Source: https://www.fdic.gov/news/news/press/2004/pr12804a.html
Timestamp: 2019-04-18 13:10:16+00:00

Document:
AGENCIES:	Office of the Comptroller of the Currency, Treasury (OCC); Board of Governors of the Federal Reserve System (Board); Federal Deposit Insurance Corporation (FDIC); and Office of Thrift Supervision, Treasury (OTS).
SUMMARY: The OCC, Board, FDIC, and OTS (the Agencies) are adopting a final rule to implement section 216 of the Fair and Accurate Credit Transactions Act of 2003 by amending the Interagency Guidelines Establishing Standards for Safeguarding Customer Information. The final rule generally requires each financial institution to develop, implement, and maintain, as part of its existing information security program, appropriate measures to properly dispose of consumer information derived from consumer reports to address the risks associated with identity theft.
OCC: Aida Plaza Carter, Director, Bank Information Technology, (202) 874-4740; Amy Friend, Assistant Chief Counsel, (202) 874-5200; or Deborah Katz, Senior Counsel, Legislative and Regulatory Activities Division, (202) 874-5090.
Board: Donna L. Parker, Supervisory Financial Analyst, Division of Supervision & Regulation, (202) 452-2614; Joshua H. Kaplan, Attorney, Legal Division, (202) 452-2249; Minh-Duc T. Le or Ky Tran-Trong, Senior Attorneys, Division of Consumer and Community Affairs, (202) 452-3667.
FDIC: Jeffrey M. Kopchik, Senior Policy Analyst, Division of Supervision and Consumer Protection, (202) 898-3872; Kathryn M. Weatherby, Examination Specialist, Division of Supervision and Consumer Protection, (202) 898-6793; Robert A. Patrick, Counsel, Legal Division, (202) 898-3757; Janet V. Norcom, Counsel, Legal Division, (202) 898-8886.
OTS: Glenn Gimble, Senior Project Manager, Thrift Policy, (202) 906-7158; Lewis C. Angel, Senior Project Manager, Technology Risk Management, (202) 906-5645; Richard Bennett, Counsel (Banking and Finance), Regulations and Legislation Division, (202) 906-7409.
Section 216 of the Fair and Accurate Credit Transactions Act of 2003 (FACT Act or the Act) adds a new section 628 to the Fair Credit Reporting Act (FCRA), at 15 U.S.C. 1681w, that, in general, is designed to protect a consumer against the risks associated with unauthorized access to information about the consumer contained in a consumer report, such as fraud and related crimes including identity theft. Section 216 of the Act requires each of the Agencies to adopt a regulation with respect to the entities that are subject to its enforcement authority requiring any person that maintains or otherwise possesses consumer information, or any compilation of consumer information, derived from consumer reports for a business purpose to properly dispose of any such information or compilation. Pub. L. 108-159, 117 Stat. 1985-86. The FACT Act mandates that the Agencies ensure that their respective regulations are consistent with the requirements issued pursuant to the Gramm-Leach-Bliley Act (GLB Act) (Pub. L. 106-102), as well as other provisions of federal law.
In general, commenters expressed support for the Agencies proposal because the new requirements would allow financial institutions sufficient latitude to adopt controls that suit their particular circumstances. Commenters offered revisions to several aspects of the proposal, notably the definitions and compliance deadlines, and the Agencies have considered each of these suggestions.
The Agencies also proposed to amend their respective regulations that implement the FCRA by adding a new provision setting forth the duties of users of consumer reports regarding identity theft. The proposed provision would require a financial institution to properly dispose of consumer information in accordance with the standards set forth in the Guidelines. The Agencies also proposed to amend their respective FCRA regulations by incorporating a rule of construction, which generally provides that the duty to properly dispose of consumer information shall not be construed to require a financial institution to maintain or destroy any record pertaining to a consumer that is not imposed under any other law or alter any requirement under any other law to maintain or destroy such a record. This rule of construction closely tracks section 628(b) of the FCRA, as added by section 216 of the FACT Act. In general, commenters supported the Agencies proposal to amend their FCRA regulations and, in particular, urged the Agencies to retain the rule of construction in the final rule.
In accordance with section 216 of the Act, the Agencies have consulted with the FTC, the National Credit Union Administration, and the Securities and Exchange Commission to ensure that, to the extent possible, the rules adopted by the respective agencies are consistent and comparable.
To implement section 216 of the FACT Act, the Agencies are adopting amendments to the Guidelines7 that require each financial institution to develop and maintain, as part of its information security program, appropriate controls designed to ensure that the institution properly disposes of consumer information. The amendments to the Guidelines generally require a financial institution to properly dispose of consumer information derived from a consumer report in a manner consistent with a financial institutions existing obligations under the Guidelines to properly dispose of customer information. Although the Guidelines currently address an institutions obligations to properly dispose of customer information, the amendments now state this obligation more directly and combine it with the new requirement to properly dispose of consumer information.
The Agencies have incorporated this new requirement into the Guidelines by: (1) adding a definition of consumer information, including illustrations of the information covered by the new term; (2) adding an objective (in paragraph II) regarding the proper disposal of customer information and consumer information; and (3) adding a provision (in paragraph III) that requires a financial institution to implement appropriate measures to properly dispose of customer information and consumer information in accordance with each of the requirements in paragraph III.
The final rule requires each financial institution to implement the appropriate measures to properly dispose of consumer information by July 1, 2005. The Agencies believe that any changes to an institutions existing information security program likely will be minimal because many of the measures that an institution already uses to dispose of customer information can be adapted to properly dispose of consumer information. Nevertheless, a few of the comments noted that the proposed period for compliance would be relatively short in light of the work required to locate and track all consumer information in a financial institutions existing information systems. Accordingly, the Agencies have determined that financial institutions should be afforded a six-month period to adjust their systems and controls.
A discussion of each proposed amendment to the Guidelines and the addition of cross-references to the Guidelines in the Agencies FCRA regulations follows.
Commenters generally supported the Agencies proposed definition of this term, but argued that the Agencies should include statements or illustrations to clarify the nature and scope of consumer information. Several commenters found the proposed phrase about an individual to be ambiguous and urged the Agencies to adopt a definition expressly stating that consumer information only includes information that identifies a particular individual.
Similarly, some commenters supported the Agencies explanation in the proposal that consumer information does not include information derived from a consumer report that does not identify any particular consumer, such as the mean credit score derived from a group of consumer reports. These commenters suggested that the Agencies include this example (or similar examples) in the definition.
In the final rule, as in the proposed rule, the Agencies have continued to define consumer information to mean any record about an individual, whether in paper, electronic, or other form, that is a consumer report or is derived from a consumer report and that is maintained or otherwise possessed by or on behalf of the [institution] for a business purpose. In addition, the Agencies have continued to define consumer information to mean a compilation of such records, as proposed.
The Agencies have modified the term consumer information, however, to expressly exclude from the definition any record that does not identify an individual.The Agencies believe that qualifying the term consumer information to cover only personally identifiable information appropriately focuses on the information derived from a consumer report that, if improperly disposed, could be used to commit fraud or identity theft against a consumer. The Agencies believe that limiting consumer information to information that identifies a consumer is consistent with the current law relating to the scope of the term consumer report under the FCRA and the purposes of section 216 of the FACT Act.
Under the final rule, a financial institution must implement measures to properly dispose of consumer information that identifies a consumer, such as the consumers name and the credit score derived from a consumer report. However, this requirement does not apply to aggregate information, such as the mean credit score that is derived from a group of consumer reports, or blind data, such as a series of credit scores that do not identify the subjects of the consumer reports from which those scores are derived. The Agencies have included examples of records that illustrate this aspect of the Guidelines, but have not rigidly defined the nature and scope of personally identifiable information. The Agencies note that there are a variety of types of information apart from an individuals name, account number, or address that, depending on the circumstances or when used in combination, could identify the individual.
A few commenters argued that the term consumer information should exclude non-sensitive information about a consumer, such as names and addresses that are publicly available. These commenters urged the Agencies to limit consumer information to information about an individuals specific financial characteristics, such as payment history or account numbers, or personal characteristics, such as drivers license information. In their view, only sensitive, non-public information should be subject to the requirements of the rule because unauthorized access to or misuse of that information poses the greatest threats of identity theft against consumers. The Agencies believe that there is no basis to exclude certain classes of relatively non-sensitive information from the scope of consumer information under section 216 of the Act.
Some commenters urged the Agencies to eliminate references to business-related transactions in the discussion of the definition of consumer information. These commenters argued that the FCRA defines a consumer report only with respect to information used to determine a consumers eligibility for credit or insurance to be used primarily for personal, family, or household purposes. 8 Thus, these commenters recommended that the Agencies remove references to business transactions that, in their view, would be inconsistent with the scope of the FCRA. The Agencies note that the FCRA defines a consumer report as encompassing a communication by a consumer reporting agency of information about a consumer that, in general, is used as a factor in establishing the consumers eligibility for any other purpose authorized under section 604 [of the FCRA]. 9 Among other permissible purposes, a consumer reporting agency lawfully may furnish a consumer report to a person which it has reason to believe otherwise has a legitimate business need for the information in connection with a business transaction that is initiated by the consumer. 10 If used in whole or in part to establish a consumers eligibility for a business transaction that is initiated by the consumer, such as an application for a small business loan that is initiated by a sole proprietor, then that information could be a consumer report. Accordingly, a financial institution that maintains information derived from a consumer report for a business purpose including a consumer report originally obtained in connection with a business transaction that is initiated by the consumer, would be subject to the requirement to properly dispose of such information, pursuant to section 216 of the FACT Act.
The relationship between consumer information and customer information can be illustrated through the following examples. Payment history information from a consumer report about an individual, who is a financial institutions customer, will be both consumer information because it comes from a consumer report and customer information because it is nonpublic personal information about a customer. In some circumstances, customer information will be broader than consumer information. For instance, information about a financial institutions own transactions with its customer is customer information but is not consumer information because it does not come from a consumer report. In other circumstances, consumer information will be broader than customer information. Consumer information includes information from a consumer report that an institution obtains about an individual who applies for but does not receive a loan, an individual who guarantees a loan (including a loan to a business entity), an employee or a prospective employee, or an individual in connection with a loan to the individuals sole proprietorship. In each of these instances, the consumer reports are not customer information because the information is not about a customer within the meaning of the Guidelines.
The Agencies believe that the phrase derived from consumer reports covers all of the information about a consumer that is taken from a consumer report, including information that results in whole or in part from manipulation of information from a consumer report or information from a consumer report that has been combined with other types of information. Consequently, a financial institution that possesses any of this information must properly dispose of it. For example, any record about a consumer derived from a consumer report, such as the consumers name and credit score, that is shared among affiliates must be disposed of properly by each affiliate that possesses that information.12 Similarly, a consumer report that is shared among affiliated companies after the consumer has been given a notice and has elected not to opt out of that sharing, and therefore is no longer a consumer report under the FCRA,13 would still be consumer information. Accordingly, an affiliate that receives consumer information under these circumstances must properly dispose of the information.
A few commenters suggested that the Agencies modify this provision to limit the obligation of a financial institution to properly dispose of consumer information only when the institution knows that the information has been derived from a consumer report. The Agencies believe that implementing such a limitation is unwarranted in light of the general duty established in section 216 of the Act which applies to any person that maintains or otherwise possesses consumer information, without regard to whether the person actually knows that it possesses such information.
The Agencies note that the proposed definition of consumer information includes the qualification for a business purpose, as set forth in section 216 of the Act. The Agencies believe that the phrase for a business purpose encompasses any commercial purpose for which a financial institution might maintain or possess consumer information. Commenters did not raise concerns about this interpretation.
Some commenters urged the Agencies to define the term disposal to clarify whether the sale, donation, or transfer of any medium containing consumer information is covered by the requirements imposed under the Guidelines. A few other commenters, however, disagreed with this suggestion and supported the Agencies proposal, which was silent with respect to this particular term. The Agencies believe that there is no need to adopt a definition of the term disposal because, in the context of the duty imposed under section 216 of the FACT Act, the ordinary meaning of that term applies. The Agencies note that any sale, lease, or other transfer of any medium containing consumer information constitutes disposal of the information insofar as the information itself is not the subject of the sale, lease, or other transfer between the parties. By contrast, the sale, lease, or other transfer of consumer information from a financial institution to another party (which may be subject to limitations imposed under other laws) can be distinguished from the act of throwing out or getting rid of consumer information, and accordingly, does not constitute disposal that is subject to the Agencies rule.
The Agencies proposed to add a new objective regarding the proper disposal of consumer information in paragraph II.B. of the Guidelines. A few commenters expressed objections to this aspect of the proposal, mainly insofar as this provision relates to service providers.
Under the final rule, a financial institution must design its information security program to satisfy the general objective to [e]nsure the proper disposal of customer information and consumer information. The added reference to customer information more directly states an institutions overall duties with respect to disposing of information. However, because proper disposal of customer information already is part of a financial institutions obligation in designing and maintaining its information security program under the Guidelines, the inclusion of customer information in the objective does not impose a new requirement on an institutions compliance with the Guidelines.
The general objective to [e]nsure the proper disposal of customer information and consumer information replaces the proposed provision that would require an institution to develop controls in a manner consistent with the disposal of customer information. The Agencies believe that setting forth the obligation in this manner more directly states a financial institutions obligation to develop and maintain risk-based measures to dispose of both types of information properly and is consistent with the Guidelines and the Act.
By expressly incorporating a provision in paragraph II.B., each financial institution must contractually require its service providers to develop appropriate measures for the proper disposal of consumer information and, where warranted, to monitor its service providers to confirm that they have satisfied their contractual obligations. As several commenters observed, the particular contractual arrangements that an institution may negotiate with a service provider may take varied forms or use general terms. As a result, some institutions may have existing contracts that cover the proper disposal of customer information and consumer information. The Agencies continue to believe that the parties should be allowed substantial latitude in negotiating the contractual terms appropriate to their arrangement in any manner that satisfies the objectives of the Guidelines. Accordingly, the Agencies have not prescribed any particular standards that relate to this contract requirement.
The Agencies have made a technical amendment to the definition of service provider in paragraph I.C.2. to include a reference to consumer information in addition to customer information. Thus the amended definition of service provider is any person or entity that maintains, processes, or otherwise is permitted access to customer information or consumer information through its provision of services directly to the bank. Consistent with section 216 and the amendments to the Guidelines, a financial institutions obligation with respect to a service provider that has access to consumer information is limited to ensuring that the service provider properly disposes of consumer information.
The Agencies also have amended paragraph III.G.2. to allow a financial institution a reasonable period of time, after the final regulations are issued, to amend its contracts with its service providers to incorporate the necessary requirements in connection with the proper disposal of consumer information. After reviewing the comments on this provision of the proposal, which uniformly advocated a longer period of time for modifying contracts with service providers if necessary, the Agencies have determined that financial institutions must modify any affected contracts not later than July 1, 2006.
The Agencies have amended paragraph III.C. (Manage and Control Risk) of the Guidelines by adding a new provision to require a financial institution to develop, implement, and maintain, as part of its information security program, appropriate measures to properly dispose of customer information and consumer information. Like the provision described in the proposal, this new provision requires an institution to implement these measures in accordance with each of the requirements in this paragraph III. of the Guidelines.
Paragraph III. of the Guidelines presently requires a financial institution to undertake measures to design, implement, and maintain its information security program to protect customer information and customer information systems. Because customer information systems is defined to include any methods used to dispose of customer information, a financial institution presently must use risk-based measures to protect customer information in the course of disposing of it. Building on this provision in the Guidelines, the Agencies proposed a provision in paragraph III.C. that would require a financial institution to develop controls in a manner consistent with the disposal of customer information. Commenters generally supported this provision because a financial institution would be permitted to develop and implement risk-based protections, rather than adopt particular methods for disposing of consumer information that would comply with a prescriptive standard.
Under the final rule, an institution must adopt procedures and controls to properly dispose of consumer information and customer information. Instead of describing a financial institutions obligation to dispose of consumer information in relation to the standard for customer information (which is currently set forth in discrete provisions of the Guidelines), the Agencies have determined that the obligation should be stated directly and generally. A provision that requires each financial institution to develop and maintain risk-based measures to properly dispose of customer information and consumer information more clearly states an institutions responsibilities to properly dispose of both classes of information and is consistent with the Guidelines and the Act.
Under this provision of the final rule, a financial institution must broaden the scope of its risk assessment to include an assessment of the reasonably foreseeable internal and external threats associated with the methods it uses to dispose of consumer information, and adjust its risk assessment in light of the relevant changes relating to such threats. By expressly adding this new provision, the Agencies are requiring a financial institution to integrate into its information security program each of those risk-based measures in connection with the disposal of consumer information, as set forth in paragraph III. of the Guidelines.
Some commenters urged the Agencies to adopt a detailed standard for the destruction of information or criteria that define proper methods or levels of disposal, rather than a provision that tracks the general obligation imposed under section 216 of the FACT Act. Other commenters favored the approach set forth in the proposal and argued that the general duty to properly dispose of consumer information is appropriately suited to the varying circumstances that financial institutions confront.
As set forth in the proposal, the Agencies final rules create a cross-reference to the Guidelines in their respective regulations that implement the FCRA17 by adding a provision setting forth the duties of users of consumer reports regarding identity theft. Commenters generally agreed with the Agencies proposal to create the cross-reference. In particular, commenters supported the Agencies proposal to make explicit in the regulations the rule of construction in the statute stating that the requirement pertaining to proper disposal under the FCRA shall not be construed as requiring a person to maintain or destroy a record containing consumer information and does not alter any requirement imposed under other law to maintain or destroy such a record.
In accordance with the Paperwork Reduction Act of 1995 (44 U.S.C. 3501 et seq.) and its implementing regulations at 5 CFR 1320, including Appendix A.1, the Agencies have reviewed the final rules and determined that they contain no collections of information. The Board made this determination under authority delegated by the Office of Management and Budget.
In accordance with the Regulatory Flexibility Act, each agency must publish a final regulatory flexibility analysis with its final rule, unless the agency certifies that the rule will not have a significant economic impact on a substantial number of small entities. (5 U.S.C. 601-612). Each of the Agencies hereby certifies that its final rule does not have a significant economic impact on a substantial number of small entities.
Any modifications to a financial institutions information security program needed to address the proper disposal of consumer information could be incorporated through the process the institution presently uses to adjust its program under paragraph III.E. of the Guidelines, particularly because of the similarities between customer information and consumer information and the measures commonly used to properly dispose of both types of information. To the extent that these rules impose new requirements for certain types of consumer information, developing appropriate measures to properly dispose of that information likely would require only a minor modification of an institutions existing information security program.
Because some consumer information will be customer information and because segregating particular records for special treatment may entail considerable costs, the Agencies believe that many banks and savings associations, including small institutions, already are likely to have implemented measures to properly dispose of both customer and consumer information. In addition, the Agencies, through the Federal Financial Institutions Examination Council (FFIEC), already have issued guidance regarding their expectations concerning the proper disposal of all of an institutions paper and electronic records. See FFIEC Information Technology Examination Handbook, Information Security Booklet, December 2002, p. 63.21 Therefore, the rules do not require any significant changes for institutions that currently have procedures and systems designed to comply with this guidance.
The Agencies anticipate that, in light of current practices relating to the disposal of information in accordance with the Guidelines and the guidance issued by the FFIEC, the final rules will not impose undue costs on financial institutions. Therefore, the Agencies believe that the controls that small financial institutions will develop and implement, if any, to comply with the rules likely pose a minimal economic impact on those entities.
The Small Business Regulatory Enforcement Fairness Act of 1996 (SBREFA) (Public Law 104-121, 110 Stat. 857) provides generally for agencies to report rules to Congress and for Congress to review these rules. The reporting requirement is triggered in instances where the FDIC issues a final rule as defined by the Administrative Procedure Act (APA) (5 U.S.C. 551, et seq.). Because the FDIC is issuing a final rule as defined by the APA, the FDIC will file the reports required by SBREFA.
The OCC and OTS each have determined that this rule is not a significant regulatory action under Executive Order 12866.
Under Section 202 of the Unfunded Mandates Reform Act of 1995, Public Law 104-4 (2 U.S.C. 1532) (Unfunded Mandates Act), the OCC and OTS must prepare budgetary impact statements before promulgating any rule likely to result in a federal mandate that may result in the expenditure by state, local, and tribal governments, in the aggregate, or by the private sector of $100 million or more in any one year. If a budgetary impact statement is required, under section 205 of the Unfunded Mandates Act, the OCC and OTS must identify and consider a reasonable number of regulatory alternatives before promulgating a rule.
For the reasons outlined earlier, the OCC and OTS have determined that this proposal will not result in expenditures by state, local, and tribal governments, or by the private sector, of $100 million or more, in any one year. Accordingly, a budgetary impact statement is not required under section 202 of the Unfunded Mandates Reform Act of 1995 and this rulemaking requires no further analysis under the Unfunded Mandates Act.
Banks, banking, Consumer protection, National banks, Privacy, Reporting and recordkeeping requirements.
Banks, banking, Consumer protection, National Banks, Reporting and recordkeeping requirements.
Banks, banking, Consumer protection, Information, Privacy, Reporting and recordkeeping requirements.
Exports, Foreign banking, Holding companies, Reporting and recordkeeping requirements.
Banks, banking, Holding companies, state member banks.
Banks, banking, Holding companies, Reporting and recordkeeping requirements.
Administrative practice and procedure, Bank deposit insurance, Banks, banking, Reporting and recordkeeping requirements, Safety and Soundness.
Consumer protection, Privacy, Reporting and recordkeeping requirements, Savings associations, Security measures.
Accounting, Administrative practice and procedure, Bank deposit insurance, Consumer protection, Holding companies, Privacy, Reporting and recordkeeping requirements, Safety and soundness, Savings associations.
Consumer protection, Credit, Fair Credit Reporting Act, Privacy, Reporting and recordkeeping requirements, Savings associations.
Authority: 12 U.S.C. 93a, 1818, 1831-p and 3102(b); 15 U.S.C. 1681s, 1681w, 6801, and 6805(b)(1).
The Interagency Guidelines Establishing Information Security Standards (Guidelines) set forth standards pursuant to section 39 of the Federal Deposit Insurance Act (section 39, codified at 12 U.S.C. 1831p-1), and sections 501 and 505(b), codified at 15 U.S.C. 6801 and 6805(b) of the Gramm-Leach Bliley Act. These Guidelines address standards for developing and implementing administrative, technical, and physical safeguards to protect the security, confidentiality, and integrity of customer information. These Guidelines also address standards with respect to the proper disposal of consumer information, pursuant to sections 621 and 628 of the Fair Credit Reporting Act (15 U.S.C. 1681s and 1681w).
A. Scope. * * * The Guidelines also apply to the proper disposal of consumer information by or on behalf of such entities.
b. Consumer information means any record about an individual, whether in paper, electronic, or other form, that is a consumer report or is derived from a consumer report and that is maintained or otherwise possessed by or on behalf of the bank for a business purpose. Consumer information also means a compilation of such records. The term does not include any record that does not identify an individual.
(E) Information from a consumer report that the bank obtains about an employee or prospective employee.
(B) Blind data, such as payment history on accounts that are not personally identifiable, that may be used for developing credit scoring models or for other purposes.
c. Consumer report has the same meaning as set forth in the Fair Credit Reporting Act, 15 U.S.C. 1681a(d).
g. Service provider means any person or entity that maintains, processes, or otherwise is permitted access to customer information or consumer information through its provision of services directly to the bank.
4. Ensure the proper disposal of customer information and consumer information.
4. Develop, implement, and maintain, as part of its information security program, appropriate measures to properly dispose of customer information and consumer information in accordance with each of the requirements of this paragraph III.
3. Effective date for measures relating to the disposal of consumer information. Each bank must satisfy these Guidelines with respect to the proper disposal of consumer information by July 1, 2005.
4. Exception for existing agreements with service providers relating to the disposal of consumer information. Notwithstanding the requirement in paragraph III.G.3., a banks contracts with its service providers that have access to consumer information and that may dispose of consumer information, entered into before July 1, 2005, must comply with the provisions of the Guidelines relating to the proper disposal of consumer information by July 1, 2006.
Authority: 12 U.S.C. 1 et seq., 24 (Seventh), 93a, 481, 484, and 1818; 15 U.S.C. 1681s, 1681w, 6801 and 6805.
(a) Purpose. The purpose of this part is to establish standards for national banks regarding consumer report information. In addition, the purpose of this part is to specify the extent to which national banks may obtain, use, or share certain information. This part also contains a number of measures national banks must take to combat consumer fraud and related crimes, including identity theft.
(e) Consumer means an individual.
§ 41.83 Disposal of consumer information.
(a) Definitions as used in this section. (1) Bank means national banks, Federal branches and agencies of foreign banks, and their respective operating subsidiaries.
(b) In general. Each bank must properly dispose of any consumer information that it maintains or otherwise possesses in accordance with the Interagency Guidelines Establishing Information Security Standards, as set forth in appendix B to 12 CFR part 30, to the extent that the bank is covered by the scope of the Guidelines.
(2) Alter or affect any requirement imposed under any other provision of law to maintain or destroy such a record.
Authority: 12 U.S.C. 24, 36, 92a, 93a, 248(a), 248(c), 321-338a, 371d, 461, 481-486, 601, 611, 1814, 1816, 1820(d)(9), 1823(j), 1828(o), 1831, 1831o, 1831p-1, 1831r-1, 1831w, 1831x, 1835a, 1882, 2901-2907, 3105, 3310, 3331-3351, and 3906-3909, 15 U.S.C. 78b, 78l(b), 78l(g), 78l(i), 78o-4(c)(5), 78q, 78q-1, 78w, 1681s, 1681w, 6801 and 6805; 31 U.S.C. 5318, 42 U.S.C. 4012a, 4104a, 4104b, 4106, and 4128.
§ 208.3 Application and conditions for membership in the Federal Reserve System.
(d) Conditions of membership. (1) Safety and soundness. Each member bank shall at all times conduct its business and exercise its powers with due regard to safety and soundness. Each member bank shall comply with the Interagency Guidelines Establishing Standards for Safety and Soundness prescribed pursuant to section 39 of the FDI Act (12 U.S.C. 1831p-1), set forth in appendix D-1 to this part, and the Interagency Guidelines Establishing Information Security Standards prescribed pursuant to sections 501 and 505 of the Gramm-Leach-Bliley Act (15 U.S.C. 6801 and 6805) and section 216 of the Fair and Accurate Credit Transactions Act of 2003 (15 U.S.C. 1681w), set forth in appendix D-2 to this part.
b. In section I., Introduction, a new sentence is added at the end of the introductory paragraph.
c. In section I.A., Scope, a new sentence is added at the end of the paragraph.
d. In section I.C.2., paragraphs b. through f. are redesignated as paragraphs 2.d. through 2.h., respectively, new paragraphs 2.b. and 2.c. are added and redesignated paragraph g. is amended.
e. In paragraph II. the heading entitled Standards for Safeguarding Customer Information is revised to read Standards for Information Security.
f. At the end of paragraph II.B.2. the word and is removed.
g. At the end of paragraph II.B.3 the period is removed and replaced with ; and.
h. In section II.B. a new paragraph 4. is added.
i. In section III.C., Manage and Control Risk, a new paragraph 4. is added.
j. In section III.G., Implement the Standards, new paragraphs 3. and 4. are added.
* * * These Guidelines also address standards with respect to the proper disposal of consumer information, pursuant to sections 621 and 628 of the Fair Credit Reporting Act (15 U.S.C. 1681s and 1681w).
A.	Scope. * * * These Guidelines also apply to the proper disposal of consumer information by or on behalf of such entities.
4.	Develop, implement, and maintain, as part of its information security program, appropriate measures to properly dispose of customer information and consumer information in accordance with each of the requirements in this paragraph III.
Authority: 12 U.S.C. 221 et seq., 1818, 1835a, 1841 et seq., 3101 et seq., and 3901 et seq.; 15 U.S.C. 1681s, 1681w, 6801 and 6805.
§ 211.5 Edge and agreement corporations.
(l) Protection of customer information and consumer information. An Edge or agreement corporation shall comply with the Interagency Guidelines Establishing Information Security Standards prescribed pursuant to sections 501 and 505 of the Gramm-Leach-Bliley Act (15 U.S.C. 6801 and 6805) and, with respect to the proper disposal of consumer information, section 216 of the Fair and Accurate Credit Transactions Act of 2003 (15 U.S.C. 1681w), set forth in appendix D-2 to part 208 of this chapter.
§ 211.24 Approval of offices of foreign banks; procedures for applications; standards for approval; representative-office activities and standards for approval; preservation of existing authority.
(i) Protection of customer information and consumer information. An uninsured state-licensed branch or agency of a foreign bank shall comply with the Interagency Guidelines Establishing Information Security Standards prescribed pursuant to sections 501 and 505 of the Gramm-Leach-Bliley Act (15 U.S.C. 6801 and 6805) and, with respect to the proper disposal of consumer information, section 216 of the Fair and Accurate Credit Transactions Act of 2003 (15 U.S.C. 1681w), set forth in appendix D-2 to part 208 of this chapter.
Authority: 15 U.S.C. 1681, 1681b, 1681s, 1681s-2, and 1681w.
8. In section 222.1(b)(2)(i) remove the phrase paragraph (b)(2) and add in its place the word part.
§ 222.83 Disposal of consumer information.
(a) Definitions as used in this section. (1) You means member banks of the Federal Reserve System (other than national banks) and their respective operating subsidiaries, branches and agencies of foreign banks (other than Federal branches, Federal agencies and insured State branches of foreign banks), commercial lending companies owned or controlled by foreign banks, and organizations operating under section 25 or 25A of the Federal Reserve Act (12 U.S.C. 601 et seq., 611 et seq.).
(b) In general. You must properly dispose of any consumer information that you maintain or otherwise possess in accordance with the Interagency Guidelines Establishing Information Security Standards, as required under sections 208.3(d) (Regulation H), 211.5(l) and 211.24(i) (Regulation K) of this chapter, to the extent that you are covered by the scope of the Guidelines.
(h) Protection of customer information and consumer information. A bank holding company shall comply with the Interagency Guidelines Establishing Information Security Standards, as set forth in appendix F of this part, prescribed pursuant to sections 501 and 505 of the Gramm-Leach-Bliley Act (15 U.S.C. 6801 and 6805). A bank holding company shall properly dispose of consumer information in accordance with the rules set forth at 16 CFR Part 682.
a. The heading for Appendix F to Part 225 entitled Interagency Guidelines Establishing Standards for Safeguarding Customer Information is revised to read Interagency Guidelines Establishing Information Security Standards wherever it appears in Title 12, Chapter 2, Part 225.
By order of the Board of Governors of the Federal Reserve System, December 16, 2004.
Authority: 12 U.S.C. 1818 and 1819 (Tenth); 15 U.S.C. 1681b, 1681s, and 1681w.
§ 334.80-334.82 [Reserved] § 334.83 Disposal of consumer information. (a) In general. You must properly dispose of any consumer information that you maintain or otherwise possess in accordance with the Interagency Guidelines Establishing Information Security Standards, as set forth in appendix B to part 364 of this chapter, prescribed pursuant to section 216 of the Fair and Accurate Credit Transactions Act of 2003 (15 U.S.C. 1681w) and section 501(b) of the Gramm-Leach-Bliley Act (15 U.S.C. 6801(b)), to the extent the Guidelines are applicable to you.
(2)	Alter or affect any requirement imposed under any other provision of law to maintain or destroy such a record.
Authority: 12 U.S.C. 1819(Tenth), 1831p-1; 15 U.S.C. 1681s, 1681w, 6801(b), 6805(b)(1).
§ 364.101 Standards for safety and soundness.
(b) Interagency Guidelines Establishing Information Security Standards. The Interagency Guidelines Establishing Information Security Standards prescribed pursuant to section 39 of the Federal Deposit Insurance Act (12 U.S.C. 1831p-1), and sections 501 and 505(b) of the Gramm-Leach-Bliley Act (15 U.S.C. 6801, 6805(b)), and with respect to the proper disposal of consumer information requirements pursuant to section 628 of the Fair Credit Reporting Act (15 U.S.C. 1681w), as set forth in appendix B to this part, apply to all insured state nonmember banks, insured state licensed branches of foreign banks, and any subsidiaries of such entities (except brokers, dealers, persons providing insurance, investment companies, and investment advisers).
a. The heading for Appendix B to part 364 entitled Interagency Guidelines Establishing Standards for Safeguarding Customer Information is revised to read Interagency Guidelines Establishing Information Security Standards wherever it appears in Title 12, Chapter 2, part 364.
b. In the Introduction, the first sentence is revised and a new sentence is added at the end of the introductory paragraph.
c. In section I.A., Scope, the first sentence is revised.
d. In section I.C.2., Definitions, paragraphs 2.b. through 2.e. are redesignated as paragraphs 2.d. through 2.g., respectively, new paragraphs 2.b. and 2.c. are added and redesignated paragraph g. is amended.
Customer Information is revised to read Standards for Information Security.
j. In section III.G, Implement the Standards, new paragraphs 3. and 4. are added.
I. Introduction The Interagency Guidelines Establishing Information Security Standards (Guidelines) set forth standards pursuant to section 39 of the Federal Deposit Insurance Act, 12 U.S.C. 1831p-1, and sections 501 and 505(b), 15 U.S.C. 6801 and 6805(b), of the Gramm- Leach-Bliley Act.* * * These Guidelines also address standards with respect to the proper disposal of consumer information pursuant to sections 621 and 628 of the Fair Credit Reporting Act (15 U.S.C. 1681s and 1681w).
b. Consumer information means any record about an individual, whether in paper, electronic, or other form, that is a consumer report or is derived from a consumer report and that is maintained or otherwise possessed by or on behalf of the bank for a business purpose. Consumer information also means a compilation of such records. The term does not include any record that does not personally identify an individual.
(D) information from a consumer report that the bank obtains about an individual who guarantees a loan (including a loan to a business entity); or (E) information from a consumer report that the bank obtains about an employee or prospective employee.
4.	Develop, implement, and maintain, as part of its information security program, appropriate measures to properly dispose of customer information and consumer information in accordance with each of the requirements of this paragraph III.
3.	Effective date for measures relating to the disposal of consumer information. Each bank must satisfy these Guidelines with respect to the proper disposal of consumer information by July 1, 2005.
Dated at Washington, D.C., this 7th day of December, 2004.
Authority: 12 U.S.C. 1462a, 1463, 1464, 1467a, 1828, 1831p-1, 1881-1884; 15 U.S.C. 1681s and 1681w; 15 U.S.C. 6801 and 6805(b)(1).
2. Revise the part heading for part 568 to read as shown above.
§ 568.1 Authority, purpose, and scope.
§ 568.5 Protection of customer information.
Savings associations and their subsidiaries (except brokers, dealers, persons providing insurance, investment companies, and investment advisers) must comply with the Interagency Guidelines Establishing Information Security Standards set forth in appendix B to part 570 of this chapter.
5. In the Index for part 570, the heading for Appendix B is revised by removing Interagency Guidelines Establishing Standards for Safeguarding Customer Information, as revised by OTSs Technical Amendments Final Rule published in December 2004, and inserting Interagency Guidelines Establishing Information Security Standards in its place.
7. Amend § 570.1(b) by removing the phrase Interagency Guidelines Establishing Standards for Safeguarding Customer Information and adding the phrase Interagency Guidelines Establishing Information Security Standards in its place.
8. Amend § 570.1(c) by removing the phrase Interagency Guidelines Establishing Standards for Safeguarding Customer Information, as revised by OTSs Technical Amendments Final Rule published in December 2004, and adding the phrase Interagency Guidelines Establishing Information Security Standards in its place.
9. Amend § 570.2(a) by removing the phrase Interagency Guidelines Establishing Standards for Safeguarding Customer Information and adding the phrase Interagency Guidelines Establishing Information Security Standards in its place.
j. Adding new paragraphs 3. and 4. to paragraph III.G. Implement the Standards.
The Interagency Guidelines Establishing Information Security Standards (Guidelines) set forth standards pursuant to section 39(a) of the Federal Deposit Insurance Act (12 U.S.C. 1831p-1), and sections 501 and 505(b) of the Gramm-Leach-Bliley Act (15 U.S.C. 6801 and 6805(b)). These Guidelines address standards for developing and implementing administrative, technical, and physical safeguards to protect the security, confidentiality, and integrity of customer information. These Guidelines also address standards with respect to the proper disposal of consumer information, pursuant to sections 621 and 628 of the Fair Credit Reporting Act (15 U.S.C. 1681s and 1681w).
A. Scope. * * * These Guidelines also apply to the proper disposal of consumer information by or on behalf of such entities.
a. Consumer information means any record about an individual, whether in paper, electronic, or other form, that is a consumer report or is derived from a consumer report and that is maintained or otherwise possessed by you or on your behalf for a business purpose. Consumer information also means a compilation of such records. The term does not include any record that does not identify an individual.
(E) Information from a consumer report that you obtain about an employee or prospective employee.
b. Consumer report has the same meaning as set forth in the Fair Credit Reporting Act, 15 U.S.C. 1681a(d).
f. Service provider means any person or entity that maintains, processes, or otherwise is permitted access to customer information or consumer information, through its provision of services directly to you.
4. Develop, implement, and maintain, as part of your information security program, appropriate measures to properly dispose of customer information and consumer information in accordance with each of the requirements in this paragraph III.
3. Effective date for measures relating to the disposal of consumer information. You must satisfy these Guidelines with respect to the proper disposal of consumer information by July 1, 2005.
4. Exception for existing agreements with service providers relating to the disposal of consumer information. Notwithstanding the requirement in paragraph III.G.3., your contracts with service providers that have access to consumer information and that may dispose of consumer information, entered into before July 1, 2005, must comply with the provisions of the Guidelines relating to the proper disposal of consumer information by July 1, 2006.
571.1 Purpose, scope, and effective dates.
571.83 Disposal of consumer information.
§ 571.1 Purpose and scope.
(a) Purpose. The purpose of this part is to establish standards regarding consumer report information. In addition, the purpose of this part is to specify the extent to which you may obtain, use, or share certain information. This part also contains a number of measures you must take to combat consumer fraud and related crimes, including identity theft.
(2) Institutions covered. (i) Except as otherwise provided in this paragraph (b)(2), this part applies to savings associations whose deposits are insured by the Federal Deposit Insurance Corporation (and federal savings association operating subsidiaries in accordance with § 559.3(h)(1) of this chapter).
(o) You means savings associations whose deposits are insured by the Federal Deposit Insurance Corporation and federal savings association operating subsidiaries.
§ 571.83 Disposal of consumer information.
(a) In general. You must properly dispose of any consumer information that you maintain or otherwise possess in accordance with the Interagency Guidelines Establishing Information Security Standards, as set forth in appendix B to part 570, to the extent that you are covered by the scope of the Guidelines.
1 69 FR 31913 (June 8, 2004). The Guidelines are codified at 12 CFR Parts 30, app. B (OCC); 208, app. D-2 and 225, app. F (Board); 364, app. B (FDIC); 570, app. B (OTS). Citations to the Guidelines omit references to titles and publications and give only the appropriate paragraph or section number.
2 Individual consumers and organizations representing consumers submitted comments on the proposed rule issued by the Federal Trade Commission (FTC), which was substantively similar to the Agencies proposal. 69 FR 21388 (April 20, 2004); see http://www.ftc.gov/os/comments/disposal/index.htm. The Agencies have reviewed these and other comments submitted to the FTC in connection with this final rule.
3 66 FR 8616 (Feb. 1, 2001).
5 See generally, III.B. and III.C.
7 The Agencies are renaming the Interagency Guidelines Establishing Standards for Safeguarding Customer Information to read Interagency Guidelines Establishing Standards for Information Security to make clear that the Guidelines encompass the disposal of consumer information.
12 An affiliate subject to the jurisdiction of the OCC, Board, FDIC, or OTS must properly dispose of consumer information that it possesses or maintains in accordance with the agencys rule. An affiliate subject to the jurisdiction of the FTC or the SEC must properly dispose of consumer information that it possesses or maintains in accordance with the FTCs or SECs final rules, as applicable, which are consistent and comparable to this final rule. Savings associations and savings association subsidiaries that are not functionally regulated are subject to the OTSs Guidelines.
14 III.D.2. This requirement applies to service providers located domestically and abroad.
15 See FFIEC Information Technology Examination Handbook, Information Security Booklet, page 63 at: http://www.ffiec.gov/ffiecinfobase/booklets/information_security/information_security.pdf.
17 12 CFR part 41 (OCC); 12 CFR part 222 (Board); 12 CFR part 334 (FDIC); and 12 CFR part 571 (OTS). Several of the Agencies proposed establishing new parts to house their respective regulations implementing the FCRA in a notice of proposed rulemaking titled Fair Credit Reporting Medical Information Regulations. See 69 FR 23380 (April 28, 2004). As these regulations are not yet final, the new parts are established in this final rule.
18 Bank holding companies will be subject to the FTCs disposal rule (16 CFR Part 682) and functionally regulated subsidiaries of financial institutions will be subject to the SECs disposal rule (17 CFR Part 248) or the FTCs disposal rule, as applicable.
19 The OTS is making additional conforming changes to its regulations at 12 CFR 568.1 and 568.5, as well.
20 In 2001, the Agencies issued final Guidelines requiring financial institutions to develop and maintain an information security program, including procedures to dispose of customer information, and each agency provided a final regulatory flexibility analysis at that time. See 66 FR 8625-32 (Feb. 1, 2001).
21 See footnote 15, supra.

References: V. 

§ 41

§ 208

§ 211

§ 211

§ 222

§ 334
 § 334

§ 364

§ 568

§ 568
 § 570
 § 570
 § 570

§ 571
 § 559

§ 571