Opinion ID: 2356015
Heading Depth: 4
Heading Rank: 1

Heading: Any personally identifiable financial information?

Text: ¶ 14 The first meaning of `nonpublic personal information' is personally identifiable financial information. 15 U.S.C. § 6809(4)(A); 16 C.F.R. § 313.3(n)(1)(i).  Personally identifiable financial information  means any information, in the context of the provision of a financial product or service, that (1) a consumer gives to a financial institution, (2) is about a consumer's transaction, or (3) a financial institution obtains from a consumer. 16 C.F.R. § 313.3( o )(1); see also 15 U.S.C. § 6809(4)(A)(i)-(iii). The FTC rule provides relevant examples of information that meets this definition. Meeting the definition are [i]nformation a consumer provides to you on an application to obtain a loan, 16 C.F.R. § 313.3( o )(2)(i)(A), [t]he fact that an individual is or has been one of your customers or has obtained a financial product or service from [a financial institution], 16 C.F.R. § 313.3( o )(2)(i)(C), and [a]ny information about [a financial institution's] consumer if it is disclosed in a manner that indicates that the individual is or has been [the financial institution's] consumer, 16 C.F.R. § 313.3( o )(2)(i)(D). See 16 C.F.R. § 313.3(h) (defining [ c ] ustomer). Not meeting the definition of [ p ] ersonally identifiable financial information  is [i]nformation that does not identify a consumer, such as aggregate information or blind data that does not contain personal identifiers such as account numbers, names, or addresses. 16 C.F.R. § 313.3( o )(1), (2)(ii)(B). ¶ 15 In the circumstances of this case, names, addresses, and phone numbers meet the definition of personally identifiable financial information. Not only are these bits of information personal identifiers, but also their disclosure by the AGO would reveal the fact that the individual is or has been Ameriquest's customer. See 16 C.F.R. § 313.3( o )(2)(i)(D). As noted above, the mere existence of the customer relationship is personally identifiable financial information. 16 C.F.R. § 313.3( o )(2)(i)(C). Only blind data or information stripped of personal identifiers are not protected information. 16 C.F.R. § 313.3( o )(2)(ii)(B). ¶ 16 Notably, the definition of [ p ] ersonally identifiable financial information  relates to information, and not to the vessel of the information (for example, a document or an e-mail). 16 C.F.R. § 313.3( o )(1). Therefore, any information meeting the definition of [ p ] ersonally identifiable financial information  is subject to the GLBA and the FTC rule, regardless of whether the information appears in loan files, e-mails, or the AGO's internal work product. Id. If the AGO took protected information from a loan file and reproduced it elsewhere (e.g., a memorandum listing the names of the consumers), the information does not lose its status as personally identifiable financial information. ¶ 17 Next, the information at issue must be filtered through the definition of [ p ] ublicly available information.  16 C.F.R. § 313.3(p)(1).