeking to fashion a workable regulation from the extremely broad language of the Act. In general, the proposed Privacy Regulation is comprehensible and detailed. The numerous examples are particularly useful. However, it is clear from the outset that implementation of the Privacy Regulation will be complicated and fraught with potential for error on the part of financial institutions, as defined. For this reason, I strongly urge the FTC to take whatever action it can to extend the time period available for implementation between the publication of the final version of the Privacy Regulation and its effective date.
Many factors come into play here.
First, many New CFS Providers, as well as their traditional industry counterparts, are new to the regulated businesses in which they are engaged. It will take a certain amount of time for both New CFS Providers and for traditional small consumer financial service providers, such as finance companies, check cashers, check sellers, etc., to learn of the existence of the final Privacy Regulation and to bring themselves into compliance. Those vendors thus perform a valuable public service by making a much higher level of compliance capability available than small entities would otherwise be able to generate on their own. However, the development, marketing, and implementation of such compliance services take time, which will not be available under the accelerated time frame currently contemplated. There is a common and important fact pattern involved here.