Opinion ID: 2356015
Heading Depth: 3
Heading Rank: 1

Heading: The GLBA exceptions

Text: ¶ 29 The GLBA prohibits nonaffiliated third parties from redisclosing nonpublic personal information [e]xcept as otherwise provided. 15 U.S.C. § 6802(c). Relying on this language, the AGO argues that it can disclose nonpublic personal information pursuant to the GLBA exception for disclosures necessary to comply with Federal, State, or local laws. 15 U.S.C. § 6802(e)(8). Because the PRA is a State ... law, the AGO claims it may disclose to comply. Id. We disagree. The AGO cites the statute out of context. ¶ 30 To understand the meaning of the exception in § 6802(e)(8), one has to read it together with the introduction to subsection (e) this way: Subsections (a) and (b) of this section shall not prohibit the disclosure of nonpublic personal information ... to comply with Federal, State, or local laws. 15 U.S.C. § 6802(e). And subsections (a) and (b), in turn, are the notice and opt-out requirements imposed on financial institutions. 15 U.S.C. § 6802(a)-(b). Therefore, the exceptions enumerated in § 6802(e) are not general exceptions available to whoever holds protected information. Rather, the exceptions describe the limited circumstances under which a financial institution may bypass the notice and opt-out provisions. Thus, the § 6802(e) exceptions do not give nonaffiliated third parties an unrestricted escape hatch from the nondisclosure rule of § 6802(c). ¶ 31 The AGO may invoke an exception under § 6802(e) only if Ameriquest could. Section 6802(c) allows the AGO's disclosure if such disclosure would be lawful if made directly to such other person by the financial institution. By the terms of § 6802(c), the lawfulness of the disclosure is measured as if the financial institution were standing in the shoes of the nonaffiliated party. See Marks v. Global Mortgage Group, Inc., 218 F.R.D. 492, 496 (S.D.W.Va. 2003) (The language in § 6802(e)(8) permitting disclosure `to comply with Federal, State, or local laws, rules, and other applicable legal requirements' refers to the numerous federal and state statutes, rules, and legal requirements that regulate the financial industry.). Ameriquest could not disclose directly to Huelsman in order to comply with Federal, State, or local laws, § 6802(e), because the PRA applies only to state agencies, RCW 42.56.010(1), .070(1). Thus, the AGO may not invoke this exception. [8] ¶ 32 The AGO could plausibly argue that Ameriquest, and therefore it, could disclose to Huelsman after obtaining the consumers' prior consent. 15 U.S.C. § 6802(e)(2). However, the FTC rule forecloses it.