VIA E-MAIL: rule-comments@sec.gov
Jonathan G. Katz, Secretary
Securities and Exchange Commission
450 5th Street, N.W.
Washington, D.C. 20549-0609
Re: Gramm-Leach-Bliley Act Privacy Rule (File No. S7-6-00) , 17 CFR Part 248 - Comment.
ChoicePoint is pleased to submit these comments regarding the Security and Exchange Commission's proposed rule ("Proposed Rule") for implementing Title V of the Gramm-Leach-Bliley Act ("Title V" or "G-L-B Act").
While we support the privacy protective goals of Title V and the proposed rules published by the federal agencies to implement Title V, we are concerned about the impact that the Proposed Rule could have our ability to obtain and disclose consumer reports and credit header information from consumer reporting agencies. Credit header information, a term of art in the consumer reporting industry, was defined by the FTC, in a 1997 report to Congress, to mean "the portion of a credit report that typically contains an individual's name, aliases, birth date, Social Security number, current and prior addresses, and telephone number." Credit header information is a building block of many of our products and services designed to assist government agencies and private sector organizations in the identification and location of individuals for purposes ranging from the location of missing children, deadbeat dads, subjects for medical research, and lost stockholders and heirs to assisting in the apprehension of criminals and the prevention of fraud.
Our comments highlight three areas of concern we have about the Proposed Rule. First, we believe that the Proposed Rule's definition of the term "nonpublic personal information" is more broad than what Congress intended when it enacted Title V. Second, we believe that the Proposed Rule's definition of "publicly available information" should be revised to better reflect the nature of publicly available information and to provide a workable rule for financial institutions. Third, we are concerned that if the definitional problems in the Proposed Rule are not resolved, the Proposed Rule needs to make clear that the Proposed Rule does not interfere with the flow of information (both consumer reports and credit header data) to and from consumer reporting agencies and their clients pursuant to the Fair Credit Reporting Act ("FCRA").
ChoicePoint is the nation's premier source of personal information to the insurance industry and a leading provider of decision-making intelligence to businesses, individuals and government. Through the identification, retrieval, storage, analysis and delivery of data, ChoicePoint serves the informational needs of the property and casualty market, life and health market, and businesses, including Fortune 1000 corporations, asset-based lenders and professional service providers, and federal, state and local government agencies. ChoicePoint is also the largest provider of personal information products to employers for applicant and employee background screening purposes.
Protecting privacy is a ChoicePoint priority. Many of our products are already subject to important privacy protections provided by federal and state laws, such as the FCRA and its state law counterparts, or by self-regulatory principles, such as the Individual Reference Services Group ("IRSG") Principles. We are a founding member of the IRSG and we are a leader in the adoption and implementation of the IRSG Privacy Principles. To underscore our fundamental commitment to privacy and our vision that good privacy is good business -- for ChoicePoint, for our customers and for consumers -- we have adopted a comprehensive set of privacy principles which we apply in addition to the privacy protections mandated by law or self-regulatory principles. In addition, Our Board of Directors has created a special committee to oversee the implementation and future development of our privacy principles.
The Proposed Rule's definition of "nonpublic personal information" should be limited to information that is intrinsically financial in nature.
Title V and the Proposed Rule regulate the disclosure of "nonpublic personal information" by financial institutions to nonaffiliated third parties. The definition of "nonpublic financial information, as a result is critically important to the interpretation of Title V and the Proposed Rule. Section 509(4) of Title V defines the term "nonpublic personal information" to mean, in relevant part:
(A) ..personally identifiable financial information ---- (i) provided by a customer to a financial institution; (ii) resulting from any transaction with the customer or any service performed for the customer; or (iii) otherwise obtained by such financial institution. (B) Such term does not include publicly available information, as such term is defined by the regulations." (emphasis added).
The Proposed Rule appears to read the word "financial" out of the phrase "personally identifiable financial information," which, if not corrected in the final rule could bring credit header information within the definition of "nonpublic financial information." In our opinion, this is not what Congress intended. As the words used by the Congress in the definition of "nonpublic personal information" indicate, we believe Congress intended that the definition apply to information that was intrinsically financial in character. If Congress had intended Title V to cover more than financial information it could have done so easily and clearly by omitting the word "financial" from "personally identifiable financial information." Congress did not do so. As a result the Proposed Rule should be revised, consistent with the words of the statute, to limit the definition of "nonpublic personal information" to information that is intrinsically financial in nature.
The Proposed Rule should be revised to better reflect the nature of publicly available information.
The definition of "nonpublic financial information" in Title V states that "nonpublic personal information" does not include "publicly available information." The task of defining the term "publicly available information" is delegated by Title V to the regulatory agencies, most of whom have offered two alternative definitions, referred to as Alternatives A and B for public comment. If the definition of "nonpublic personal information" is not limited to information that is intrinsically financial in nature, then the definition of "publicly available information" could have a major impact on the treatment of credit header information under the Proposed Rule.
Alternative A, which the SEC did not include in the Proposed Rule, would deem information to be "publicly available" only if it was actually obtained from public sources. Under Alternative A the fact that the information is available from public sources is irrelevant if the financial institution did not actually obtain the information from such a source. This approach misunderstands the reasons for treating publicly available information differently from nonpublic information, mistakenly placing unnecessary emphasis on the source from which the financial institution obtains the information. The salient characteristic of "publicly available information" is not whether the financial institution obtained it from a public source, but rather whether the information could be obtained by others from a public source. The privacy goals of Title V are not advanced by restricting the ability of financial institutions to disclose information that is readily available to everyone from sources such as newspapers, telephone books, birth certificates, real estate records, UCC filings, licenses, or court records. Conversely, the privacy goals of Title V are advanced by restricting the ability of financial institutions to disclose information that in not typically available to the public (such as account balances) from these or other sources.
The SEC's preferred definition, Alternative B in most of the regulatory proposals, would exclude from the definition of "nonpublic personal information" information that is available from public sources, even if the financial institution did not obtain the information from such sources. This Alternative is a more appropriate treatment of "publicly available information." If the overly broad definition of "nonpublic personal information " were to be retained in the final rule despite our arguments to the contrary, Alternative B could result in the exclusion of identifying information of the type included in credit header reports from the reach of Title V because it is publicly available. Whether the outcome under Alternative B would significantly differ from Alternative A in practice, however, is unclear because the Proposed Rule does not provide any guidance on whether a particular piece of information is, in fact, "available" publicly. We suggest that the Proposed Rule create a presumption that certain categories of information, such as name, address, and other information that is included in credit header reports, are publicly available from many sources, such as those discussed above, and therefore financial institutions are not required to determine the actual availability on a case by case basis.
The Proposed Rule, consistent with Title V, should make clear that the operation of the FCRA is in no way altered by the Proposed Rule.
If the Proposed Rule is not revised to limit the definition of "nonpublic personal information" to information that is intrinsically financial or to define "publicly available information" in an appropriate and workable way, we are concerned that the Proposed Rule might be misinterpreted so as to limit our ability to obtain and redisclose consumer reports and credit header information in accordance with the FCRA. As you know, § 506(c) of Title V provides that, with the exception of certain explicit amendments concerning administrative enforcement of the FCRA, "nothing in this title shall be construed to modify, limit, or supercede the operation of the [FCRA], and no inference shall be drawn on the basis of the provisions of this title regarding whether information is transaction or experience information under section 603 of [the FCRA]." The Proposed Rule restates this provision, but does not elaborate.
We believe that there are potential ambiguities in the Proposed Rule which would be eliminated if the Proposed Rule were modified to include a discussion of the meaning of this section and clarify that § 506(c) takes precedence in the event of potential conflicts with other provisions of the Proposed Rule, particularly §§ 502(c) and 502(e) regarding the flow of information to and from consumer reporting agencies and their clients.
Section 502(c) of Title V prohibits nonaffiliated third parties that receive nonpublic personal information from financial institutions from disclosing that information to other nonaffiliated third parties, unless such a disclosure would be lawful if made directly by the financial institution. While consumer reporting agencies are not explicitly excepted from this provision, applying the provision to consumer reporting agencies would effectively eliminate consumer reports and credit header reports, and clearly conflict with §506(c). To avoid any ambiguity on this point, we request, that the Proposed Rule be modified to make clear that § 502(c) does not apply to consumer reporting agencies.
A similar clarification is necessary with respect to § 502(e)(6) of Title V, which provides an exception to the general rule established in §§ 502(a)-(b) for disclosures that are: "(A) to a consumer reporting agency in accordance with the Fair Credit Reporting Act, or (B) from a consumer report reported by a consumer reporting agency." The Proposed Rule would prohibit nonaffiliated third parties from using nonpublic personal information obtained under this exception for other purposes. This creates the potential, depending upon whether § 502(e)(6) were interpreted to include credit header information, that consumer reporting agencies would be barred from disclosing credit header information independently of consumer reports.
Such an outcome would conflict with section 506(c) because the disclosure of credit header information independently of a consumer report has long been recognized to be in accordance with the FCRA. Examples of this longstanding recognition include:
We believe that this last point is worth emphasizing. If Congress had intended to alter the settled law regarding the disclosure of credit header information, it would have done so explicitly. It has not done so. As a result, we suggest that the Proposed Rule be revised to make it clear that consumer reporting agencies can continue to disclose credit header information and the clients of consumer reporting agencies can continue to use and redisclose credit header information to the extent permitted by the FCRA.
Again, ChoicePoint appreciates the opportunity to submit comments on the Proposed Rule. Please contact me if you have any questions regarding our submission.
Sincerely,
J. Michael de Janes
General Counsel and Secretary
ChoicePoint Inc.
1000 Alderman Drive
Alpharetta, GA 30005
Tel. 770-752-5745