; Affiliate Marketing Rule - Final
Documents
Resources
Learning Center
Upload
Plans & pricing Sign in
Sign Out
Your Federal Quarterly Tax Payments are due April 15th Get Help Now >>

Affiliate Marketing Rule - Final

VIEWS: 9 PAGES: 42

  • pg 1
									Tuesday,
October 30, 2007




Part II

Federal Trade
Commission
16 CFR Parts 680 and 698
Affiliate Marketing Rule; Final Rule
61424          Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations

FEDERAL TRADE COMMISSION                     consumer reporting agency.1 In                         consumer; or (4) to make a solicitation
                                             addition, the communication of such                    that has been authorized or requested by
16 CFR Parts 680 and 698                     transaction or experience information                  the consumer. Unlike the FCRA affiliate
                                             among affiliates will not result in any                sharing opt-out and the Gramm-Leach-
[Regulation No. 411006]                      affiliate becoming a consumer reporting                Bliley Act, 15 U.S.C. 6801 et seq.,
                                             agency. See FCRA §§ 603(d)(2)(A)(i) and                (GLBA) non-affiliate sharing opt-out,
RIN 3084-AA94
                                             (ii).                                                  which apply indefinitely, section 624
Affiliate Marketing Rule                        Section 603(d)(2)(A)(iii) of the FCRA               provides that a consumer’s affiliate
                                             provides that a person may                             marketing opt-out election must be
AGENCY:    Federal Trade Commission          communicate ‘‘other’’ information—that                 effective for a period of at least five
ACTION:   Final rule.                        is, information that is not transaction or             years. Upon expiration of the opt-out
                                             experience information—among its                       period, the consumer must be given a
SUMMARY:   The Federal Trade                 affiliates without becoming a consumer                 renewal notice and an opportunity to
Commission (FTC or Commission) is            reporting agency if it is clearly and                  renew the opt-out before information
publishing a final rule to implement the     conspicuously disclosed to the                         received from an affiliate may be used
affiliate marketing provisions in section    consumer that such information may be                  to make solicitations to the consumer.
214 of the Fair and Accurate Credit          communicated among affiliates and the
Transactions Act of 2003, which                                                                        Section 624 governs the use of
                                             consumer is given an opportunity,
amends the Fair Credit Reporting Act.        before the information is                              information by an affiliate, not the
The final rule generally prohibits a         communicated, to ‘‘opt out’’ or direct                 sharing of information among affiliates,
person from using information received       that the information not be                            and thus is distinct from the affiliate
from an affiliate to make a solicitation     communicated among such affiliates,                    sharing opt-out under section
for marketing purposes to a consumer,        and the consumer has not opted out.                    603(d)(2)(A)(iii) of the FCRA.
unless the consumer is given notice and                                                             Nevertheless, the affiliate marketing and
a reasonable opportunity and a               The Fair and Accurate Credit                           affiliate sharing opt-outs and the
reasonable and simple method to opt          Transactions Act of 2003                               information subject to the two opt-outs
out of the making of such solicitations.        The President signed into law the Fair              overlap to some extent. As noted above,
The FACT Act requires certain other          and Accurate Credit Transactions Act of                the FCRA allows transaction or
federal agencies to publish similar rules,   2003 (FACT Act) on December 4, 2003.                   experience information to be shared
and mandates that the FTC and other          Pub. L. 108-159, 117 Stat. 1952. In                    among affiliates without giving the
agencies consult and cooperate so that       general, the FACT Act amends the                       consumer notice and an opportunity to
their regulations implementing this          FCRA to enhance the ability of                         opt out, but provides that ‘‘other’’
provision are consistent and comparable      consumers to combat identity theft,                    information, such as information from
with one another.                            increase the accuracy of consumer                      credit reports and credit applications,
DATES: This rule is effective on January     reports, restrict the use of medical                   may not be shared among affiliates
1, 2008. The mandatory compliance            information in credit eligibility                      without giving the consumer notice and
date for this rule is October 1, 2008.       determinations, and allow consumers to                 an opportunity to opt out. The new
                                             exercise greater control regarding the                 affiliate marketing opt-out applies to
FOR FURTHER INFORMATION CONTACT:
                                             type and number of solicitations they                  both transaction or experience
Loretta Garrison and Anthony                                                                        information and ‘‘other’’ information.
                                             receive.
Rodriguez, Attorneys, Federal Trade             Section 214 of the FACT Act added a                 Thus, certain information will be
Commission, (202) 326-2252, Division         new section 624 to the FCRA. This                      subject to two opt-outs, a sharing opt-
of Privacy and Identity Protection,          provision gives consumers the right to                 out and a marketing use opt-out.
Federal Trade Commission, 601 New            restrict a person from using certain
Jersey Avenue, NW, Washington, DC                                                                      Section 214(b) of the FACT Act
                                             information obtained from an affiliate to              requires the FTC, the Federal banking
20580.                                       make solicitations to that consumer.                   agencies,2 the Securities and Exchange
SUPPLEMENTARY INFORMATION:                   Section 624 generally provides that if a               Commission (SEC), and the National
                                             person receives certain consumer                       Credit Union Administration (NCUA) to
I. Background
                                             eligibility information from an affiliate,             prescribe regulations, in consultation
The Fair Credit Reporting Act                the person may not use that information                and coordination with each other, to
   The Fair Credit Reporting Act (FCRA       to make solicitations to the consumer                  implement the FCRA’s affiliate
or Act), which was enacted in 1970, sets     about its products or services, unless the             marketing opt-out provisions. In
standards for the collection,                consumer is given notice and an                        adopting its regulation, the Commission
communication, and use of information        opportunity and a simple method to opt                 must ensure that the affiliate marketing
bearing on a consumer’s credit               out of such use of the information, and                notification methods provide a simple
worthiness, credit standing, credit          the consumer does not opt out. The                     means for consumers to make choices
capacity, character, general reputation,     statute also provides that section 624                 under section 624, consider the affiliate
personal characteristics, or mode of         does not apply, for example, to a person               sharing notification practices employed
living. 15 U.S.C. 1681-1681x. In 1996,       using eligibility information: (1) to make             on the date of enactment by persons
the Consumer Credit Reporting Reform         solicitations to a consumer with whom                  subject to section 624, and ensure that
Act extensively amended the FCRA.            the person has a pre-existing business                 notices may be coordinated and
Pub. L. 104-208, 110 Stat. 3009.             relationship; (2) to perform services for              consolidated with other notices required
   The FCRA, as amended, provides that       another affiliate subject to certain                   by law.
a person may communicate to an               conditions; (3) in response to a
affiliate or a non-affiliated third party    communication initiated by the                           2 The Federal banking agencies are the Board of

information solely as to transactions or                                                            Governors of the Federal Reserve System (Board),
                                               1 The FCRA creates substantial obligations for a     the Office of the Comptroller of the Currency (OCC),
experiences between the consumer and         person that meets the definition of a ‘‘consumer       the Federal Deposit Insurance Corporation (FDIC),
the person without becoming a                reporting agency’’ in section 603(f) of the statute.   and the Office of Thrift Supervision (OTS).
                  Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations                                   61425

II. The Proposed Regulation                              other affiliates. The Commission             persons covered by this part of the
   The Commission published its notice                   designed this approach to provide            Commission’s rule.
of proposed rulemaking in the Federal                    flexibility and to facilitate the use of a
                                                                                                      Section 680.2 Examples
Register on June 15, 2004 (69 FR 33324)                  single coordinated notice, while taking
                                                         into account existing affiliate sharing         Proposed § 680.2 described the scope
to implement section 214 of the FACT
                                                         notification practices. At the same time,    and effect of the examples included in
Act.3
   The proposal defined the key terms                    the approach sought to ensure that the       the proposed rule. Most commenters
‘‘pre-existing business relationship’’ and               notice would be effective because it         supported the proposed use of non-
‘‘solicitation’’ essentially as defined in               generally would be provided by or on         exclusive examples to illustrate the
the statute. The Commission did not                      behalf of an entity from which the           operation of the rule. One commenter,
propose to include additional                            consumer would expect to receive             concerned that the use of examples
circumstances within the meaning of                      important notices, and would not be          would increase the risk of litigation,
‘‘pre-existing business relationship’’ or                provided along with solicitations.           urged the Commission to delete all
other types of communications within                        The proposal also provided guidance       examples.
the meaning of ‘‘solicitation.’’                         on the contents of the opt-out notice,          The Commission does not believe the
   To address the scope of the affiliate                 what constitutes a reasonable                use of illustrative examples will
marketing opt-out, the proposal defined                  opportunity to opt out, reasonable and       materially increase the risk of litigation,
‘‘eligibility information’’ to mean any                  simple methods of opting out, and the        but rather will provide useful guidance
information the communication of                         delivery of opt-out notices. Finally, the    for compliance purposes, which may
which would be a ‘‘consumer report’’ if                  proposal provided guidance on the            alleviate litigation risks for institutions.
the statutory exclusions from the                        effect of the limited duration of the opt-      As § 680.2 states, examples in a
definition of ‘‘consumer report’’ in                     out and the requirement to provide an        paragraph illustrate only the issue
section 603(d)(2)(A) of the FCRA for                     extension notice upon expiration of the      described in the paragraph and do not
transaction or experience information                    opt-out period.                              illustrate any other issue that may arise
and for ‘‘other’’ information that is                                                                 in the part. Similarly, the examples do
                                                         III. Overview of Comments Received           not illustrate any issues that may arise
subject to the affiliate-sharing opt-out
did not apply. The Commission                              The Commission received 49                 under other laws or regulations.
substituted the term ‘‘eligibility                       comments. In addition, the Commission        Section 680.3 Definitions
information’’ for the more complicated                   considered the comments submitted to
                                                         the Federal banking agencies, the               Section 680.3 of the proposal
statutory language regarding the
                                                         NCUA, and the SEC. Many commenters           contained definitions for the following
communication of information that
                                                         sent copies of the same letter to more       terms: ‘‘Act,’’ ‘‘affiliate’’ (as well as the
would be a consumer report, but for
                                                         than one agency. The Commission              related terms ‘‘company’’ and
clauses (i), (ii), and (iii) of section
                                                         received comments from a variety of          ‘‘control’’); ‘‘clear and conspicuous’’;
603(d)(2)(A) of the FCRA.4 In addition,
                                                         banks, thrifts, credit unions, credit card   ‘‘consumer’’; ‘‘eligibility information’’;
the proposal incorporated each of the
                                                         companies, mortgage lenders, other non-      ‘‘person’’; ‘‘pre-existing business
scope limitations contained in the
                                                         bank creditors, and industry trade           relationship’’; ‘‘solicitation’’; and,
statute, such as the pre-existing business
                                                         associations. The Commission also            ‘‘you.’’
relationship exception.                                                                                  Those definitions that elicited
   Section 624 does not state which                      received comments from consumer
                                                         groups, the National Association of          comment are discussed below.
affiliate must give the consumer the
affiliate marketing opt-out notice. The                  Attorneys General (‘‘NAAG’’), and            Affiliate, Common Ownership or
proposal provided that the person                        individual consumers.                        Common Corporate Control, and
communicating information about a                          Most industry commenters objected to       Company
consumer to its affiliate would be                       several key aspects of the proposal. The        The proposed rule included
responsible for satisfying the notice                    most significant areas of concern raised     definitions for ‘‘affiliate’’ as well as for
requirement, if applicable. A rule of                    by industry commenters related to            the related terms ‘‘control’’ and
construction provided flexibility to                     which affiliate would be responsible for     ‘‘company.’’ For the reasons discussed
allow the notice to be given by the                      providing the notice, the scope of           below, the final rule substituted
person that communicates information                     certain exceptions to the notice and opt-    ‘‘common ownership or common
to its affiliate, by the person’s agent, or              out requirement, and the content or the      corporate control’’ as a substitute for the
through a joint notice with one or more                  inclusion of definitions for terms such      definition of ‘‘control,’’ and renumbered
                                                         as ‘‘clear and conspicuous’’ and ‘‘pre-      it as § 680.3(d). The term ‘‘company’’ is
   3 On July 15, 2004, the Federal banking agencies      existing business relationship.’’            renumbered as § 680.3(e).
and the NCUA published their proposed affiliate          Consumer groups and NAAG generally              Several FCRA provisions apply to
marketing rule in the Federal Register (69 FR            supported the proposal, although these
42502). The SEC published its proposed affiliate                                                      information sharing with persons
marketing rule in the Federal Register on July 14,       commenters believed that the proposal        ‘‘related by common ownership or
2004 (69 FR 42301).                                      could be strengthened in certain             affiliated by corporate control,’’ ‘‘related
   4 Under section 603(d)(1) of the FCRA, a              respects. A more detailed discussion of      by common ownership or affiliated by
‘‘consumer report’’ means any written, oral, or other    the comments is contained in the
communication of any information by a consumer                                                        common corporate control,’’ or
reporting agency bearing on a consumer’s credit
                                                         Section-by-Section Analysis below.           ‘‘affiliated by common ownership or
worthiness, credit standing, credit capacity,            IV. Section-by-Section Analysis              common corporate control.’’ E.g., FCRA,
character, general reputation, personal
characteristics, or mode of living which is used or
                                                                                                      sections 603(d)(2), 615(b)(2), and
                                                         Section 680.1 Purpose and Scope              625(b)(2). Each of these provisions was
expected to be used or collected in whole or in part
for the purpose of serving as a factor in establishing     Section 680.1 of the proposal set forth    enacted as part of the 1996 amendments
the consumer’s eligibility for credit or insurance to    the purpose and scope of the regulation.     to the FCRA. Similarly, section 2 of the
be used primarily for personal, family, or household
purposes, employment purposes, or any other
                                                         The Commission received few                  FACT Act defines the term ‘‘affiliate’’ to
purpose authorized in section 604 of the FCRA. 15        comments on this section. Section            mean ‘‘persons that are related by
U.S.C. 1681a(d).                                         680.1(b) of the final rule identifies the    common ownership or affiliated by
61426             Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations

corporate control.’’ In contrast, the                    Information Privacy Act in August            litigation and civil liability. Although
GLBA defines ‘‘affiliate’’ to mean ‘‘any                 2003.6 Congress, however, did not            these commenters recognized that the
company that controls, is controlled by,                 incorporate these exceptions from            proposed definition was derived from
or is under common control with                          California law into the definition of        the GLBA privacy regulations, they
another company.’’ See 15 U.S.C.                         ‘‘affiliate’’ when it enacted the FACT       noted that compliance with the GLBA
6809(6).                                                 Act at the end of 2003. Accordingly, the     privacy regulations is enforced
   In the proposal, the Commission                       Commission believes that the approach        exclusively through administrative
sought to harmonize the various FCRA                     adopted here best effectuates the intent     action, not through private litigation.
and FACT Act formulations by defining                    of Congress.                                 These commenters also stated that the
‘‘affiliate’’ to mean ‘‘any person that is                  Under the GLBA privacy rule, the          Federal Reserve Board had withdrawn a
related by common ownership or                           definition of ‘‘control’’ determines         similar proposal to define ‘‘clear and
common corporate control with another                    whether two or more entities meet the        conspicuous’’ for purposes of
person.’’ Industry commenters generally                  definition of ‘‘affiliate.’’7 The            Regulations B, E, M, Z, and DD, in part
supported the Commission’s goal of                       Commission included the same                 because of concerns about civil liability.
harmonizing the various FCRA                             definition of ‘‘control’’ in the proposal    Some industry commenters believed
definitions of ‘‘affiliate’’ for consistency.            and received no comments on the              that it was not necessary to define the
Many of these commenters, however,                       proposed definition. The Commission          term in order for consumers to receive
believed that the most effective way to                  interprets the phrase ‘‘related by           clear and conspicuous disclosures based
do this was for the Commission to                        common ownership or common                   on industry’s experience in providing
incorporate into the FCRA the definition                 corporate control’’ used in the FACT         clear and conspicuous affiliate sharing
of ‘‘affiliate’’ used in the GLBA privacy                Act to have the same meaning as              opt-out notices. Consumer groups
regulations. In addition, a few industry                 ‘‘control’’ in the GLBA privacy rule. For    believed that incorporation of the
commenters urged the Commission to                       example, if an individual owns 25            standard and examples from the GLBA
incorporate into the definition of                       percent of two companies, the                privacy regulations was not adequate
‘‘affiliate’’ certain concepts from                      companies would be affiliates under          because they did not believe that the
California’s Financial Information                       both the GLBA and FCRA definitions.          existing standard has proven sufficient
Privacy Act so as to exempt certain                      However, the individual would not be         to ensure effective privacy notices.
classes of corporate affiliates from the                 considered an affiliate of the companies        Except for certain non-substantive
restrictions on affiliate sharing or                     because the definition of ‘‘affiliate’’ is   changes made for purposes of clarity,
marketing.5                                              limited to companies.                        the definition of ‘‘clear and
   The Commission does not believe                          The proposal also defined the term        conspicuous’’ is the same as in the
there is a substantive difference between                ‘‘company’’ to mean any corporation,         proposal and is substantively the same
the FACT Act definition of ‘‘affiliate’’                 limited liability company, business          as the definition used in the GLBA
and the definition of ‘‘affiliate’’ in                   trust, general or limited partnership,       privacy rule. The Commission believes
section 509 of the GLBA. The                             association, or similar organization. The    that the clear and conspicuous standard
Commission is not aware of any                           proposed definition of ‘‘company’’           for the affiliate marketing opt-out
circumstances in which two entities                      excluded some entities that are              notices should be substantially similar
would be affiliates for purposes of the                  ‘‘persons’’ under the FCRA, including        to the standard that applies to GLBA
FCRA but not for purposes of the GLBA                    estates, cooperatives, and governments       privacy notices because the affiliate
privacy rule, or vice versa. Also, even                  or governmental subdivisions or              marketing opt-out notice may be
though affiliated entities have had to                   agencies, as well as individuals.            provided on or with the GLBA privacy
comply with different FCRA and GLBA                                                                   notice.
formulations of the ‘‘affiliate’’ definition             Clear and Conspicuous                           In defining ‘‘clear and conspicuous,’’
since 1999, commenters did not identify                     Proposed § 680.3(c) defined the term      the Commission believes it is more
any specific compliance difficulties or                  ‘‘clear and conspicuous’’ to mean            appropriate to focus on the affiliate
uncertainty resulting from the fact that                 reasonably understandable and                marketing opt-out notices that are the
the two statutes use somewhat different                  designed to call attention to the nature     subject of this rulemaking, rather than
wording to describe what constitutes an                  and significance of the information          adopting a generally applicable
affiliate.                                               presented. Under this definition,            definition governing all consumer
   Consistent with the definition of                     institutions would retain flexibility in     disclosures under the FCRA. This
‘‘affiliate’’ adopted by the Federal                     determining how best to meet the clear       approach gives the Commission the
banking agencies in the final medical                    and conspicuous standard. The                flexibility to refine or clarify the clear
information rules, the Commission                        supplementary information to the             and conspicuous requirement for
declines to incorporate into the                         proposal provided guidance regarding a       different disclosures, if necessary.
definition of ‘‘affiliate’’ exceptions for               number of practices that institutions           The statute directs the Commission to
entities regulated by the same or similar                might wish to consider in making their       provide specific guidance regarding
functional regulators, entities in the                   notices clear and conspicuous. These         how to comply with the clear and
same line of business, or entities that                  practices were derived largely from          conspicuous standard. See 15 U.S.C.
share a common brand or identity. See                    guidance included in the GLBA privacy        1681s-3(a)(2)(B). For that reason, the
70 FR 70664-70665 (Nov. 22, 2005).                       rule.                                        Commission does not agree with
These exceptions were incorporated                          Industry commenters urged the             commenters that requested the
into the California Financial                            Commission not to define ‘‘clear and         elimination of the definition of ‘‘clear
                                                         conspicuous’’ in the final rule. The         and conspicuous’’ and related guidance.
   5 These commenters noted that the California law      principal objection these commenters         Rather, the Commission believes it is
places no restriction on information sharing among       raised was that this definition would        necessary to define ‘‘clear and
affiliates if they: (1) are regulated by the same or                                                  conspicuous’’ in the final rule and
similar functional regulators; (2) are involved in the
                                                         significantly increase the risk of
same broad line of business, such as banking,
                                                                                                      provide specific guidance for how to
insurance, or securities; and (3) share a common          6 See   Cal. Financial Code § 4053(c). 
    satisfy that standard in connection with
brand identity.                                           7 See   16 C.F.R. 313.3(g). 
               this notice.
              Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations                        61427

   Accordingly, the final rule contains      may include using distinctive type           Finally, the proposal clarified that the
two types of specific guidance on            sizes, styles, fonts, paragraphs,            requirement for a concise notice would
satisfying the requirement to provide a      headings, graphic devices, and               be satisfied by the appropriate use of
clear and conspicuous opt-out notice.        appropriate groupings of information.        one of the model forms contained in
First, as in the proposal, the               However, there is no need to use             proposed Appendix A to the
supplementary information to the final       distinctive features, such as distinctive    Commission’s rule, although use of the
rule describes certain techniques that       type sizes, styles, or fonts, to             model forms is not required. The
may be used to make notices clear and        differentiate an affiliate marketing opt-    Commission received no comments on
conspicuous. These techniques are            out notice from other components of a        the proposed definition of ‘‘concise.’’
described below. Second, the                 required disclosure, for example, where      The final rule renumbers the definition
Commission has adopted model forms           a GLBA privacy notice combines several       of ‘‘concise’’ as § 680.3(f). The reference
that may, but are not required to, be        opt-out disclosures in a single notice.      to the model forms has been moved to
used to facilitate compliance with the       Moreover, nothing in the clear and           Appendix C to Part 698, but otherwise
affiliate marketing notice requirements.     conspicuous standard requires                the definition is adopted as proposed.
The requirement for clear and                segregation of the affiliate marketing
                                                                                          Consumer
conspicuous notices would be satisfied       opt-out notice when it is combined with
by the appropriate use of one of the         a GLBA privacy notice or other required         Proposed paragraph (e) defined the
model forms.                                 disclosures.                                 term ‘‘consumer’’ to mean an
   As noted in the supplementary                The Commission recognizes that it         individual. This definition is identical
information to the proposal, institutions    will not be feasible or appropriate to       to the definition of ‘‘consumer’’ in
may wish to consider a number of             incorporate all of the methods described     section 603(c) of the FCRA.
methods to make their notices clear and      above all the time. The Commission              Several commenters asked the
conspicuous. The various methods             recommends, but does not require, that       Commission to narrow the proposed
described below for making a notice          institutions consider the methods            definition to apply only to individuals
clear and conspicuous are suggestions        described above in designing their opt-      who obtain financial products or
that institutions may wish to consider in    out notices. The Commission also             services primarily for personal, family,
designing their notices. Use of any of       encourages the use of consumer or other      or household purposes, in part to
these methods alone or in combination        readability testing to devise notices that   achieve consistency with the definition
is voluntary. Institutions are not           are understandable to consumers.             of ‘‘consumer’’ in the GLBA. The
required to use any particular method or        Finally, although the Commission          FCRA’s definition of ‘‘consumer,’’
combination of methods to make their         understands the concerns of some             however, differs from, and is broader
disclosures clear and conspicuous.           industry commenters about the                than, the definition of that term in the
Rather, the particular facts and             potential for civil liability, the           GLBA. The Commission believes that
circumstances will determine whether a       Commission believes that these               the use of distinct definitions of
disclosure is clear and conspicuous.         concerns are mitigated by the safe           ‘‘consumer’’ in the two statutes reflects
   A notice or disclosure may be made        harbors afforded by the model forms in       differences in the scope and objectives
reasonably understandable through            Appendix C to Part 698. The                  of each statute. For purposes of this
various methods that include: using          Commission notes that the affiliate          definition, an individual acting through
clear and concise sentences, paragraphs,     sharing opt-out notice under section         a legal representative would qualify as
and sections; using short explanatory        603(d)(2)(A)(iii) of the FCRA, which         a consumer. The final rule renumbers
sentences; using bullet lists; using         may be enforced through private rights       ‘‘consumer’’ as § 680.3(g) but otherwise
definite, concrete, everyday words;          of action, must be included in the GLBA      adopts it without change.
using active voice; avoiding multiple        privacy notice. Therefore, the affiliate
                                                                                          Eligibility Information
negatives; avoiding legal and highly         sharing opt-out notice generally is
technical business terminology; and          disclosed in a manner consistent with           Proposed § 680.3(g) defined the term
avoiding explanations that are imprecise     the clear and conspicuous standard set       ‘‘eligibility information’’ to mean any
and are readily subject to different         forth in the GLBA privacy regulations.       information the communication of
interpretations. In addition, a notice or    Commenters did not identify any              which would be a consumer report if
disclosure may be designed to call           litigation that has resulted from the        the exclusions from the definition of
attention to the nature and significance     requirement to provide a clear and           ‘‘consumer report’’ in section
of the information in it through various     conspicuous affiliate sharing opt-out        603(d)(2)(A) of the FCRA did not apply.
methods that include: using a plain-         notice. The Commission believes that         As proposed, eligibility information
language heading; using a typeface and       compliance with the examples and use         would include a person’s own
type size that are easy to read; using       of the model forms, although optional,       transaction or experience information,
wide margins and ample line spacing;         should minimize the risk of litigation.      such as information about a consumer’s
and using boldface or italics for key                                                     account history with that person, and
words. Further, institutions that provide    Concise                                      ‘‘other’’ information under section
the notice on a Web page may use text           Proposed § 680.21(b) defined the term     603(d)(2)(A)(iii), such as information
or visual cues to encourage scrolling        ‘‘concise’’ to mean a reasonably brief       from consumer reports or applications.
down the page, if necessary, to view the     expression or statement. The proposal           Most commenters generally supported
entire notice and may take steps to          also provided that a notice required by      the proposed definition of ‘‘eligibility
ensure that other elements on the Web        this part may be concise even if it is       information’’ as an appropriate means of
site (such as text, graphics, hyperlinks,    combined with other disclosures              simplifying the statutory terminology
or sound) do not distract attention from     required or authorized by federal or         without changing the scope of the
the notice. When a notice or disclosure      state law. Such disclosures include, but     information covered by the rule. A
is combined with other information,          are not limited to, a GLBA privacy           number of commenters requested that
methods for designing the notice or          notice, an affiliate sharing notice under    the Commission clarify that certain
disclosure to call attention to the nature   section 603(d)(2)(A)(iii) of the FCRA,       types of information do not constitute
and significance of the information in it    and other consumer disclosures.              eligibility information, such as name,
61428         Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations

address, telephone number, Social              commenter asked how the                     regulation other circumstances that
Security number, and other identifying         supplementary information’s discussion      qualify as a pre-existing business
information. One commenter requested           of agents might affect the scope            relationship, the Commission did not
the exclusion of publicly available            provisions of the rule.                     propose to exercise this authority. In the
information from the definition.                  The supplementary information to the     final rule, the definition of ‘‘pre-existing
Another commenter requested                    proposal stated that a person may act       business relationship’’ has been
additional clarification regarding the         through an agent, including but not         renumbered as §680.3(j).
term ‘‘transaction or experience               limited to a licensed agent (in the case       Industry commenters suggested
information.’’ A few commenters                of an insurance company) or a trustee.      certain revisions to the proposed
suggested that the Commission include          The supplementary information also          definition of ‘‘pre-existing business
examples of what is and is not included        provided that actions taken by an agent     relationship.’’ Many industry
within ‘‘eligibility information.’’            on behalf of a person that are within the   commenters asked the Commission to
Finally, one commenter urged the               scope of the agency relationship would      include in the definition statutory
Commission to revise the definition to         be treated as actions of that person. The   language relating to ‘‘a person’s licensed
restate much of the statutory definition       Commission included these statements        agent.’’ A number of these commenters
of ‘‘consumer report’’ to eliminate the        to address comprehensively the status of    noted that this concept was particularly
need for cross-references.                     agents and to eliminate the need to refer   important to the insurance industry
   The final rule renumbers the                specifically to licensed agents in the      where independent, licensed agents
definition of ‘‘eligibility information’’ as   proposed definition of ‘‘pre-existing       frequently act as the main point of
680.3(h). The Commission has revised           business relationship.’’ As discussed       contact between the consumer and the
the definition to clarify that the term        below, many commenters believed that        insurance company.
‘‘eligibility information’’ does not           licensed agents should be expressly            In the final rule, the phrase ‘‘or a
include aggregate or blind data that does      included in the definition of ‘‘pre-        person’s licensed agent’’ has been added
not contain personal identifiers.              existing business relationship.’’ The       to the definition of ‘‘pre-existing
Examples of personal identifiers include       Commission has revised the final rule in    business relationship’’ to track the
account numbers, names, or addresses,          response to those comments. By              statutory language. For example, assume
as indicated in the definition, as well as     specifically addressing licensed agents,    that a person is a licensed agent for the
Social Security numbers, driver’s              the final rule does not alter the general   affiliated ABC life, auto, and
license numbers, telephone numbers, or         principles of principal-agent               homeowners’ insurance companies. A
other types of information that,               relationships that apply to all agents,     consumer purchases an ABC auto
depending on the circumstances or              not just licensed agents. The               insurance policy through the licensed
when used in combination, could                Commission will treat actions taken by      agent. The licensed agent may use
identify the individual.                       an agent on behalf of a person that are     eligibility information about the
   The Commission also believes that           within the scope of the agency              consumer obtained in connection with
further clarification of, or exclusions        relationship as actions of that person,     the ABC auto policy it sold to the
from, the term ‘‘eligibility information,’’    regardless of whether the agent is a        consumer to market ABC life and
such as the categorical exclusion of           licensed agent or not. The final rule       homeowner’s insurance policies to the
names, addresses, telephone numbers,           renumbers the definition of ‘‘person’’ as   consumer for the duration of the pre-
other identifying information, or              § 680.3(i).                                 existing business relationship without
publicly available information, would                                                      offering the consumer the opportunity
                                               Pre-Existing Business Relationship          to opt out of that use.
directly implicate the definitions of
‘‘consumer report’’ and ‘‘consumer                Proposed § 680.3(i) defined the term        Regarding the first basis for a pre-
reporting agency’’ in sections 603(d) and      ‘‘pre-existing business relationship’’ to   existing business relationship (a
(f), respectively, of the FCRA. The            mean a relationship between a person        financial contract in force), several
Commission decided not to define the           and a consumer based on the following:      industry commenters asked the
terms ‘‘consumer report’’ and                  (1) a financial contract between the        Commission to clarify that a financial
‘‘consumer reporting agency’’ in this          person and the consumer that is in          contract includes any in-force contract
rulemaking and not to interpret the            force; (2) the purchase, rental, or lease   that relates to a financial product or
meaning of terms used in those                 by the consumer of that person’s goods      service covered by title V of the GLBA.
definitions, such as ‘‘transaction or          or services, or a financial transaction     One commenter objected to the
experience’’ information. The                  (including holding an active account or     requirement that the contract be in force
Commission also notes that financial           a policy in force or having another         on the date of the solicitation. This
institutions have relied on these              continuing relationship) between the        commenter believed that the
statutory definitions for many years.          consumer and that person, during the        Commission should interpret the statute
                                               18-month period immediately preceding       to permit the exception to apply if a
Person                                         the date on which a solicitation covered    contract is in force at the time the
  Proposed paragraph (h) defined the           by this part is sent to the consumer; or    affiliate uses the information, rather
term ‘‘person’’ to mean any individual,        (3) an inquiry or application by the        than when the solicitation is sent,
partnership, corporation, trust, estate,       consumer regarding a product or service     noting that there may be a delay
cooperative, association, government or        offered by that person during the three-    between the use and the solicitation.
governmental subdivision or agency, or         month period immediately preceding             The Commission has adopted the first
other entity. This definition is identical     the date on which a solicitation covered    prong of the definition of ‘‘pre-existing
to the definition of ‘‘person’’ in section     by this part is sent to the consumer.       business relationship’’ as proposed.
603(b) of the FCRA.                               The proposed definition generally        Although a comprehensive definition of
  One commenter requested                      tracked the statutory definition            the term ‘‘financial contract’’ has not
clarification of how the proposed              contained in section 624 of the FCRA,       been included in the final rule, the
definition of ‘‘person’’ would affect          with certain revisions for clarity.         Commission construes the statutory
other provisions of the affiliate              Although the statute gave the               term ‘‘financial contract’’ at least to
marketing rule. Specifically, this             Commission the authority to identify by     include a contract that relates to a
              Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations                                  61429

consumer’s purchase or lease of a            used in the definition of ‘‘pre-existing      relationship based on a consumer’s call
financial product or service that a          business relationship.’’                      to a central call center about a specific
financial holding company could offer           More generally, however, even though       product or service offered by an affiliate.
under section 4(k) of the Bank Holding       a ‘‘financial transaction’’ would include        In the supplementary information to
Company Act of 1956 (12 U.S.C.               in virtually all cases a financial contract   the proposal, the Commission noted that
1843(k)). In addition, a financial           which is in force, as noted above, the        certain elements of the definition of
contract which is in force will, in          Commission does not believe it is             ‘‘pre-existing business relationship’’
virtually all instances, qualify as a        appropriate to state that the 18-month        were substantially similar to the
‘‘financial transaction,’’ as that term is   period begins to run when all                 definition of ‘‘established business
used in the second prong of the              outstanding contractual responsibilities      relationship’’ under the amended
definition of ‘‘pre-existing business        of both parties expire, regardless of         Telemarketing Sales Rule (TSR) (16 CFR
relationship.’’ The Commission does not      whether specific transactions occur.          310.2(n)). The TSR definition was
agree with the suggestion that the           Such a clarification would not                informed by Congress’ intent that the
financial contract should be in force on     appropriately address circumstances           ‘‘established business relationship’’
the date of use rather than on the date      such as charge-offs, bankruptcies, early      exemption to the ‘‘do not call’’
the solicitation is sent. The approach       terminations, or extended periods of          provisions of the Telephone Consumer
taken in the proposed and final rule is      credit inactivity that could trigger          Protection Act (47 U.S.C. 227 et seq.)
consistent with the approach used in         commencement of the 18-month period.          should be grounded on the reasonable
the other two prongs of the statutory        In addition, some contract provisions,        expectations of the consumer.8 The
definition.                                  such as arbitration clauses and choice of     Commission observed that Congress’
   Industry commenters also suggested        law provisions, may continue to have          incorporation of similar language in the
certain clarifications to the second basis   legal effect after all contractual            definition of ‘‘pre-existing business
for a pre-existing business                  performance has ended. The                    relationship’’9 suggested that it would
relationship—a purchase, rental, or          Commission does not believe that the          be appropriate to consider the
lease by the consumer of the person’s        continued effectiveness of such               reasonable expectations of the consumer
goods or services, or a financial            provisions should delay commencement          in determining the scope of this
transaction between the consumer and         of the 18-month period.                       exception. Thus, the Commission
the person during the preceding 18              Nevertheless, the Commission               explained that, for purposes of this
months. Several industry commenters          believes that a few examples may              regulation, an inquiry would include
noted that, notwithstanding the example      provide useful guidance to facilitate         any affirmative request by a consumer
in the proposal regarding a lapsed           compliance. For example, in the case of       for information after which the
insurance policy, it was not clear from      a closed-end mortgage or auto loan, the       consumer would reasonably expect to
what point in time the 18-month period       18-month period generally would begin         receive information from the affiliate
begins to run in the case of many            to run when the consumer pays off the         about its products or services.10
purchase, rental, lease, or financial        outstanding balance on the loan. In a         Moreover, a consumer would not
transactions. These commenters asked         lease or rental transaction, the 18-month     reasonably expect to receive information
the Commission to clarify that the 18-       period generally would begin to run           from the affiliate if the consumer did
month period begins to run at the time       when the lease or rental agreement            not request information or did not
all contractual responsibilities of either   expires or is terminated by mutual            provide contact information to the
party under the purchase, rental, lease,     agreement. In the case of general             affiliate.
or financial transaction expire. In          purpose credit cards that are issued             Industry commenters objected to the
addition, some commenters indicated          with an expiration date, the 18-month         discussion in the supplementary
that the term ‘‘active account’’ should be   period generally would begin to run           information. Some of these commenters
clarified to mean any account with           when the consumer pays off the                believed that looking to the reasonable
outstanding contractual responsibilities     outstanding balance on the card and the       expectations of the consumer would
on either side of an account                 card is either cancelled or expires           narrow the scope of the exception and
relationship, regardless of whether          without being renewed.                        impose on institutions a subjective
specific transactions do or do not occur        Commenters also made certain               standard that depended upon the
on that account.                             suggestions regarding the third basis for     consumer’s state of mind. These
   The Commission has adopted the            a pre-existing business relationship—an       commenters also maintained that the
second prong of the definition of ‘‘pre-     inquiry or application by the consumer        availability of the exception should not
existing business relationship’’ as          regarding a product or service offered by     depend upon the consumer both
proposed. The Commission declines to         the person during the preceding three         requesting information and providing
interpret the term ‘‘active account’’ as     months. Consumer groups urged the             contact information to the affiliate.
requested by some commenters. The            Commission to clarify that an inquiry         Some commenters noted that either
Commission notes that section 603(r)(4)      must be made of the specific affiliate,       requesting information or providing
of the FCRA defines the term ‘‘account’’     rather than a general inquiry about a         contact information should suffice to
to have the same meaning as in section       product or service. Industry commenters       establish an expectation of receiving
903 of the Electronic Fund Transfer Act      expressed concern about certain               solicitations. Other commenters noted
(EFTA). Under the EFTA, the term             statements in the supplementary               that consumers would not provide
‘‘account’’ means a demand deposit,          information that explained the meaning
savings deposit, or other asset account      of an inquiry.                                   8 H.R. Rep. No. 102-317, at 14-15 (1991). See also
established primarily for personal,             The Commission does not agree that         68 FR 4580, 4591-94 (Jan. 29, 2003).
family, or household purposes. Some          an inquiry must be made of a specific            9 149 Cong. Rec. S13,980 (daily ed. Nov. 5, 2003)

commenters, however, apparently              affiliate. Many affiliated institutions use   (statement of Senator Feinstein) (noting that the
believed that the term ‘‘active account’’    a central call center to handle consumer      ‘‘pre-existing business relationship’’ definition ‘‘is
                                                                                           the same definition developed by the Federal Trade
included extensions of credit. Credit        inquiries. The clarification urged by         Commission in creating a national ‘Do Not Call’
extensions presumably would qualify as       consumer groups could preclude the            registry for telemarketers.’’)
‘‘another continuing relationship,’’ as      establishment of a pre-existing business         10See 68 FR at 4594.
61430         Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations

contact information if they believed that    product information. According to these      overly broad, is not necessary given the
the affiliate would already have the         commenters, manufacturers also send          breadth of the statutory definition of
consumer’s contact information or            solicitations to consumers about their       ‘‘pre-existing business relationship,’’
would obtain it from the consumer’s          products and services, drawing in part       and could result in circumvention of the
financial institution. Some commenters       on transaction or experience                 notice requirement.
believed that the consumer should not        information from the captive finance            Proposed § 680.20(d)(1) provided four
have to make an affirmative request for      company. These commenters asked the          examples of the pre-existing business
information in order to have an inquiry.     Commission to clarify that the               relationship exception. In the final rule,
Commenters also expressed concern            relationship between a manufacturer          these examples have been renumbered
that the discussion in the                   and a consumer qualifies as a pre-           as § 680.3(j)(2)(i)-(iv), and revised to
supplementary information would              existing business relationship based on      illustrate the definition of ‘‘pre-existing
require consumers to use specific words      the purchase, rental, or lease of the        business relationship,’’ rather than the
to trigger the exception.                    manufacturer’s goods, or, alternatively,     corresponding exception.
   The Commission has adopted the            to exercise its authority to add this           The two examples relating to the first
third prong of the definition of ‘‘pre-      relationship as an additional basis for a    and second prongs of the definition of
existing business relationship’’ as          pre-existing business relationship. One      ‘‘pre-existing business relationship’’
proposed. The Commission continues to        commenter asked the Commission to            have been revised in § 680.3(j)(2)(i) and
believe that it is appropriate to consider   clarify that a pre-existing business         (ii) to focus on a loan account creditor
what the consumer says in determining        relationship could be established even if    as the person with the pre-existing
whether the consumer has made an             the person provides a product or service     business relationship, but are otherwise
inquiry about a product or service. It       to the consumer without charging a fee.      substantively similar to the proposal.
may not be necessary, however, for the          The Commission does not believe it is     One commenter recommended
consumer to provide contact                  necessary to add any additional bases        expanding the example now contained
information in all cases. As discussed       for a pre-existing business relationship.    in § 680.3(j)(2)(i) to refer to the licensed
below, the Commission has revised the        The Commission acknowledges that a           agent that wrote the policy or services
examples of inquiries to illustrate          pre-existing business relationship exists    the relationship. The Commission
different circumstances.                     where a person owns the servicing            believes that adding the term ‘‘licensed
   Consumer groups and NAAG urged            rights to a consumer’s loan and such         agent’’ to the definition is sufficient and
the Commission not to expand the             person collects payments from, or            sees no reason to further complicate this
definition of ‘‘pre-existing business        otherwise deals directly with, the           example to illustrate how the definition
relationship’’ to include any additional     consumer. In the Commission’s view,          applies to licensed agents.
types of relationships. Industry             however, that situation qualifies as a          Section 680.3(j)(2)(iii) is new and
commenters suggested a number of             financial transaction and thus falls         illustrates when a pre-existing business
additional bases for establishing a pre-     within the second prong of the               relationship is created in the context of
existing business relationship. Several      definition of ‘‘pre-existing business        a mortgage loan. This example
industry commenters believed that the        relationship.’’ The Commission has           specifically addresses circumstances
term ‘‘pre-existing business                 included an example, discussed below,        where either the loan or ownership of
relationship’’ should be defined to          to illustrate how the ownership of           the servicing rights to the loan is sold
include relationships arising out of the     servicing rights can create a pre-existing   to a third party. As this example
ownership of servicing rights, a             business relationship.                       illustrates, sale of the entire loan by the
participation interest in lending               A pre-existing business relationship      original lender terminates the financial
transactions, and similar relationships.     does not arise solely from a                 transaction between the consumer and
These commenters provided no further         participation interest in a lending          that lender and creates a new financial
explanation for why such an expansion        transaction because such an interest         transaction between the consumer and
was necessary. One commenter urged           does not result in a financial contract or   the purchaser of the loan. However, the
the Commission to expand the                 a financial transaction between the          original lender’s sale of a fractional
definition of ‘‘pre-existing business        consumer and the participating party.        interest in the loan to an investor does
relationship’’ to apply to affiliates that   The Commission declines to add a             not create a new financial transaction
share a common trade name, share the         specific provision for franchised            between the consumer and the investor.
same employees or representatives,           dealers. The statute contains no special     When the original lender sells a
operate out of the same physical             provision addressing franchised dealers,     fractional interest in the consumer’s
location or locations, and offer similar     as it does for licensed agents. Moreover,    loan to an investor but also retains an
products.                                    a franchised dealer and a manufacturer       ownership interest in the loan, however,
   In addition, a number of industry         generally are not affiliates and thus are    the original lender continues to have a
commenters requested clarification of        subject to the GLBA privacy rule             pre-existing business relationship with
the term ‘‘pre-existing business             relating to information sharing with         the consumer because the consumer
relationship’’ as applied to                 non-affiliated third parties. The            obtained a loan from the lender and the
manufacturers that make sales through        Commission also finds no basis for           lender continues to own an interest in
dealers. These commenters explained          including within the meaning of ‘‘pre-       the loan. In addition, the ownership of
that automobile manufacturers do not         existing business relationship’’ any         servicing rights coupled with direct
sell vehicles directly to consumers, but     affiliate that shares a common trade         dealings with the consumer results in a
through franchised dealers. Vehicle          name or representatives, or that operates    financial transaction between the
financing may be arranged through a          from the same location or offers similar     consumer and the owner of the
manufacturer’s captive finance company       products. Finally, the Commission            servicing rights, thereby creating a pre-
or independent sources of financing.         declines to add a provision that would       existing business relationship between
These commenters noted that                  create a pre-existing business               the consumer and the owner of the
manufacturers often provide consumers        relationship when a consumer obtains a       servicing rights. The Commission notes
with information about warranty              product or service without charge from       that a financial institution that owns
coverage, recall notices, and other          a person. Such a provision would be          servicing rights generally has a customer
              Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations                        61431

relationship with the consumer and an        opportunity to ask for the consumer’s         encourage consumers to purchase
obligation to provide a GLBA privacy         contact information.                          products and services from the person
notice to the consumer.                         Industry commenters recommended            initiating the communications.
   The example in proposed                   deleting the example in proposed                 Congress gave the Commission the
§ 680.20(d)(1)(iii) regarding applications   § 680.20(d)(1)(iv) illustrating a call        authority to determine by regulation
and inquiries elicited comment. Some         center scenario where a consumer              that other communications do not
industry commenters urged the                would not reasonably expect to receive        constitute a solicitation. The
Commission to revise this example so         information from an affiliate. In the final   Commission does not propose to
that it does not depend upon the             rule, the Commission has included a           exercise this authority. The Commission
consumer’s expectations or the               positive example of an inquiry made by        solicited comment on whether, and to
consumer providing contact                   a consumer through a call center in           what extent, various tools used in
information. These commenters noted,         § 680.3(j)(2)(vii), while retaining the       Internet marketing, such as pop-up ads,
for example, that the contact                negative example from the proposal in         may constitute solicitations as opposed
information would be self-evident if the     § 680.3(j)(3)(i). In addition, the            to communications directed at the
consumer makes an e-mail request or          Commission has included in                    general public, and whether further
provides a return address on an              § 680.3(j)(3)(ii) an example of a             guidance was needed to address Internet
envelope. These commenters also              consumer call to ask about retail             marketing.
believed that in the case of a telephone     locations and hours, which does not              Most commenters believed that the
call initiated by a consumer, a captured     create a pre-existing business                proposed definition tracked the
telephone number should be sufficient        relationship. This example is                 statutory definition contained in section
to create an inquiry if the consumer         substantively similar to the example          624 of the FCRA. A number of industry
requests information about products or       from proposed § 680.20(d)(2)(iii).            commenters, however, believed that the
services.                                       A new example in § 680.3(j)(3)(iii)        proposed definition misstated the types
                                             illustrates a case where a consumer           of marketing that would not qualify as
   In the final rule, the Commission has
                                             responds to an advertisement that offers      a solicitation. Specifically, the first
crafted three separate examples from
                                             a free promotional item, but the              sentence of proposed § 680.3(j)(2)
proposed § 680.20(d)(1)(iii). Section
                                             advertisement does not indicate that an       provided that ‘‘[a] solicitation does not
680.3(j)(2)(iv) provides an example
                                             affiliate’s products or services will be      include communications that are
where a consumer applies for a product
                                             marketed to consumers who respond to          directed at the general public and
or service, but does not obtain the
                                             the advertisement. The example                distributed without the use of eligibility
product or service for which she
                                             illustrates that the consumer’s response      information communicated by an
applied. Contact information is not          does not create a pre-existing business       affiliate.’’ These commenters believed
mentioned in this example because the        relationship because the consumer has         that a solicitation should not include
consumer presumably would have               not made an inquiry about a product or        either marketing directed at the general
supplied it on the application.              service, but has merely responded to an       public or marketing distributed without
   Section 680.3(j)(2)(v) provides an        offer for a free promotional item.            the use of eligibility information
example where a consumer makes a             Similarly, if a consumer is directed by       communicated by an affiliate. Several
telephone inquiry about a product or         a company with which the consumer             industry commenters also requested that
service offered by a depository              has a pre-existing business relationship      the Commission include the phrase ‘‘of
institution and provides contact             to contact the company’s affiliate to         a product or service’’ in the introductory
information to the institution, but does     receive a promotional item but the            language for consistency with the
not obtain a product or service from or      company does not mention the                  statutory definition. Some industry
enter into a financial transaction with      affiliate’s products or services, the         commenters sought clarification that
the institution. The Commission does         consumer’s contact with the affiliate         certain types of communications would
not believe that an institution’s capture    about the promotional item does not           not constitute solicitations, for example,
of a consumer’s telephone number             create a pre-existing business                marketing announcements delivered via
during a telephone conversation with         relationship between the consumer and         pre-recorded call center messages,
the consumer about the institution’s         the affiliate.                                automated teller machine screens, or
products or services is sufficient to                                                      Internet sites, or product information
create an inquiry. In that circumstance,     Solicitation
                                                                                           provided at or through educational
to ensure that an inquiry has been made,        Proposed § 680.3(j) defined the term       seminars, customer appreciation events,
the institution should ask the consumer      ‘‘solicitation’’ to mean marketing            or newsletters.
to provide his or her contact                initiated by a person to a particular            NAAG urged the Commission to
information, or confirm with the             consumer that is based on eligibility         clarify the portion of the definition that
consumer that the consumer has a pre-        information communicated to that              refers to ‘‘a particular consumer.’’
existing business relationship with an       person by its affiliate and is intended to    NAAG believed that mass mailings of
affiliate.                                   encourage the consumer to purchase a          the same or similar marketing materials
   Section 680.3(j)(2)(vi) provides an       product or service. The proposed              to a large group of consumers could fall
example where the consumer makes an          definition further clarified that a           within the definition of ‘‘solicitation,’’
e-mail inquiry about a product or            communication, such as a telemarketing        so long as the marketing is based on
service offered by a creditor, but does      solicitation, direct mail, or e-mail,         eligibility information received from an
not separately provide contact               would be a solicitation if it is directed     affiliate. NAAG expressed concern that
information. In that case, the consumer      to a specific consumer based on               some might construe the term
provides the creditor with contact           eligibility information. The proposed         ‘‘particular’’ to narrow the meaning of a
information in the form of the               definition did not, however, include          ‘‘solicitation.’’
consumer’s e-mail address. In addition,      communications that were directed at             With regard to Internet marketing,
e-mail communications, unlike                the general public without regard to          industry commenters urged the
telephone communications, do not             eligibility information, even if those        Commission not to address such
provide institutions with the same           communications were intended to               practices in this rulemaking. These
61432         Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations

commenters believed that the definition        solicitation depends upon the facts and     by proposing to place certain
of ‘‘solicitation’’ should provide specific    circumstances. The Commission has           responsibilities on the ‘‘communicating
guidance that ‘‘pop-up’’ ads and other         decided not to make those                   affiliate’’ and other responsibilities on
forms of Internet marketing generally          determinations in this rulemaking.          the ‘‘receiving affiliate.’’
were directed to the general public and        Thus, the Commission is not adopting           Proposed § 680.20(a) set forth the
not based on eligibility information           special rules or guidance regarding         duties of a communicating affiliate. That
received from an affiliate, or that such       Internet-based marketing; whether           section required the communicating
marketing would fall within an                 Internet-based marketing is a               affiliate to provide a notice to the
exception. NAAG believed that such             solicitation in a particular case will be   consumer before a receiving affiliate
advertisements should be treated as            determined according to the same            could use eligibility information to
solicitations if they were based on any        criteria that apply to other means of       make or send solicitations to the
eligibility information received from an       marketing. The Commission also              consumer. Under the proposal, the opt-
affiliate. Consumer groups believed that       declines to exclude categorically from      out notice would state that eligibility
if an affiliate’s pop-up ads and other         the definition of ‘‘solicitation’’          information may be communicated to
Internet marketing were the result of          marketing messages on voice response        and used by the receiving affiliate to
specific actions by the consumer or            units, ATM screens, or other forms of       make or send solicitations to the
information collected based upon a             media. Marketing delivered via such         consumer regarding the affiliate’s
consumer’s experience on the Internet,         media may be solicitations if such          products and services, and would give
then such marketing should be                  marketing is targeted to a particular       the consumer a reasonable opportunity
considered solicitations. These                consumer based on eligibility               and a simple method to opt out.
commenters also believed that pop-up           information received from an affiliate.        Proposed § 680.20(a) also contained
ads and other Internet marketing               For example, a marketing message on an      two rules of construction relating to the
targeted to all customers of a company         ATM screen would be a solicitation if it    communicating affiliate’s duty to
should be treated as solicitations if          is targeted to a particular consumer        provide the notice. The first rule of
based on the consumer’s experience on          based on eligibility information received   construction would have allowed the
the Internet.                                  from an affiliate, but would not be a       notice to be provided either in the name
   Section 680.3(k) of the final rule          solicitation if it is delivered to all      of a person with which the consumer
contains the definition of ‘‘solicitation.’’   consumers that use the ATM.                 currently does or previously has done
The definition has been revised to track          Similarly, the Commission declines to    business or in one or more common
the statutory language more closely. The       exclude educational seminars, customer      corporate names shared by members of
phrase ‘‘of a product or service’’ has         appreciation events, focus group            an affiliated group of companies that
been added to the definition, as               invitations, and similar forms of           includes the common corporate name
requested by some commenters. To               communication from the definition of        used by that person. The rule of
ensure consistency with the definition         ‘‘solicitation.’’ The Commission believes   construction also would have provided
of ‘‘pre-existing business relationship,’’     that such activities must be evaluated      alternatives regarding the manner in
the phrase ‘‘or obtain’’ has been retained     according to the facts and circumstances    which the notice could be given, such
so that the definition of ‘‘solicitation’’     and some of those activities may be         as by allowing the communicating
will include marketing for the rental or       coupled with, or a prelude to, a            affiliate to provide the notice either
lease of goods or services, financial          solicitation. For example, an invitation    directly to the consumer, through an
transactions, and financial contracts.         to a financial educational seminar          agent, or through a joint notice with one
The Commission has also deleted as             where the invitees are selected based on    or more of its affiliates. The second rule
unnecessary the reference to                   eligibility information received from an    of construction would have clarified
communications ‘‘distributed without           affiliate may be a solicitation if the      that, to avoid duplicate notices, it would
the use of eligibility information             seminar is used to solicit the consumer     not be necessary for each affiliate that
communicated by an affiliate.’’                to purchase investment products or          communicates the same eligibility
Marketing that is undertaken without           services.                                   information to provide an opt-out notice
the use of eligibility information                                                         to the consumer, so long as the notice
received from an affiliate is not covered      You                                         provided by the affiliate that initially
by the affiliate marketing rule.                 The term ‘‘you’’ is defined as persons    communicated the information was
Moreover, there is no restriction on           described in § 680.1(a) and the             broad enough to cover use of that
using eligibility information received         definition has been renumbered as           information by each affiliate that
from an affiliate in marketing directed at     § 680.3(l).                                 received and used it to make
the general public, such as radio,                                                         solicitations. The proposal included
                                               Section 680.21 Affiliate Marketing Opt-     examples to illustrate how each of these
television, or billboard advertisements.
                                               out and Exceptions                          rules of construction would work.
The phrase ‘‘to a particular consumer’’
has been retained because it is part of           The Commission proposed to                  Proposed § 680.20(b) set forth the
the statutory definition. The                  establish certain rules relating to the     general duties of a receiving affiliate.
Commission does not believe that the           requirement to provide the consumer         That section would have prohibited the
phrase ‘‘to a particular consumer’’            with notice and a reasonable                receiving affiliate from using eligibility
excludes large-scale marketing                 opportunity and a simple method to opt      information it received from an affiliate
campaigns from the definition of               out of a person’s use of eligibility        to make solicitations to the consumer
‘‘solicitation’’ because, within such          information that it obtained from an        unless, prior to such use, the consumer
campaigns, eligibility information             affiliate for the purpose of making or      was provided an opt-out notice that
received from an affiliate may be used         sending solicitations to the consumer.      applied to that affiliate’s use of
to target individual consumers.                The Commission noted that the statute       eligibility information to make
   The definition of ‘‘solicitation’’ does     is ambiguous because it does not specify    solicitations and a reasonable
not distinguish between different              which affiliate must provide the opt-out    opportunity and simple method to opt
mediums. A determination of whether a          notice to the consumer. The                 out, and the consumer did not opt out
marketing communication constitutes a          Commission addressed this ambiguity         of that use.
              Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations                        61433

   Most industry commenters                   § 680.20(b) into proposed § 680.20(a) to     unlikely to be an entity from which the
maintained that the final rule should         focus exclusively on the responsibilities    consumer would expect to receive
not require any specific entity to            of the receiving affiliate. One              important communications. NAAG also
provide the opt-out notice, but should        commenter identified certain drafting        requested that the Commission revise
only require that the consumer be             problems it believed arose from the fact     certain portions of the proposed rules of
provided an opt-out notice covering an        that the proposal focused alternately on     construction, for example, by deleting
affiliate’s use of eligibility information    the communicating affiliate and the          from proposed § 680.20(a)(2)(i) the
before a solicitation is made to the          receiving affiliate and that those two       phrase ‘‘or previously has done
consumer. These commenters believed           entities may be regulated by different       business’’ based on concerns that it
the final rule should provide flexibility     regulatory agencies.                         would render the notice partially
and allow either the receiving affiliate,        A few industry commenters                 ineffective because, even without this
the communicating affiliate, or any           acknowledged that the Commission had         phrase, the notice would not be required
other affiliate to provide the opt-out        raised legitimate concerns in the            for 18 months after a customer
notice. These commenters maintained           supplementary information to the             relationship ends. NAAG also requested
that the statute is not ambiguous and         proposal about how meaningful a notice       that the Commission revise proposed
does not impose any obligations on a          could be when provided by a receiving        §§ 680.20(a)(2)(B)(2) and (a)(2)(C) to
specific entity, such as the                  affiliate that the consumer may not          clarify that the common name used
communicating affiliate, to provide the       recognize. These commenters believed         must be one that includes the name
opt-out notice. Some of these                 that this concern could be addressed         used by the person providing the opt-
commenters acknowledged, however,             through other means. One commenter,          out notice.
that the communicating affiliate would,       for example, suggested the following            In the proposal, the Commission did
as a practical matter, most likely give       introductory language in paragraph           not require the opt-out notice to be
the opt-out notice.                           (a)(2): ‘‘The notice required by this        provided in writing. The Commission
   A number of industry commenters            paragraph (a) may be provided either in      noted, however, that it contemplated
expressed concern that the proposed           the name of the bank receiving the           that the opt-out notice would be
rule would create a basis for civil           information (provided that such bank         provided to the consumer in writing or,
liability against the communicating           also identifies the affiliate which          if the consumer agrees, electronically.
affiliate under section 624 because that      provided such information), in the name      The proposal solicited comment on
section is covered by the FCRA’s private      of the affiliate which provided such         whether there were circumstances in
right of action provisions in sections        information, or in one or more common        which it would be necessary and
616 and 617. Some commenters noted            corporate names shared by such bank          appropriate to allow oral notice and opt
that, to avoid exposure to civil liability,   and the affiliate which provided the         out and how an oral notice could satisfy
a communicating affiliate would have to       information, and may be provided in the      the clear and conspicuous standard in
require receiving affiliates to commit to     following manner . . .’’ Another industry    the statute.
not using the information to make             commenter expressed support for the             Industry commenters believed that
solicitations, give an opt-out notice         rules of construction with revisions to      the final rule should permit oral notices.
whenever they share eligibility               allow the use of brand names and trade       These commenters identified
information with affiliates, or never         names, as well as the actual ‘‘corporate’’   circumstances in which a relationship is
share eligibility information with            name, and to allow an agent or affiliate     established by telephone as an example
affiliates. These commenters maintained       to send a common notice that uses more       of when oral notice would be
that, in many cases, none of these            than one common name in a non-               appropriate. Some industry commenters
solutions would be practical, for             deceptive manner.                            also noted that an oral notice should be
example, where a receiving affiliate             Consumer group commenters                 permitted because the affiliate sharing
negligently failed to comply with a           supported making the communicating           opt-out notice under section
commitment not to make solicitations          affiliate responsible for providing the      603(d)(2)(A)(iii) may be given orally, as
unless notice has been given to the           notice and opportunity to opt out. These     well as in writing or electronically.
consumer.                                     commenters believed that allowing the        Several industry commenters noted that
   Several industry commenters noted          receiving affiliate to send the opt-out      the Commission in the Telemarketing
that the language in section 624(a)(1)(A)     notice would invite consumer confusion       Sales Rule and the OCC in regulations
that ‘‘information may be                     as to whether or not the opt-out notice      relating to debt cancellation contracts
communicated’’ could be included in an        itself is a solicitation. These              and debt suspension agreements have
opt-out notice provided by the receiving      commenters also believed that the            permitted clear and conspicuous oral
affiliate. These commenters also              Commission should require the names          notices. These commenters did not
believed that the statutory requirement       of the receiving affiliates to be clearly    believe that allowing oral notice in these
that the Commission consider existing         disclosed to the consumer. Consumer          circumstances had created any
affiliate sharing notification practices      groups also believed that the proposed       enforcement difficulties for the
and permit coordinated and                    rules of construction struck a reasonable    Commission or OCC. Other industry
consolidated notices did not imply that       balance by allowing commonly named           commenters noted that institutions
the communicating affiliate should be         affiliates to share a notice while making    could demonstrate compliance through
responsible for providing the opt-out         clear that a notice from an affiliate with   the use of scripts or by monitoring or
notice.                                       whom the consumer is not familiar will       recording calls.
   Industry commenters made several           not be effective. They also suggested           Consumer groups believed that a
suggestions for revising the language of      that the company with the pre-existing       written opt-out notice should be
the proposal. Some suggested revising         business relationship should be clearly      required in all cases. These commenters
proposed § 680.20(a) to omit any              marked on the opt-out notice.                believed that, with an oral notice, it is
reference to the communicating affiliate         NAAG believed that a receiving            impossible to ensure that a consumer
and to incorporate the passive voice          affiliate should not be permitted to give    receives the appropriate notice or
used in the statute. Others suggested         the opt-out notice solely on its own         information on the right to opt out. They
various ways of merging proposed              behalf because a receiving affiliate is      believed that allowing oral notices
61434        Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations

would create enforcement barriers for       related opt-out notices. The Commission      proposal did little to address those
regulators. Consumer groups also            is not persuaded that there are any          concerns. For practical reasons, the
believed that institutions have strong      circumstances where it would be              Commission believes that affiliate
economic incentives to prevent              necessary to provide an oral opt-out         marketing opt-out notices typically
consumers from opting out and would         notice. A number of key exceptions to        would be provided by an affiliate that
engage in misrepresentations or             the initial notice and opt-out               has or has previously had a pre-existing
otherwise use language in their scripts     requirement, such as the pre-existing        business relationship with the
that is designed to discourage              business relationship exception,             consumer, or as part of a joint notice,
consumers from opting out. NAAG             consumer-initiated communication             whether or not required by the rule.
believed that oral notices would not        exception, and consumer authorization           The Commission appreciates industry
meet the statutory requirement for a        or request exception, may be triggered       concerns about civil liability and has
clear, conspicuous, and concise notice,     by an oral communication with the            revised the final rule to address those
that consumers would be less likely to      consumer. It also could be more difficult    concerns. Specifically, in contrast to the
comprehend oral notices, and                for the Commission to monitor and            proposal, the final rule does not impose
enforcement would be more difficult if      enforce compliance with the final rule       duties on any affiliate other than the
oral opt-out notices were allowed.          if oral opt-out notices were allowed.        affiliate that intends to use shared
   Section 680.21(a) of the final rule      Accordingly, the final rule requires the     eligibility information to make
contains the revised provisions             opt-out notice to be provided in writing     solicitations to the consumer. Although
regarding the initial notice and opt-out    or, if the consumer agrees,                  an opt-out notice must be provided by
requirement. Although the language of       electronically.                              an affiliate that has or has previously
this section has been revised and              Section 680.21(a)(3) identifies those     had a pre-existing business relationship
simplified, the substance of this           affiliates who may provide the initial       with the consumer (or as part of a joint
provision is substantially similar to the   opt-out notice. This section provides        notice), that affiliate has no duty to
proposal.                                   that the initial opt-out notice must be      provide such a notice. Instead, the final
   Section 680.21(a)(1) sets forth the      provided either by an affiliate that has     rule provides that absent such a notice,
general rule. This section contains the     or has previously had a pre-existing         an affiliate must not use shared
three conditions that must be met before    business relationship with the               eligibility information to make
a person may use eligibility information    consumer, or as part of a joint notice       solicitations to the consumer. Industry
about a consumer that it receives from      from two or more members of an               concerns about civil liability also may
an affiliate to make a solicitation for     affiliated group of companies, provided      be mitigated to some extent by the
marketing purposes to the consumer.         that at least one of the affiliates on the   Supreme Court’s recent decision in
First, it must be clearly and               joint notice has or has previously had a     Safeco Ins. Co. of America v. Burr, 127
conspicuously disclosed to the              pre-existing business relationship with      S. Ct. 2201 (June 4, 2007).
consumer in writing or, if the consumer     the consumer. The final rule follows the        Finally, many institutions currently
agrees, electronically, in a concise        general approach taken in the proposal       require consumers to provide their
notice that the person may use shared       to ensure that the notice is provided by     Social Security numbers when
eligibility information to make             an entity known to the consumer, while       exercising their existing GLBA and
solicitations to the consumer. Second,      eliminating potentially ambiguous and        FCRA opt-out rights. The Commission
the consumer must be provided a             confusing terms like ‘‘communicating         believes that institutions likely would
reasonable opportunity and a reasonable     affiliate’’ and ‘‘receiving affiliate.’’     follow their existing practice with
and simple method to opt out of the use        The Commission also has eliminated        regard to affiliate marketing opt-outs. To
of that eligibility information to make     as unnecessary the rules of construction.    combat identity theft and prevent
solicitations to the consumer. Third, the   Joint notices are now addressed directly     ‘‘phishing,’’ however, the Commission,
consumer must not have opted out.           in § 680.21(a)(3). The Commission also       along with many institutions, has been
Section 680.21(a)(2) of the final rule      has concluded that the provisions from       educating consumers not to provide
provides an example of the general rule.    the proposal relating to notice provided     their Social Security numbers to
   The Commission has concluded that        by an agent are unnecessary. General         unknown entities. Furthermore, as co-
the opt-out notice may not be provided      agency principles, however, continue to      Chair of the President’s Identity Theft
orally, but must be provided in writing     apply. An affiliate that has or has          Task Force, the Commission has made
or, if the consumer agrees,                 previously had a pre-existing business       a commitment to examine and
electronically. The statute requires the    relationship with the consumer may           recommend ways to limit the private
Commission to consider the affiliate        direct its agent to provide the opt-out      sector’s use of Social Security numbers.
sharing notification practices employed     notice on its behalf.                           The approach recommended by
on the date of enactment and to ensure         The Commission has concluded that         industry commenters would allow an
that notices and disclosures may be         the statute’s silence with regard to         unknown entity not only to provide an
coordinated and consolidated in             which affiliates may provide the opt-out     affiliate marketing opt-out notice to the
promulgating regulations. The affiliate     notice makes the statute ambiguous on        consumer, but also to require the
sharing notice under section                this point, despite industry comments to     consumer to reveal his or her Social
603(d)(2)(A)(iii) of the FCRA generally     the contrary. The Commission also            Security number to that unknown entity
must be included in the GLBA privacy        continues to believe that consumers are      in order to exercise the opt-out right.
notice, which must be provided in           more likely to pay attention to a notice     Such an approach would send
writing, or if the consumer agrees,         provided by a person known to the            conflicting messages to consumers about
electronically. Requiring the affiliate     consumer. The Commission remains             providing Social Security numbers to
marketing opt-out notice to be provided     concerned that a notice provided by an       unknown entities. This approach also
in writing, or if the consumer agrees,      entity unknown to the consumer may           would be inconsistent with the
electronically, is thus consistent with     not provide meaningful or effective          Commission’s current efforts to develop
existing affiliate sharing notification     notice, and that consumers may ignore        a comprehensive record on the uses of
practices and promotes coordination         or discard notices provided by unknown       the Social Security number in the
and consolidation of the three privacy-     entities. Industry comments on the           private sector and evaluate their
                 Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations                                   61435

necessity, as recommended by the                        ‘‘to make’’ a solicitation. Similarly, the      marketing purposes to a consumer if: (a)
President’s Identity Theft Task Force.11                legislative history does not contain            the person receives eligibility
                                                        guidance as to the meaning of ‘‘making’’        information from an affiliate; (b) the
Making Solicitations
                                                        a solicitation. Nevertheless, the               person uses that eligibility information
   The proposal repeatedly referred to                  Commission believes it is important to          to do one of the following—identify the
‘‘making or sending’’ solicitations.                    provide clear guidance regarding what           consumer or type of consumer to receive
Several commenters suggested revising                   activities result in making a solicitation.     a solicitation, establish the criteria used
the regulation to eliminate all references                 One commenter suggested that the             to select the consumer to receive a
to ‘‘sending’’ solicitations. These                     test for making a solicitation should           solicitation, or decide which of its
commenters believed that the statute                    turn on whether an affiliate having a           products or services to market to the
only concerns the use of eligibility                    pre-existing business relationship with         consumer or tailor its solicitation to that
information to ‘‘make’’ solicitations and               the consumer retains the discretion to          consumer; and (c) as a result of the
does not address ‘‘sending’’                            determine whether or not to send the            person’s use of the eligibility
solicitations. Commenters expressed                     solicitation. This commenter provided           information, the consumer is provided a
concern that by referring to ‘‘sending’’                an example where a financial institution        solicitation about the person’s products
solicitations, the proposal would apply                 obtains a list of an affiliate’s customers      or services.
the notice and opt-out requirements to                  from a common shared database, applies             The Commission recognizes that
servicers that send solicitations on                    its own criteria to this list, and then         several common industry practices may
behalf of another entity.                               requests the affiliate with an existing         complicate application of the rule
   The Commission has revised the final                 business relationship to solicit the            outlined in § 680.21(b)(1). First,
rule to eliminate all combined                          affiliate’s own customers to purchase           affiliated groups often use a common
references to ‘‘making or sending’’                     the financial institution’s products or         database as the repository for eligibility
solicitations. The general rule in section              services. (Thus, the financial institution      information obtained by various
624(a)(1), along with the duration                      would be using eligibility information to       affiliates, and information in that
provisions in section 624(a)(3) and the                 select a list of its affiliate’s customers to   database may be accessible to multiple
pre-existing business relationship                      receive the financial institution’s             affiliates. Second, affiliated companies
exception in section 624(a)(4)(A), refer                marketing materials.) This commenter            often use service providers to perform
to ‘‘making’’ or ‘‘to make’’ a solicitation.            believed that section 624 should not            marketing activities, and some of those
Other provisions of the statute, such as                apply so long as the affiliate with the         service providers may provide services
the consumer choice provision in                        existing business relationship has              for a number of different affiliates.
section 624(a)(2)(A), the service                       discretion to determine whether or not          Third, an affiliate may use its own
provider exception in section                           to send the solicitations. This                 eligibility information to market the
624(a)(4)(C), the non-retroactivity                     commenter also maintained that the              products or services of another affiliate.
provision in section 624(a)(5), and the                 applicability of section 624’s notice and       Sections 680.21(b)(2)-(5) address these
definition of ‘‘pre-existing business                   opt-out requirement should depend on            issues.
relationship’’ in section 624(d)(1), refer              who markets the product and not on                 Section 680.21(b)(2) clarifies that a
to ‘‘sending’’ or ‘‘to send’’ a solicitation.           what the product is or whose product it         person may receive eligibility
The verb ‘‘to send,’’ as used in the                    is.                                             information from an affiliate in various
statute, refers to a ministerial act that a                Nothing in the statute indicates that        ways, including when the affiliate
service provider, such as a mail house,                 the discretion of the affiliate providing       places that information into a common
performs for the person making the                      the eligibility information to determine        database that the person may access. Of
solicitation, (see 15 U.S.C. 1681s-                     whether or not to send a solicitation on        course, receipt of eligibility information
3(a)(4)(C)), or indicates the point in time             behalf of a person who has received             from an affiliate is only one element of
after which solicitations are no longer                 eligibility information from that affiliate     the rule outlined in § 680.21(b)(1). In the
permitted. See 15 U.S.C. 1681s-                         is the test for what constitutes making         case of a common database, use of the
3(d)(1)(B) and (C).                                     a solicitation. Rather, the statute focuses     eligibility information will be the key
   The Commission concludes that                        on whether the person receiving                 element in determining whether a
‘‘making’’ and ‘‘sending’’ solicitations                eligibility information from an affiliate       person has made a solicitation.
are different activities and that the focus             uses that information to market its                Section 680.21(b)(3) provides that a
of the statute is primarily on the                      products or services to consumers. A            person receives or uses an affiliate’s
‘‘making’’ of solicitations. For example,               ‘‘discretion to send’’ test would also          eligibility information if a service
a service provider may send a                           inappropriately link the terms ‘‘making’’       provider acting on behalf of the person
solicitation on behalf of another entity,               and ‘‘sending’’ in a manner that would          receives or uses that information in the
but it is the entity on whose behalf the                promote confusion and undercut                  manner described in §§ 680.21(b)(1)(i)
solicitation is sent that is making the                 arguments made by commenters urging             or (b)(1)(ii), except as provided in
solicitation and thus is subject to the                 the Commission to disassociate the two          § 680.21(b)(5), which is discussed
general prohibition on making a                         terms. Finally, a ‘‘discretion to send’’        below. Section 680.21(b)(3) also
solicitation, unless the consumer is                    test could foster circumvention of the          provides that all relevant facts and
given notice and an opportunity to opt                  notice and opt-out requirement, restrict        circumstances will determine whether a
out. Accordingly, the Commission has                    the ability of consumers to prohibit            service provider is acting on behalf of a
revised the final rule to refer to                      solicitations in a manner not                   person when it receives or uses an
‘‘making’’ a solicitation, except where                 contemplated by the statute, and make           affiliate’s eligibility information in
the statute specifically refers to                      it difficult for the Commission to              connection with marketing that person’s
‘‘sending’’ solicitations.                              administer and enforce the statute.             products or services.
   The statute, however, does not                          Section 680.21(b) of the final rule             Section 680.21(b)(4) addresses
describe what a person must do in order                 clarifies what constitutes ‘‘making’’ a         constructive sharing. In the
                                                        solicitation for purposes of this part.         supplementary information to the
   11See Combatting Identity Theft: A Strategic Plan,   Section 680.21(b)(1) provides that a            proposal, the Commission solicited
at 26–27 (April 2007) (available at www.idtheft.gov).   person makes a solicitation for                 comment on whether the notice and
61436            Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations

opt-out requirements of this rule should                business relationship with the consumer       restrict the sharing of transaction or
apply to circumstances that involve a                   and is thus exempt from the notice and        experience information among affiliates
‘‘constructive sharing’’ of eligibility                 opt-out requirements. Fourth, if the          unless that information is medical
information to conduct marketing, given                 consumer responds to the marketing            information. Section 603(d)(2)(A)(iii)
the policy objectives of section 214 of                 materials, for example, by returning a        operates independent of the affiliate
the FACT Act. By way of example, in a                   response card to an affiliate, one or         marketing rule. Thus, the existence of a
‘‘constructive sharing’’ scenario, a                    more of the exceptions to the notice and      pre-existing business relationship
consumer has a relationship with a                      opt-out requirement would apply, such         between a consumer and an affiliate that
financial institution, and the financial                as the consumer-initiated                     seeks to use shared eligibility
institution is affiliated with an                       communication exception, the pre-             information, such as credit scores or
insurance company. The insurance                        existing business relationship                income, to market to that consumer (or
company develops specific eligibility                   exception, or both.                           the applicability of another exception to
criteria, such as consumers having                         Consumer groups believed that              this affiliate marketing rule) does not
combined deposit balances in excess of                  constructive sharing contravenes the          relieve the entity sharing the credit
$50,000 or average monthly demand                       intent of Congress and amounts to a           score or income information of the
account deposits in excess of $10,000,                  loophole that should be fixed. Similarly,     requirement to comply with the affiliate
without the use of eligibility                          NAAG believed that the letter and spirit      sharing notice and opt-out provisions of
information received from the financial                 of section 624 required subjecting            section 603(d)(2)(A)(iii) of the FCRA
institution. The insurance company                      constructive sharing to the notice and        before it shares that non-transaction or
provides its criteria to the financial                  opt-out requirements and that to find         experience information with its
institution and asks the institution to                 otherwise would create a significant and      affiliate.13
identify financial institution consumers                unwarranted exception.                           Section 680.21(b)(4) describes two
that meet the eligibility criteria and                     After considering the constructive         situations where a person is deemed not
send insurance company marketing                        sharing issue, the Commission                 to have made a solicitation subject to
materials to those consumers. The                       concludes that the statute only covers        this part. Both situations assume that
financial institution sends the marketing               situations where a person uses                the person has not used eligibility
materials to those consumers who meet                   eligibility information that it received      information received from an affiliate in
the insurance company’s eligibility                     from an affiliate to make a solicitation      the manner described in
criteria. A consumer who meets the                      to the consumer about its products or         § 680.21(b)(1)(ii). First, a person does
eligibility criteria contacts the insurance             services. In a ‘‘constructive sharing’’       not make a solicitation subject to this
company after receiving the insurance                   scenario like that described above, a         part if that person’s affiliate uses its own
company marketing materials in the                      pre-existing business relationship is         eligibility information that it obtained in
manner specified in those materials.                    established between the consumer and          connection with a pre-existing business
The consumer’s response provides the                    the insurance company when the                relationship it has or had with the
insurance company with discernible                      consumer contacts the insurance               consumer to market the person’s
eligibility information, such as through                company to inquire about or apply for         products or services to the consumer.
a response form that is coded to identify               insurance products as a result of the         Second, if, in the situation just
the consumer as an individual who                       consumer’s receipt of the insurance           described, the person’s affiliate directs
meets the specific eligibility criteria.12              marketing materials. This pre-existing        its service provider to use the affiliate’s
   Industry commenters urged the                        business relationship is established          own eligibility information to market
Commission not to apply the notice and                  before the insurance company uses any
                                                                                                      the person’s products or services to the
opt-out requirement to ‘‘constructive                   shared eligibility information to make
                                                                                                      consumer, and the person does not
sharing’’ situations. The principal                     solicitations to the consumer. Because
                                                                                                      communicate directly with the service
arguments made by these commenters                      the insurance company does not use
                                                                                                      provider regarding that use of the
in support of their position were as                    shared eligibility information to make
                                                                                                      eligibility information, then the person
follows. First, in a constructive sharing               solicitations to the consumer before it
                                                                                                      has not made a solicitation subject to
scenario, there is no sharing of                        establishes a pre-existing business
                                                                                                      this part.
eligibility information among affiliates.               relationship with the consumer, the
                                                                                                         The core concept underlying the
Rather, the consumer provides                           statute does not apply.
                                                                                                      second prong of this provision is that
information to an affiliate when                           The Commission acknowledges the
                                                        concerns expressed by consumer groups         the affiliate that obtained the eligibility
responding. Second, section 624 applies                                                               information in connection with a pre-
when a person uses eligibility                          and NAAG regarding the decision not to
                                                        apply the notice and opt-out                  existing business relationship with the
information furnished by its affiliate to                                                             consumer controls the actions of the
make a solicitation for its own products                requirements to constructive sharing
                                                        situations. The statute’s affiliate           service provider using that information.
or services to the consumer. In                                                                       Therefore, the service provider’s use of
constructive sharing, however, the                      marketing provisions, however, only
                                                        limit the use of eligibility information      the eligibility information should not be
person does not use eligibility                                                                       attributed to the person whose products
information and does not make a                         received from an affiliate to make
                                                        solicitations to a consumer. A separate       or services will be marketed to
solicitation as defined in the statute.                                                               consumers. In such circumstances, the
Third, the affiliate that sends the                     provision of the FCRA, section
                                                        603(d)(2)(A)(iii), regulates the sharing of   service provider is acting on behalf of
marketing material has a pre-existing                                                                 the affiliate that obtained the eligibility
                                                        eligibility information among affiliates
                                                        and prohibits the sharing of non-             information in connection with a pre-
   12 The supplementary information to the proposal
                                                        transaction or experience information,        existing business relationship with the
noted that the notice and opt-out requirement
would not apply if, for example, an insurance           such as credit scores from a consumer         consumer, and not on behalf of the
company asked its affiliated financial institution to   report or income from an application,
include insurance company marketing material in                                                          13 A sharing of information occurs if a reference

periodic statements sent to consumers by the
                                                        among affiliates, unless the consumer is      code included in marketing materials reveals one
financial institution without regard to eligibility     given notice and an opportunity to opt        affiliate’s information about a consumer to another
information.                                            out of such sharing. The FCRA does not        affiliate upon receipt of a consumer’s response.
              Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations                        61437

person whose products or services will          First, the person’s affiliate controls     or on the envelope which contains the
be marketed to that affiliate’s              access to and use of its eligibility          marketing materials.
consumers.                                   information by the service provider              Fifth, the person does not directly use
   The Commission also recognizes that       (including the right to establish specific    the affiliate’s eligibility information in
there may be situations where the            terms and conditions under which the          the manner described in
person whose products or services are        service provider may use such                 § 680.21(b)(1)(ii).
being marketed does communicate with         information to market the person’s               These five conditions together ensure
the affiliate’s service provider. This may   products or services). This requirement       that the service provider is acting on
be the case, for example, where the          must be set forth in a written agreement      behalf of the affiliate that obtained the
service provider performs services for       between the person’s affiliate and the        eligibility information in connection
various affiliates relying on information    service provider. The person’s affiliate      with a pre-existing business relationship
maintained in and accessed from a            may demonstrate control by, for               with the consumer because that affiliate
common database. In certain                  example, establishing and implementing        controls the service provider’s receipt
circumstances, the person whose              reasonable policies and procedures            and use of that affiliate’s eligibility
products or services are being marketed      applicable to the service provider’s          information.
may communicate with the affiliate’s         access to and use of its eligibility             Section 680.21(b)(6) provides six
service provider, yet the service            information.                                  illustrative examples of the rule relating
provider is still acting on behalf of the       Second, the person’s affiliate             to making solicitations as set forth in
affiliate when it uses the affiliate’s       establishes specific terms and                §§ 680.21(b)(1)-(5).
eligibility information in connection        conditions under which the service            Exceptions
with marketing the person’s products or      provider may access and use that
services. Section 680.21(b)(5) describes     eligibility information to market the            Proposed § 680.20(c) contained
the conditions under which a service         person’s products or services (or those       exceptions to the requirements of this
provider would be deemed to be acting        of affiliates generally) to the consumer,     part and incorporated each of the
on behalf of the affiliate with the pre-     and periodically evaluates the service        statutory exceptions to the affiliate
existing business relationship, rather       provider’s compliance with those terms        marketing notice and opt-out
than the person whose products or            and conditions. These terms and               requirements that are set forth in section
services are being marketed,                 conditions may include the identity of        624(a)(4) of the FCRA. The Commission
notwithstanding direct communications        the affiliated companies whose products       has revised the preface to the exceptions
between the person and the service           or services may be marketed to the            for clarity to provide that the provisions
provider.                                    consumer by the service provider, the         of this part do not apply to ‘‘you’’ if a
   Section 680.21(b)(5) builds upon the      types of products or services of affiliated   person uses eligibility information that
concept of control of a service provider     companies that may be marketed, and           it receives from an affiliate in certain
and thus is a natural outgrowth of           the number of times the consumer may          circumstances. In addition, each of the
§ 680.21(b)(4). Under the conditions set     receive marketing materials. The              exceptions has been moved to
out in § 680.21(b)(5), the service           specific terms and conditions                 § 680.21(c) in the final rule and is
provider is acting on behalf of an           established by the person’s affiliate         discussed below.
affiliate that obtained the eligibility      must be set forth in writing, but need        Pre-existing Business Relationship
information in connection with a pre-        not be set forth in a written agreement       Exception
existing business relationship with the      between the person’s affiliate and the
consumer because, among other things,        service provider. If a periodic evaluation       Proposed § 680.20(c)(1) provided that
the affiliate controls the actions of the    by the person’s affiliate reveals that the    the provisions of this part would not
service provider in connection with the      service provider is not complying with        apply to an affiliate using eligibility
service provider’s receipt and use of the    those terms and conditions, the               information to make a solicitation to a
eligibility information. This provision is   Commission expects the person’s               consumer with whom the affiliate has a
designed to minimize uncertainty that        affiliate to take appropriate corrective      pre-existing business relationship. As
may arise from application of the facts      action.                                       noted above, a pre-existing business
and circumstances test in § 680.21(b)(3)        Third, the person’s affiliate requires     relationship exists when: (1) there is a
to cases that involve direct                 the service provider to implement             financial contract in force between the
communications between a service             reasonable policies and procedures            affiliate and the consumer; (2) the
provider and a person whose products         designed to ensure that the service           consumer and the affiliate have engaged
and services will be marketed to             provider uses the affiliate’s eligibility     in a financial transaction (including
consumers.                                   information in accordance with the            holding an active account or a policy in
   Section 680.21(b)(5) provides that a      terms and conditions established by the       force or having another continuing
person does not make a solicitation          affiliate relating to the marketing of the    relationship) during the 18 months
subject to this part if a service provider   person’s products or services. This           immediately preceding the date of the
(including an affiliated or third-party      requirement must be set forth in a            solicitation; (3) the consumer has
service provider that maintains or           written agreement between the person’s        purchased, rented, or leased the
accesses a common database that the          affiliate and the service provider.           affiliate’s goods or services during the
person may access) receives eligibility         Fourth, the person’s affiliate is          18 months immediately preceding the
information from the person’s affiliate      identified on or with the marketing           date of the solicitation; or (4) the
that the person’s affiliate obtained in      materials provided to the consumer.           consumer has inquired about or applied
connection with a pre-existing business      This requirement will be construed            for a product or service offered by the
relationship it has or had with the          flexibly. For example, the person’s           affiliate during the 3-month period
consumer and uses that eligibility           affiliate may be identified directly on       immediately preceding the date of the
information to market the person’s           the marketing materials, on an                solicitation. Proposed § 680.20(d)(1)
products or services to the consumer, so     introductory cover letter, on other           provided examples of the pre-existing
long as the following five conditions are    documents included with the marketing         business relationship exception. As
met.                                         materials, such as a periodic statement,      explained above, the Commission has
61438        Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations

revised the examples from proposed          Employee Benefit Plan Exception               exception, the person using the
§ 680.20(d)(1) in the final rule and           Proposed §680.20(c)(2) provided that       information is also ‘‘the person
included them as examples of the            the provisions of this part would not         provid[ing] employee benefit or other
definition of ‘‘pre-existing business       apply to an affiliate using the               services pursuant to a contract with an
relationship’’ rather than as examples of   information to facilitate                     employer.’’ Therefore, the Commission
the pre-existing business relationship      communications to an individual for           concludes that this exception, like the
exception.                                  whose benefit the affiliate provides          other provisions of this part, should
   Section 680.21(c)(1) of the final rule   employee benefit or other services            apply only to a person that uses
revises the pre-existing business           under a contract with an employer             eligibility information it receives from
relationship exception to delete the        related to and arising out of a current       an affiliate to make solicitations to
word ‘‘send’’ and to eliminate as           employment relationship or an                 consumers about its products or
unnecessary the cross-reference to the      individual’s status as a participant or       services.
location of the definition of ‘‘pre-        beneficiary of an employee benefit plan.      Service Provider Exception
existing business relationship.’’ As        One commenter believed that the
discussed above, commenters made a                                                          Proposed § 680.20(c)(3) provided that
                                            exception should be revised to permit         the provisions of this part would not
number of suggestions regarding the         communications ‘‘to an affiliate about
definition of ‘‘pre-existing business                                                     apply to an affiliate using the
                                            an individual for whose benefit an            information to perform services for
relationship.’’ The Commission has          entity provides employee benefit or           another affiliate, unless the services
addressed those comments elsewhere.         other services pursuant to a contract         involve making or sending solicitations
Most commenters supported the               with an employer related to and arising       on its own behalf or on behalf of an
proposed text of the pre-existing           out of the current employment                 affiliate and the service provider or such
business relationship exception, which      relationship or status of the individual      affiliate is not permitted to make or send
generally tracks the statutory language.    as a participant or beneficiary of an         such solicitations as a result of the
   Some commenters, however,                employee benefit plan.’’ This                 consumer’s election to opt out. Thus,
apparently believed that the pre-existing   commenter also suggested deleting the         under the proposal, when the notice has
business relationship exception is          phrase ‘‘you receive from an affiliate’’ in   been provided to a consumer and the
broader than it actually is. For example,   the introduction to proposed                  consumer has opted out, an affiliate
assume that an insurance company has        § 680.20(c). This commenter believed          subject to the consumer’s opt-out
a pre-existing business relationship with   that this exception should permit an          election may not circumvent the opt-out
a consumer and shares eligibility           employer or plan sponsor to share             by instructing the person with the
information about the consumer with its     information with its affiliates in order to   consumer relationship or another
affiliates by putting that information      offer other financial services, such as       affiliate to send solicitations to the
into a common database that is              brokerage accounts or IRAs, to its            consumer on its behalf.
accessible by all affiliates. The           employees. This commenter further                Several industry commenters urged
insurance company’s lending affiliate       requested clarification on whether the        the Commission to revise the proposed
accesses the database, reviews the data     exception applies only if related to          exception to conform to the statutory
on the insurance company’s consumers        products offered as an employee benefit.      language. Specifically, with respect to
and, based on its review, decides to           Section 680.21(c)(2) of the final rule     the exclusion from the service provider
market to some of the insurance             adopts the employee benefit exception         exception, these commenters
company’s consumers. Rather than            as proposed. The Commission declined          recommended that the Commission
sending the solicitations itself, the       to adopt the changes suggested by the         delete the references to solicitations on
lender asks the insurance company with      one commenter. First, the suggestion to       behalf of the service provider. Some of
the pre-existing business relationship to   make the exception applicable to              these commenters maintained that the
send solicitations on its behalf to the     communications ‘‘to an affiliate about        references to solicitations on behalf of
insurance company’s consumers. As           an individual for whose benefit an            the service provider itself would impose
noted above, one commenter believed         entity provides employee benefit or           additional burdens and costs on
that in this circumstance the pre-          other services’’ differs from the language    companies that use a single affiliate to
existing business relationship exception    of the statute. The language of the           provide various administrative services
would apply so long as the insurance        proposed and final rule focuses on            to other affiliates and would make it
company retained the discretion to          facilitating communications ‘‘to an           more difficult to provide general
decide whether or not to send the           individual for whose benefit the person       educational materials to consumers.
solicitations on behalf of the lender.      provides employee benefit or other            Some of these commenters also asked
However, the Commission concludes           services,’’ which tracks the statutory        the Commission to clarify that the
that this situation does not fall within    language better than the alternative          limitation in the service provider
the pre-existing business relationship      language proposed by the commenter.           exception has no applicability to any
exception. Instead, the lender makes the       Second, the only person to whom            other exception.
solicitation because it used eligibility    section 624 might apply is a person that         Section 680.21(c)(3) of the final rule
information received from an affiliate to   receives eligibility information from an      revises the service provider exception to
select the consumer to receive a            affiliate. Specifically, the statutory        delete as surplusage the references to
solicitation about its products or          preface to the exceptions provides that       solicitations by a service provider on its
services and, as a result, the consumer     ‘‘[t]his section shall not apply to a         own behalf. The Commission notes that
is provided a solicitation. To eliminate    person’’ using information to do certain      the general rule in § 680.21(a)(1)
any confusion and clarify the scope of      things. The language of the statute thus      prohibits a service provider from using
the exception, the Commission has           makes clear that the exceptions in            eligibility information it received from
added an example in § 680.21(d)(1) of       section 624(a)(4) of the FCRA were            an affiliate to make solicitations to the
the final rule to illustrate a situation    meant to apply to persons that                consumer about its own products or
where the pre-existing business             otherwise would be subject to section         services unless the consumer is given
relationship exception would apply.         624. In the case of the employee benefit      notice and an opportunity to opt out or
              Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations                      61439

unless one of the other exceptions           proposed § 680.20(d)(2)(ii), the             believed this clarification was so
applies. The service provider exception      Commission also contemplated that a          important that it should be incorporated
simply allows a service provider to do       consumer would not initiate a                into the rule itself. NAAG also suggested
what the affiliate on whose behalf it is     communication if an affiliate made the       imposing a specific time limit to allow
acting may do, such as using shared          initial call and left a message for the      solicitations to be made for no more
eligibility information to make              consumer to call back, and the               than 30 days after the consumer-
solicitations to consumers to whom the       consumer responded.                          initiated communication under this
affiliate is permitted to make such             Commenters generally supported the        exception.
solicitations. The final rule also deletes   text of the proposed consumer-initiated        Industry commenters also objected to
the word ‘‘make’’ from the exception to      communication exception. Several             some of the examples. In particular,
the service provider exception because,      commenters, however, urged the               industry commenters objected to the
as discussed above, ‘‘making’’ and           Commission to either delete the phrase       example in proposed § 680.20(d)(2)(i) on
‘‘sending’’ solicitations are distinct       ‘‘orally, electronically, or in writing’’    two grounds. First, these commenters
activities and this provision of the         from the regulation or modify the            believed that the consumer should not
statute uses the verb ‘‘to send.’’ The       language to read ‘‘whether orally,           have to supply contact information in
Commission notes that, although the          electronically, or in writing.’’ These       order to trigger the exception. These
statute contains separate service            commenters maintained that other             commenters noted that such a
provider and pre-existing business           means of communication may be used           requirement would seem to preclude
relationship exceptions, nothing in          by consumers in the future and should        solicitations over the phone during the
those exceptions prevents an affiliate       not be precluded by the regulations.         same call by presuming that a
that has a pre-existing business             Another commenter welcomed the               solicitation would be made by mail or
relationship with the consumer from          reference to oral communications and         e-mail. Some of these commenters also
relying upon the service provider            requested that the Commission clarify        believed that consumers would expect
exception, where appropriate. Section        that electronic communications refers to     an affiliated company, especially a
680.21(d)(2) of the final rule provides      both e-mail and facsimile transmissions.     company with a common brand, to have
examples of the service provider                Many industry commenters objected         their contact information already and
exception.                                   to the statement in the supplementary        would not want to provide it again.
                                             information that to qualify for this         Second, as noted above, some
Consumer-Initiated Communication             exception, the use of eligibility            commenters maintained that the affiliate
Exception                                    information ‘‘must be responsive’’ to the    should be able to respond by making
   Proposed § 680.20(c)(4) provided that     communication initiated by the               solicitations about any product or
the provisions of this part would not        consumer. These commenters believed          service, not just those mentioned by the
apply to an affiliate using the              that the concept of ‘‘responsiveness’’       consumer.
information to make solicitations in         creates a vague, subjective, and narrow        Many industry commenters objected
response to a communication initiated        standard that could subject institutions     to the example in proposed
by the consumer. The proposed rule           to compliance risk. These commenters         § 680.20(d)(2)(ii) about the consumer
further clarified that this exception may    noted that the Commission did not and        responding to a call back message.
be triggered by an oral, electronic, or      could not provide a clear definition of      These commenters believed that such a
written communication initiated by the       what would be ‘‘responsive.’’ Some of        call back should qualify as a consumer-
consumer.                                    these commenters noted that consumers        initiated communication, noting that the
   The supplementary information noted       may not be familiar with the various         consumer has the option of not
that to be covered by the proposed           types of products or services available to   returning the call. Moreover, these
exception, the use of eligibility            them and the different affiliates that       commenters noted that the customer
information must be responsive to the        offer those products or services and may     service representative receiving the call
communication initiated by the               rely on the institution to inform them       would not know what prompted the
consumer. The supplementary                  about available options. For this reason,    consumer’s call. Several commenters
information also explained that the time     most of these commenters maintained          acknowledged that there may be
period during which solicitations            that the exception should not limit an       concerns about calls made under false
remain responsive to the consumer’s          affiliate from responding with               pretenses to prompt consumers to return
communication would depend on the            solicitations about any product or           the call, but suggested that those
facts and circumstances. As illustrated      service. Some of these commenters            concerns should be addressed by other
in the example in proposed                   believed that it would be difficult to       means, such as enforcement of the laws
§ 680.20(d)(2)(iii), if a consumer were to   monitor compliance with or to develop        dealing with unfair or deceptive acts or
call an affiliate to ask about retail        scripts for a ‘‘responsiveness’’ standard    practices.
locations and hours, the affiliate could     by customer service representatives.           Finally, some industry commenters
not use eligibility information to make      One commenter noted that the Senate          expressed concerns about the example
solicitations to the consumer about          bill used more restrictive language in       in proposed § 680.20(d)(2)(iii) regarding
specific products because those              this exception than the final bill passed    the consumer who calls to ask for retail
solicitations would not be responsive to     by Congress. Some commenters also            locations and hours. These commenters
the consumer’s communication.                objected to the statement that the time      noted that it is impossible to know what
Conversely, the example in proposed          period during which solicitations            will transpire on a particular telephone
§ 680.20(d)(2)(i) illustrated that if the    remain responsive would depend on the        call. One commenter noted, for
consumer calls an affiliate to ask about     facts and circumstances.                     example, that if a consumer called to
its products or services and provides           NAAG supported the statement in the       ask for directions to an office, the
contact information, solicitations related   supplementary information that, to           customer service representative might
to those products or services would be       qualify for this exception, the use of       ask why the consumer needed to go to
responsive to the communication and          eligibility information ‘‘must be            that office. This, in turn, could prompt
thus permitted under the exception.          responsive’’ to the communication            the consumer to mention a product or
Finally, as illustrated by the example in    initiated by the consumer. NAAG              service that the consumer hoped to
61440         Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations

obtain and lead to a discussion of            for information about a particular            information about the reason why the
specific products or services that might      product or service, for example, life         consumer wants to visit a retail location,
be appropriate for the consumer.              insurance, solicitations regarding life       offers to provide information about
   Section 680.21(c)(4) of the final rule     insurance could be made in response to        products of interest to the consumer by
revises the consumer-initiated                that call, but solicitations regarding        telephone and mail, thus demonstrating
communications exception to delete the        other products or services would not be       how the conversation may develop to
reference to oral, electronic, or written     responsive. Finally, the Commission           the point where making solicitations
communications. The Commission                does not believe it is appropriate to         would be responsive to the consumer’s
believes that any form of                     adopt a specific time limit for making        call.
communication may come within the             solicitations following a consumer-
exception as long as the consumer                                                           Consumer Authorization or Request
                                              initiated communication about products
initiates the communication, whether                                                        Exception
                                              or services because solicitations will
in-person or by mail, e-mail, telephone,      likely be made quickly and any time              Proposed § 680.20(c)(5) clarified that
facsimile, or through other means. New        limit would be arbitrary.                     the provisions of this part would not
forms of communication that may                  In the final rule, the Commission has      apply to an affiliate using the
develop in the future could also come         renumbered the example in proposed            information to make solicitations
within the exception.                         § 680.20(d)(2)(i) as § 680.21(d)(3)(i), and   affirmatively authorized or requested by
   Section 680.21(c)(4) of the final rule     revised it to delete the references to a      the consumer. The proposal further
also provides that the communications         telephone call as the specific form of        provided that this exception may be
covered by the exception are consumer-        communication and the reference to            triggered by an oral, electronic, or
initiated communications about a              providing contact information. As             written authorization or request by the
person’s products or services. For the        discussed above and illustrated in the        consumer. However, a pre-selected
exception to apply, the statute requires      examples in §§ 680.20(j)(2)(ii)(E) and        check box or boilerplate language in a
that a person use eligibility information     (F), the need to provide contact              disclosure or contract would not
‘‘in response to’’ a communication            information may vary depending on the         constitute an affirmative authorization
initiated by a consumer. The                  form of communication used by the             or request under the proposal.
Commission believes this statutory            consumer. The new example in                     The proposal noted that the consumer
language contemplates that the                § 680.21(d)(3)(ii) responds to                authorization or request exception could
consumer-initiated communications             commenters’ concerns by illustrating a        be triggered, for example, if a consumer
will relate to a person’s products or         circumstance involving a consumer-            obtains a mortgage from a mortgage
services and that the solicitations           initiated communication in which a            lender and authorizes or requests to
covered by the exception will be those        consumer does not know exactly what           receive solicitations about homeowner’s
made in response to that                      products or services he or she wants,         insurance from an insurance affiliate of
communication.                                but initiates a communication to obtain       the mortgage lender. The consumer
   The Commission also believes the           information about investing for a child’s     could provide the authorization or make
exceptions should be construed                college education.                            the request either through the person
narrowly to avoid undermining the                The Commission has renumbered the          with whom the consumer has a business
general rule requiring notice and opt-        call-back example in proposed                 relationship or directly to the affiliate
out. Thus, consistent with the purposes       § 680.20(d)(2)(iii) as § 680.21(d)(3)(iii)    that will make the solicitation. Proposed
of the statute, the Commission does not       and revised it. The revised example           § 680.20(d)(3) provided an example of
believe that a consumer-initiated             provides that where the financial             the affirmative authorization or request
communication that is unrelated to a          institution makes an initial marketing        exception.
product or service should trigger the         call without using eligibility                   Most industry commenters argued
exception. A rule that allowed any            information received from an affiliate        that the proposed exception did not
consumer-initiated communication, no          and leaves a message that invites the         track the language of the statute because
matter how unrelated to a product or          consumer to apply for the credit by           the Commission included the word
service, to trigger the exception would       calling a toll-free number, the               ‘‘affirmative’’ in the proposed exception.
not to give meaning to the phrase ‘‘in        consumer’s response qualifies as a            These commenters believed that
response to’’ and could produce               consumer-initiated communication              including the word ‘‘affirmative’’ in the
incongruous results. For example, if a        about a product or service. The revised       proposed rule narrowed the exception
consumer calls an affiliate solely to         example balances commenters’ concerns         in a manner not intended by Congress.
obtain retail hours and directions or         about tracking which calls are call backs     Several of these commenters noted that
solely to opt out, the exception is not       and the Commission’s concern that             the Commission has declined to specify
triggered because the communication           consumers may be induced into                 what constitutes consumer consent
does not relate to the affiliate’s products   triggering the consumer-initiated             under the GLBA privacy rule and
or services and making a solicitation         communication exception as a result of        indicated that they were not aware of
about products or services to the             inaccurate, incomplete, or deceptive          any policy considerations or compliance
consumer in those circumstances would         telephone messages.                           issues that would warrant a departure
not be a reasonable response to that             For the reasons discussed above, the       from the Commission’s prior position.
communication.                                Commission has renumbered the retail             Some industry commenters believed
   The Commission recognizes, however,        hours example in proposed                     that a pre-selected check box should be
that if the conversation shifts to a          § 680.20(d)(2)(iii) as § 680.21(d)(3)(iv),    sufficient to evidence a consumer’s
discussion of products or services that       but otherwise adopted it as proposed. In      authorization or request for
the consumer may need, solicitations          addition, the new example in                  solicitations. In other words, a
may be responsive depending upon the          § 680.21(d)(3)(v) responds to                 consumer’s decision not to deselect a
facts and circumstances. Likewise, if a       commenters’ concerns by illustrating a        pre-selected check box should
consumer who has opted out of an              case where a consumer calls to ask            constitute a knowing act of the
affiliate’s use of eligibility information    about retail locations and hours and the      consumer to authorize or request
to make solicitations calls the affiliate     call center representative, after eliciting   solicitations. Other industry
              Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations                        61441

commenters believed that preprinted          consumer.’’ The Commission interprets        securities, and insurance companies).
language in a disclosure or contract         the ‘‘authorized or requested’’ language     This commenter was focused on private
should be sufficient to evidence a           in the FCRA exception to require the         banking enterprises. As discussed
consumer’s authorization or request for      consumer to take affirmative steps in        above, the Commission finds no
solicitations. One commenter cited case      order to trigger the exception.              statutory basis for creating such an
law and Commission informal staff               The Commission has made                   exception to the notice and opt-out
opinion letters relating to a consumer’s     conforming changes to the example in         requirement.
written instructions to obtain a             proposed § 680.20(d)(3), which has been
consumer report pursuant to section          renumbered as § 680.21(d)(4)(i) in the       Relation to Affiliate-Sharing Notice and
604(a)(2) of the FCRA as support for         final rule. In addition, the Commission      Opt-out
allowing boilerplate language to             has added three additional examples.            Proposed § 680.20(f) clarified the
constitute authorization or request.         The example in § 680.21(d)(4)(ii)            relationship between the affiliate
   A few industry commenters requested       illustrates how a consumer can               sharing notice and opt-out under section
that the Commission clarify that a           authorize or request solicitations by        603(d)(2)(A)(iii) of the FCRA and the
consumer’s authorization or request          checking a blank check box. The              affiliate marketing notice and opt-out in
does not have to refer to a specific         examples in §§ 680.21(d)(4)(iii) and (iv)    new section 624 of the FCRA.
product or service or to a specific          illustrate that preprinted boilerplate       Specifically, the proposal provided that
provider of products or services in order    language and a pre-selected check box        nothing in the affiliate marketing rule
for the exception to apply. As discussed     would not meet the authorization or          limits the responsibility of a company to
above, industry commenters had               request exception.                           comply with the notice and opt-out
differing views regarding the reference         The Commission does not believe it is     provisions of section 603(d)(2)(A)(iii) of
to oral, written, or electronic means of     appropriate to set a fixed time period for   the FCRA before it shares information
triggering the exception.                    an authorization or request. As noted in     other than transaction or experience
   NAAG suggested imposing a specific        the proposal, the duration of the            information among affiliates to avoid
time limit to allow solicitations to be      authorization or request depends on          becoming a consumer reporting agency.
made for no more than 30 days after the      what is reasonable under the facts and          One commenter urged the
consumer’s authorization or request          circumstances. In addition, an               Commission to delete this provision as
under this exception.                        authorization to make solicitations to       unnecessary. In the alternative, this
   Section 680.21(c)(5) of the final rule    the consumer terminates if the               commenter requested that the
revises the consumer authorization or        consumer revokes the authorization.          Commission clarify that section
request exception to delete the word            For the same reasons discussed above,     603(d)(2)(A)(iii) applies to the sharing of
‘‘affirmative’’ as surplusage. The           the Commission has deleted the               information that would otherwise meet
deletion of the word ‘‘affirmative’’ does    reference to oral, electronic, or written    the definition of a ‘‘consumer report,’’
not change the meaning of the exception      communications from this exception to        and that the sharing affiliate does not
however. The consumer still must take        track the language of the statute.           automatically become a consumer
affirmative steps to ‘‘authorize’’ or        Further, the Commission does not             reporting agency, but risks becoming a
‘‘request’’ solicitations.                   believe it is necessary to clarify the       consumer reporting agency.
   The Commission construes this             elements of an authorization or request.        This provision has been renumbered
exception, like the other exceptions,        The statute clearly refers to
narrowly and in a manner that does not                                                    as § 680.21(e) in the final rule. Section
                                             ‘‘solicitations authorized or requested      680.21(e) has been revised to delete the
undermine the general notice and opt-        by the consumer.’’ The facts and
out requirement. For that reason, the                                                     clause that referred to becoming a
                                             circumstances will determine what            consumer reporting agency and to
Commission believes that affiliated          solicitations have been authorized or
companies cannot avoid use of the                                                         substitute in its place the neutral phrase
                                             requested by the consumer.                   ‘‘where applicable.’’
statute’s notice and opt-out provisions
by including preprinted boilerplate          Compliance with Applicable Laws              Section 680.22 Scope and Duration of
language in the disclosures or contracts     Exception                                    Opt-Out
they provide to consumers, such as             Proposed § 680.20(c)(6) clarified that
                                                                                          Scope of the Opt-out
language stating that by applying to         the provisions of this part would not
open an account, the consumer                apply to an affiliate if compliance with       The Commission addressed issues
authorizes or requests to receive            the requirements of section 624 by the       relating to the scope of the opt-out in
solicitations from affiliates. Such an       affiliate would prevent that affiliate       various sections of the proposal. In the
interpretation would permit the              from complying with any provision of         supplementary information to the
exception to swallow the rule, a result      state insurance laws pertaining to unfair    proposal, the Commission stated that
that cannot be squared with the intent       discrimination in a state where the          the opt-out would be tied to the
of Congress to give consumers notice         affiliate is lawfully doing business. See    consumer, rather than to the
and an opportunity to opt out of             FCRA, section 624(a)(4). The                 information. Some industry commenters
solicitations.                               Commission received no comments on           supported the approach of tying the opt-
   The comparison made by some               this provision. Section 680.21(c)(6) of      out to the consumer, rather than to the
commenters to the GLBA privacy rule is       the final rule adopts the state insurance    information. Other industry
misplaced. The GLBA and the privacy          law compliance exception as proposed.        commenters, however, believed it was
rule create an exception to permit the          One commenter requested the               inappropriate to tie the opt-out to the
disclosure of nonpublic personal             creation of an additional exception to       consumer and requested that
information ‘‘with the consent or at the     permit the sharing of eligibility            institutions have the flexibility to
direction of the consumer.’’ Section 624     information among affiliates that are        implement the consumer’s opt-out at the
of the FCRA creates an exception to          aligned under one line of business           account level, rather than at the
permit the use of shared eligibility         within an organization and that share        consumer level. These commenters
information ‘‘in response to solicitations   common management, branding, and             believed that an account-by-account
authorized or requested by the               regulatory oversight (i.e., banking,         approach would be consistent with the
61442         Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations

menu of opt-out choices provided in           consequences. For example, if the opt-          consumer that relates to eligibility
this rule and the GLBA privacy rule.          out were tied to the consumer, an               information obtained in connection
These commenters also noted that an           institution would have to track the             with a transaction with the consumer,
account-based approach would provide          consumer indefinitely, even if the              such as an isolated transaction or a
the consumer with a new notice and            consumer’s relationship with the                credit application that is denied, the
opportunity to opt out when a former          institution terminated and a new                opt-out notice only applies to eligibility
customer decides to re-establish a new        relationship were subsequently                  information obtained in connection
relationship with the institution.            established with that institution years         with that transaction. The notice cannot
   Proposed § 680.21(c) provided that         later. The Commission does not believe          apply to eligibility information that may
the notice could be designed to allow a       that institutions should be required to         be obtained in connection with
consumer to choose from a menu of             track consumers indefinitely following          subsequent transactions or a continuing
alternatives when opting out, such as by      termination. In addition, an opt-out tied       relationship that may be subsequently
selecting certain types of affiliates,        to the consumer could apply to the use          established by the consumer with the
certain types of information, or certain      of all eligibility information, not just to     person or its affiliate. Section
modes of delivery from which to opt           eligibility information about the               680.22(a)(3)(ii) provides examples of
out, so long as one of the alternatives       consumer, received from an affiliate and        isolated transactions.
gave the consumer the opportunity to          used to make solicitations to the                  Section 680.22(a)(4) provides that a
opt out with respect to all affiliates, all   consumer. It is not clear from the statute      consumer may be given the opportunity
eligibility information, and all methods      or the legislative history that Congress        to choose from a menu of alternatives
of delivering solicitations. Several          intended the opt-out provisions of              when electing to prohibit solicitations.
industry commenters objected to the           section 624 to apply to eligibility             An opt-out notice may give the
requirement that the institution provide      information about consumers other than          consumer the opportunity to elect to
a single universal opt-out option that        the consumer to whom a solicitation is          prohibit solicitations from certain types
would allow consumers to opt out              made. Finally, the Commission does not          of affiliates covered by the opt-out
completely of all solicitations. In           believe it is necessary to make the opt-        notice but not other types of affiliates
addition, one commenter found the             out effective in perpetuity upon                covered by the notice, solicitations
reference to all types of eligibility         termination of the relationship.                based on certain types of eligibility
information confusing, while another             Section 680.22(a) of the final rule          information but not other types of
commenter noted that some institutions        brings together these different scope           eligibility information, or solicitations
may want to implement the opt-out on          considerations to address                       by certain methods of delivery but not
an account-by-account basis.                  comprehensively the scope of the opt-           other methods of delivery, so long as
   Section 680.25(d) of the proposal          out. Under the revised approach, the            one of the alternatives is the
provided that if a consumer’s                 scope of the opt-out is derived from            opportunity to prohibit all solicitations
relationship with an institution              language of section 624(a)(2)(A) of the         from all of the affiliates that are covered
terminated for any reason when a              FCRA and generally depends upon the             by the notice. The Commission
consumer’s opt-out election was in            content of the opt-out notice. Section          continues to believe that the language of
force, the opt-out would continue to          680.22(a)(1) provides that, except as           section 624(a)(2)(A) of the FCRA
apply indefinitely, unless revoked by         otherwise provided in that section, a           requires the opt-out notice to contain a
the consumer. Most industry                   consumer’s election to opt out prohibits        single opt-out option for all solicitations
commenters objected to having the opt-        any affiliate covered by the opt-out            within the scope of the notice.
out period continue to apply                  notice from using the eligibility                  The Commission recognizes that
indefinitely upon termination of the          information received from another               consumers could receive a number of
consumer’s relationship with the              affiliate as described in the notice to         different opt-out notices, even from the
institution. These commenters believed        make solicitations for marketing                same affiliate. The Commission will
that this approach was not supported by       purposes to the consumer.                       monitor industry notice practices and
the statute, would prove costly and              Section 680.22(a)(2)(i) clarifies that, in   evaluate whether further action is
difficult to administer, and would            the context of a continuing relationship,       needed.
require the indefinite tracking of opt-       an opt-out notice may apply to                     Section 680.22(a)(5) contains a special
outs. These commenters also believed          eligibility information obtained in             rule for notice following termination of
that the five-year opt-out period would       connection with a single continuing             a continuing relationship. This rule
provide sufficient protection to              relationship, multiple continuing               provides that a consumer must be given
consumers that terminate their                relationships, continuing relationships         a new opt-out notice if, after all
relationship. One commenter noted that        established subsequent to delivery of           continuing relationships with a person
the proposed rule would impose                the opt-out notice, or any other                or its affiliate have been terminated, the
particular hardships on mortgage              transaction with the consumer. Section          consumer subsequently establishes a
lenders because those lenders often           680.22(a)(2)(ii) provides examples of           new continuing relationship with that
have consumer relationships of very           continuing relationships. These                 person or the same or a different affiliate
short duration on account of selling the      examples are substantially similar to the       and the consumer’s eligibility
loans they originate into the secondary       examples used in the GLBA privacy rule          information is to be used to make a
market. Consumer groups supported the         with added references to relationships          solicitation. This special rule affords the
proposed treatment of opt-outs for            between the consumer and an affiliate.          consumer and the company a fresh start
terminated consumer relationships.               Section 680.22(a)(3)(i) limits the           following termination of all continuing
   Upon further examination, the              scope of an opt-out notice that is not          relationships by requiring a new opt-out
Commission believes that the scope of         connected with a continuing                     notice if a new continuing relationship
the opt-out should be addressed               relationship. This section provides that        is subsequently established.
comprehensively in a single section of        if there is no continuing relationship             The new opt-out notice must apply, at
the final rule. The Commission also           between the consumer and a person or            a minimum, to eligibility information
concludes that tying the opt-out to the       its affiliate, and if the person or its         obtained in connection with the new
consumer could have had unintended            affiliate provides an opt-out notice to a       continuing relationship. The new opt-
             Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations                      61443

out notice may apply more broadly to        consumer’s opt-out should be honored        consumer’s opt-out election is received
information obtained in connection          within a specific length of time not to     and the date the consumer’s opt-out
with a terminated relationship and give     exceed 30 days after the consumer           election is implemented.
the consumer the opportunity to opt out     responds to the opt-out notice.                The Commission also believes it is
with respect to eligibility information        A few industry commenters urged the      neither necessary nor desirable to set a
obtained in connection with both the        Commission to allow consumers to            mandatory deadline for implementing
terminated and the new continuing           revoke an opt-out election orally. Other    the consumer’s opt-out election. A
relationships. Further, the consumer’s      industry commenters requested that the      general standard is preferable because
failure to opt out does not override a      final rule include a clear statement that   the time it will reasonably take to
prior opt-out election by the consumer      an opt-out period may be shortened to       implement a consumer’s opt-out
applicable to eligibility information       a period of less than five years by the     election may vary.
obtained in connection with a               consumer’s revocation of an opt-out            Consistent with the special rule for a
terminated relationship that is still in    election. Consumer groups approved of       notice following termination of a
effect, regardless of whether the new       the Commission’s statement that if a        continuing relationship, the duration of
opt-out notice applies to eligibility       consumer opts out again during the five-    the opt-out is not affected by the
information obtained in connection          year opt-out period, then a new five-       termination of a continuing
with the terminated relationship. The       year period begins. Consumer groups         relationship. When a consumer opts out
final rule also contains an example of      also supported allowing institutions to     in the course of a continuing
this special rule. The Commission notes,    make the opt-out period effective in        relationship and that relationship is
however, that where a consumer was          perpetuity so long as this is clearly       terminated during the opt-out period,
not given an opt-out notice in              disclosed to the consumer in the            the opt-out remains in effect for the rest
connection with the initial continuing      original notice.                            of the opt-out period. If the consumer
relationship because eligibility               The general provision regarding the      subsequently establishes a new
information obtained in connection          duration of the opt-out has been            continuing relationship while the opt-
with that continuing relationship was       renumbered as § 680.22(b) in the final      out period remains in effect, the opt-out
not shared with affiliates for use in       rule, consistent with the Commission’s      period may not be shortened with
making solicitations, an opt-out notice     decision to address all scope issues in     respect to information obtained in
provided in connection with a new           the same section. The Commission has        connection with the terminated
continuing relationship would have to       revised the duration provision to clarify   relationship by sending a new opt-out
apply to any eligibility information        that the opt-out period expires if the      notice to the consumer when the new
obtained in connection with the             consumer revokes the opt-out in writing     continuing relationship is established,
terminated relationship that is to be       or, if the consumer agrees,                 even if the consumer does not opt out
shared with affiliates for use in making    electronically. The requirement for a       upon receipt of the new opt-out notice.
future solicitations.                       written or electronic revocation is         A person may track the eligibility
                                            retained and is consistent with the         information obtained in connection
Duration and Timing of Opt-Out              approach taken in the GLBA privacy          with the terminated relationship and
   Proposed § 680.25 addressed the          rule. The Commission does not believe       provide a renewal notice to the
duration and effect of the consumer’s       it is necessary or appropriate to permit    consumer, or may choose not to use
opt-out election. Proposed § 680.25(a)      oral revocation. The Commission notes       eligibility information obtained in
provided that the consumer’s election to    that many of the exceptions to the          connection with the terminated
opt out would be effective for the opt-     notice and opt-out requirements may be      relationship to make solicitations to the
out period, which is a period of at least   triggered by oral communications, as        consumer.
five years beginning as soon as             discussed above, which would enable            Proposed § 680.25(c) clarified that a
reasonably practicable after the            the use of shared eligibility information   consumer may opt out at any time. As
consumer’s opt-out election is received.    to make solicitations pending receipt of    explained in the supplementary
The supplementary information noted         a written or electronic revocation. Also,   information to the proposal, even if the
that if a consumer elected to opt out       as noted in the proposal, nothing           consumer did not opt out in response to
every year, a new opt-out period of at      prohibits setting an opt-out period         the initial opt-out notice or if the
least five years would begin upon           longer than five years, including an opt-   consumer’s election to opt out was not
receipt of each successive opt-out          out period that does not expire unless      prompted by an opt-out notice, a
election.                                   revoked by the consumer.                    consumer may still opt out. Regardless
   Some industry commenters believed           The Commission does not agree that       of when the consumer opts out, the opt-
that the proposal was inconsistent with     the opt-out period should begin on the      out must be effective for a period of at
the statute because it provided that the    date the consumer’s election to opt out     least five years.
opt-out period would begin as soon as       is received. Commenters generally              The Commission received few
reasonably practicable after the            recognized that institutions cannot         comments on this provision. Consumer
consumer’s opt-out election is received.    instantaneously implement a                 groups urged the Commission to
These commenters believed that the opt-     consumer’s opt-out election but need        reinforce the continuing nature of the
out period should begin on the date the     time to do so. The Commission               right to opt out by requiring institutions
consumer’s opt-out is received and that     interprets the statutory language to        to give the opt-out notice annually along
the final rule also should allow            mean that the consumer’s opt-out            with the annual GLBA privacy notice.
institutions a reasonable period of time    election must be honored for a period of    These commenters acknowledged that
to implement a consumer’s initial or        at least five years from the date such      the FCRA does not specifically state that
renewal opt-out election before it          election is implemented. The                the notice is required annually, but
becomes effective. Consumer groups          Commission believes that Congress did       noted that the statute also does not say
believed that the requirement to honor      not intend for the opt-out period to be     that the consumer has only one
an opt-out ‘‘beginning as soon as           shortened to a period of less than the      opportunity to opt out.
reasonably practicable’’ was too vague.     five years specified in the statute to         The Commission has renumbered the
These commenters believed that a            reflect the time between the date the       provision giving the consumer the right
61444         Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations

to opt out at any time as § 680.22(c) in     notice. A representation that the notice      duration of the opt-out period that it
the final rule, but otherwise adopted the    is provided by ‘‘the ABC banking, credit      previously disclosed or honor the opt-
provision as proposed. The Commission        card, insurance, and securities               out in perpetuity has no obligation to
finds no statutory basis for requiring the   companies’’ applies to all companies in       provide a revised notice to the
provision of an annual opt-out notice to     those categories, not just some of those      consumer. In that case, the result is the
consumers along with the GLBA privacy        companies. But if the affiliates              same as if the institution established a
notice.                                      providing the notice do not all share a       five-year opt-out period and then did
                                             common name, then the notice must             not send a renewal notice at the end of
Section 680.23 Contents of Opt-out           either separately identify each affiliate     that period. A person receiving
Notice; Consolidated and Equivalent          by name or identify each of the common        eligibility information from an affiliate
Notices                                      names used by those affiliates. For           would be prohibited from using that
Contents in General                          example, if the affiliates providing the      information to make solicitations to a
   Section 680.21 of the proposal            notice do business under both the ABC         consumer unless a renewal notice is
addressed the contents of the opt-out        name and the XYZ name, then the               first provided to the consumer and the
notice. Proposed § 680.21(a) would have      notice could list each affiliate by name      consumer does not renew the opt-out.
required that the opt-out notice be clear,   or indicate that the notice is being          So long as no solicitations are made
conspicuous, and concise, and                provided by ‘‘all of the ABC and XYZ          using eligibility information received
accurately disclose: (1) that the            companies’’ or by ‘‘the ABC banking           from an affiliate, there would be no
consumer may elect to limit a person’s       and credit card companies and the XYZ         violation of the statute or regulation for
                                             insurance companies.’’                        failing to send a renewal notice in this
affiliate from using eligibility
                                                Section 680.23(a)(1)(ii) provides that     situation.
information about the consumer that it
                                             an opt-out notice must contain a list of
obtains from that person to make or          the affiliates or types of affiliates         Joint Notice
send solicitations to the consumer; (2) if   covered by the notice. The notice may            Proposed § 680.24(c) permitted a
applicable, that the consumer’s election     apply to multiple affiliates and to           person subject to this rule to provide a
will apply for a specified period of time    companies that become affiliates after        joint opt-out notice with one or more of
and that the consumer will be allowed        the notice is provided to the consumer.       its affiliates that are identified in the
to extend the election once that period      The rule for identifying the affiliates       notice, so long as the notice was
expires; and (3) a reasonable and simple     covered by the notice is substantially        accurate with respect to each affiliate
method for the consumer to opt out.          similar to the rule for identifying the       jointly issuing the notice. Under the
   Some commenters expressed concern         affiliates providing the notice in            proposal, a joint notice would not have
about requiring the notice to specify the    § 680.23(a)(1)(i), as described in the        to list each affiliate participating in the
applicable time period and the               previous paragraph.                           joint notice by its name, but could state
consumer’s right to extend the election         Sections 680.23(a)(1)(iii)-(vii)           that it applies to ‘‘all institutions with
once the opt-out expires. One                respectively require the opt-out notice       the ABC name’’ or ‘‘all affiliates in the
commenter believed this would require        to include the following: a general           ABC family of companies.’’
institutions to determine in advance the     description of the types of eligibility          One commenter believed that
length of the opt-out period. Another        information that may be used to make          individually listing each company could
commenter urged the Commission to            solicitations to the consumer; a              result in long and confusing notices.
clarify that institutions could              statement that the consumer may elect         This commenter suggested revising the
subsequently increase the duration of        to limit the use of eligibility information   rule to permit the generic identification
the opt-out or make it permanent             to make solicitations to the consumer; a      of the types of affiliates by whom
without providing another notice to the      statement that the consumer’s election        eligibility information may be used to
consumer.                                    will apply for the specified period of        make solicitations and to allow the
   The Commission has renumbered the         time stated in the notice and, if             notice to apply to entities that become
provisions addressing the contents of        applicable, that the consumer will be         affiliates after the notice is sent.
the opt-out notice as § 680.23(a) in the     allowed to renew the election once that          In the final rule, the separate joint
final rule and revised them. Section         period expires; if the notice is provided     notice provision has been eliminated.
680.23(a)(1) of the final rule requires      to consumers who may have previously          Instead, the final rule incorporates the
additional information in opt-out            opted out, such as if a notice is provided    joint notice option into the provisions
notices. Section 680.23(a)(1)(i) provides    to consumers annually, a statement that       that address which affiliates may
that all opt-out notices must identify, by   the consumer who has chosen to limit          provide the opt-out notice and the
name, the affiliate(s) that is providing     marketing offers does not need to act         contents of the notice.
the notice. A group of affiliates may        again until the consumer receives a
jointly provide the notice. If the notice    renewal notice; and a reasonable and          Joint relationships
is provided jointly by multiple affiliates   simple method for the consumer to opt           The proposal addressed joint
and each affiliate shares a common           out. The statement described in               relationships in the section dealing with
name, such as ‘‘ABC,’’ then the notice       § 680.23(a)(1)(vi) regarding consumers        delivery of opt-out notices. Proposed
may indicate that it is being provided by    who may have previously opted out             § 680.24(d) set out a rule that would
multiple companies with the ABC name         does not apply to the model privacy           apply when two or more consumers
or multiple companies in the ABC group       form that the Commission is developing        jointly obtain a product or service from
or family of companies. Acceptable           in a separate rulemaking. Appropriate         a person subject to the rule (referred to
ways of identifying the multiple             use of the model forms in Appendix C          in the proposed regulation as ‘‘joint
affiliates providing the notice include      will satisfy these content requirements.      consumers’’), such as a joint credit card
stating that the notice is provided by          The Commission continues to believe        account. It also provided several
‘‘all of the ABC companies,’’ ‘‘the ABC      that the opt-out notice must specify the      examples. Under the proposal, a person
banking, credit card, insurance, and         length of the opt-out period, if one is       subject to this rule could provide a
securities companies,’’ or by listing the    provided. However, an institution that        single opt-out notice to joint
name of each affiliate providing the         subsequently chooses to increase the          accountholders. The notice would have
              Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations                      61445

had to indicate whether the person           may opt out with respect to affiliate        under section 603(d)(2)(A)(iii) of the
would consider an opt-out by a joint         marketing in connection with an              FCRA.
accountholder as an opt-out by all of the    individually-held account, but not opt          Commenters generally supported the
associated accountholders, or whether        out with respect to affiliate marketing in   proposed provision. Several
each accountholder would have to opt         connection with a joint relationship. In     commenters believed it was probable
out separately. The person could not         that case, it could be challenging to        that most institutions would want to
require all accountholders to opt out        identify which consumer information          provide the affiliate marketing opt-out
before honoring an opt-out direction by      may and may not be used by affiliates        notice with their existing GLBA privacy
one of the joint accountholders. Because     to make solicitations to the consumer.       notice to reduce compliance costs and
section 624 of the FCRA deals with the       Nevertheless, the final rule permits         minimize consumer confusion. One
use of information for marketing by          persons providing opt-out notices to         commenter believed that institutions
affiliates, rather than the sharing of       consumers to provide a single opt-out        would be less likely to include the opt-
information among affiliates, comment        notice to joint consumers.                   out notice as part of their annual GLBA
was requested on whether information                                                      privacy notice because section 214 does
about a joint account should be allowed      Alternative Contents
                                                                                          not have an annual notice requirement.
to be used for making solicitations to a        Proposed § 680.21(d) provided that,          The Commission has moved the
joint consumer who has not opted out.        where an institution elects to give          provisions addressing consolidated and
   Some commenters supported the             consumers a broader right to opt out of      equivalent notices to the section
flexible approach proposed by the            marketing than is required by this part,     addressing the contents of the notice
Commission for dealing with joint            the institution would have the ability to    and renumbered those provisions as
accounts and notice to joint                 modify the contents of the opt-out           §§ 680.23(b) and (c) respectively in the
accountholders. One commenter                notice to reflect accurately the scope of    final rule. Otherwise, those provisions
suggested providing additional               the opt-out right it provides to             have been adopted as proposed with
flexibility to enable consumers to opt       consumers. This section also noted that      one exception. The provision on
out in certain circumstances, such as        proposed Appendix A provided a model         equivalent notices clarifies that an
when eligibility information from a joint    form that may be helpful for institutions    equivalent notice satisfies the
account is involved, but not in others,      that wish to allow consumers to opt out      requirements of § 680.23—not the entire
such as when eligibility information         of all marketing from the institution and    part—because the part addresses many
from an individual account is involved.      its affiliates, but use of the model form    issues besides the content of the notice,
Another commenter, however, believed         is not required. Commenters generally        such as delivery and renewal of opt-
that the provisions regarding joint          favored the flexibility afforded by this     outs. The Commission believes that
relationships may not be appropriate for     provision. The Commission has                these provisions are related to the
the affiliate marketing rule because
                                             renumbered the provision addressing          contents of the notice and should
section 624 relates to the use of
                                             alternative contents as § 680.23(a)(3) in    therefore be included in this section.
information for marketing to a particular
                                             the final rule, but otherwise adopted it        The Commission encourages
consumer, not to the sharing of
                                             as proposed.                                 consolidation of the affiliate marketing
information among affiliates. Consumer
groups urged the Commission to               Model Notices                                opt-out notice with the GLBA privacy
prohibit the use of eligibility                                                           notice, including the affiliate sharing
information about a joint account for          Section 680.23(a)(4) in the final rule     opt-out notice under section
making solicitations to a consumer who       states that model notices are provided in    603(d)(2)(A)(iii) of the FCRA, so that
has not opted out if the other joint         Appendix C of Part 698, renumbered           consumers receive a single notice they
consumer on the account has opted out.       from Appendix A of Part 680. The             can use to review and exercise all
   The Commission has renumbered the         Commission has provided these model          privacy opt-outs. Consolidation of these
provision addressing joint relationships     notices to facilitate compliance with the    notices, however, presents special
as § 680.23(a)(2) in the final rule. The     rule. However, the final rule does not       issues. For example, the affiliate
Commission has deleted the example of        require use of the model notices.            marketing opt-out may be limited to a
joint relationships from the final rule      Consolidated and Equivalent Notices          period of at least five years, subject to
because it addressed, in part, the                                                        renewal, whereas the GLBA privacy and
sharing of information, rather than the        Proposed § 680.27 provided that an         FCRA section 603(d)(2)(A)(iii) opt-out
use of information. The Commission has       opt-out notice required by this part         notices are not time-limited. This
made other revisions to enhance the          could be coordinated and consolidated        difference, if applicable, must be made
readability of this provision. The           with any other notice or disclosure          clear to the consumer. Thus, if a
revised provision is substantively           required to be issued under any other        consolidated notice is used and the
similar to the joint relationships           provision of law, including but not          affiliate marketing opt-out is limited in
provision of the GLBA privacy rule,          limited to the notice described in           duration, the notice must inform
except to the extent that rule refers to     section 603(d)(2)(A)(iii) of the FCRA        consumers that if they previously opted
the sharing of information among             and the notice required by title V of the    out, they do not need to opt out again
affiliates.                                  GLBA. In addition, a notice or other         until they receive a renewal notice
   The Commission believes that              disclosure that was equivalent to the        when the opt-out expires or is about to
different issues may arise with regard to    notice required by this part, and that       expire. In addition, as discussed more
providing a single opt-out notice to joint   was provided to a consumer together          fully below, the Commission has
consumers in the context of this rule,       with disclosures required by any other       developed a model privacy form that
which focuses on the use of                  provision of law, would satisfy the          includes the affiliate marketing opt-out.
information, compared to issues that         requirements of this part. The proposal      The Commission expects that once
may arise with regard to providing such      specifically requested comment on the        published in final form, use of the
a notice in the context of other privacy     consolidation of the affiliate marketing     model privacy form will satisfy the
rules that focus on the sharing of           notice with the GLBA privacy notice          requirement to provide an affiliate
information. For example, a consumer         and the affiliate sharing opt-out notice     marketing opt-out notice.
61446         Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations

Section 680.24 Reasonable Opportunity        out must be provided, the Commission        consumer could be required to check a
to Opt Out                                   believes that the appropriate time to       box right at the Internet Web site in
   Section 680.22(a) of the proposal         permit solicitations may vary depending     order to opt out or decline to opt out
provided that before a receiving affiliate   upon the circumstances. A general           before continuing with the transaction.
could use eligibility information to         standard provides flexibility to allow a    However, this example would not cover
make or send solicitations to the            person to use eligibility information it    a situation where the consumer was
consumer, the communicating affiliate        receives from an affiliate to make          required to send a separate e-mail or
would have to provide the consumer           solicitations at an appropriate point in    visit a different Internet Web site in
with a reasonable opportunity to opt out     time that may vary depending upon the       order to opt out.
                                             circumstances, while assuring that the         Proposed § 680.22(b)(4) illustrated
following delivery of the opt-out notice.
                                             consumer is given a realistic               that including the affiliate marketing
Given the variety of circumstances in
                                             opportunity to prevent such use of this     opt-out notice in a notice under the
which institutions must provide a                                                        GLBA would satisfy the reasonable
                                             information. In the final rule, the
reasonable opportunity to opt out, the                                                   opportunity standard. In such cases, the
                                             Commission has retained the approach
proposal construed the requirement for                                                   consumer would be allowed to exercise
                                             of not requiring affiliate marketing opt-
a reasonable opportunity to opt out as                                                   the opt-out in the same manner and
                                             out notices to disclose how long a
a general test that would avoid setting                                                  would be given the same amount of time
                                             consumer has to respond before
a mandatory waiting period in all cases.                                                 to exercise the opt-out as is provided for
                                             eligibility information may be used to
   The proposed rule would not have                                                      any other opt-out provided in the GLBA
                                             make solicitations to the consumer or
required institutions subject to the rule                                                privacy notice.
                                             that consumers may exercise their right
to disclose how long a consumer would                                                       Proposed § 680.22(b)(5) illustrated
                                             to opt out at any time. However, an
have to respond to the opt-out notice                                                    how an ‘‘opt-in’’ could meet the
                                             institution may, at its option, add this
before eligibility information                                                           requirement to provide a reasonable
                                             information to its opt-out notice.
communicated to affiliates could be             Section 680.22(b) of the proposal        opportunity to opt out. Specifically, if
used to make or send solicitations to the    provided examples to illustrate what        an institution has a policy of not
consumer, although institutions would        would constitute a reasonable               allowing its affiliates to use eligibility
have the flexibility to include such         opportunity to opt out. The proposed        information to market to consumers
disclosures in their notices. In this        examples would have provided a              without the consumer’s affirmative
respect, the proposed rule was               generally applicable safe harbor for opt-   consent, providing the consumer with
consistent with the GLBA privacy rule.       out periods of 30 days. As explained in     an opportunity to ‘‘opt in’’ or
   Industry commenters generally             the supplementary information to the        affirmatively consent to such use would
supported the Commission’s approach          proposal, although 30 days would be a       constitute a reasonable opportunity to
of treating the requirement for a            safe harbor, a person subject to this       opt out. The supplementary information
reasonable opportunity to opt out as a       requirement could decide, at its option,    clarified that the consumer’s affirmative
general test that would avoid setting a      to give consumers more than 30 days in      consent must be documented and that a
mandatory waiting period. NAAG, on           which to decide whether or not to opt       pre-selected check box would not
the other hand, believed that the            out. A shorter waiting period could be      evidence the consumer’s affirmative
Commission should set a mandatory            adequate in certain situations              consent.
waiting period of at least 45 days from      depending on the circumstances.                Some industry commenters supported
the date of mailing or other transmission       Proposed §680.22(b)(1) contained an      the proposed 30-day safe harbor and the
of the notice because consumers may be       example of a reasonable opportunity to      examples illustrating the safe harbor.
ill, away from home, or otherwise            opt out when the notice was provided        Other industry commenters, however,
unable to respond to correspondence          by mail. Proposed § 680.22(b)(2)            expressed concern that the 30-day safe
promptly.                                    contained an example of a reasonable        harbor would become the mandatory
   Industry commenters generally             opportunity to opt out when the notice      minimum waiting period in virtually all
supported the Commission’s decision          was provided by electronic means. The       cases, particularly because of the risk of
not to require the disclosure of how long    proposed examples were consistent           civil liability. For this reason, some
a consumer would have to respond to          with examples used in the GLBA              industry commenters objected to the use
the opt-out notice before eligibility        privacy rule.                               of examples altogether and urged that
information could be used to make or            Proposed § 680.22(b)(3) contained an     the Commission delete the proposed
send solicitations to the consumer.          example of a reasonable opportunity to      examples. Other industry commenters
Consumer groups believed that                opt out where, in a transaction             asked the Commission to include only
consumers should be told how long they       conducted electronically, the consumer      the examples from the GLBA.
have to respond to the notice before         was required to decide, as a necessary         Consumer groups believed that the
eligibility information could be used by     part of proceeding with the transaction,    safe harbor should be 45 days, rather
affiliates to make or send solicitations     whether or not to opt out before            than 30 days. These commenters
and that they may exercise their right to    completing the transaction, so long as      believed that 45 days was necessary in
opt out at any time.                         the institution provided a simple           part to account for the time consumed
   The Commission has renumbered the         process at the Internet Web site that the   in mail deliveries and in part to avoid
section addressing a reasonable              consumer could use at that time to opt      penalizing consumers who are away
opportunity to opt out as § 680.24 in the    out. In this example, the opt-out notice    from home for vacation or illness.
final rule and revised it. Section           would automatically be provided to the         Regarding the specific examples, a
680.24(a) of the final rule retains the      consumer, such as through a non-            few commenters objected to the
approach of construing the requirement       bypassable link to an intermediate Web      example in proposed § 680.22(b)(2),
for a reasonable opportunity to opt out      page, or ‘‘speedbump.’’ The consumer        stating that the acknowledgment of
as a general test that avoids setting a      would be given a choice of either opting    receipt requirement would be
mandatory waiting period in all cases.       out or not opting out at that time          inconsistent with the Electronic
Given the variety of circumstances in        through a simple process conducted at       Signatures in Global and National
which a reasonable opportunity to opt        the Web site. For example, the              Commerce Act (E-Sign Act). One of
              Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations                      61447

these commenters believed this              opt out by electronic means and divided       boxes: one that allows consumers to
requirement amounted to an opt-in for       it into two subparts in the final rule to     indicate that they want to opt out and
electronic notices. Several commenters      illustrate the different means of             one that allows consumers to indicate
believed that the example in proposed       delivering an electronic notice. The          that they do not want to opt out.
§ 680.22(b)(3) for requesting the           example illustrates that for notices            In the final rule, the Commission has
consumer to opt out as a necessary step     provided electronically, such as by           retained the example of including the
in proceeding with an electronic            posting the notice at an Internet Web         opt-out notice in a privacy notice in
transaction should not be limited to        site at which the consumer has obtained       § 680.24(b)(5) as consistent with the
electronic transactions, but should be      a product or service, a reasonable            statutory requirement that the
expanded to apply to all transaction        opportunity to opt out would include          Commission consider methods for
methods. A number of commenters             giving the consumer 30 days after the         coordinating and combining notices.
believed that the example in proposed       consumer acknowledges receipt of the          The Commission has deleted the
§ 680.22(b)(5) should either be deleted     electronic notice to opt out by any           example of providing an opt-in as a
or, alternatively, should not refer to      reasonable means. The acknowledgment          form of opting out as unnecessary and
‘‘affirmative’’ consent. These              of receipt aspect of this example is          confusing.
commenters noted that the example in        consistent with an example in the GLBA        Section 680.25 Reasonable and Simple
proposed § 680.22(b)(4) allowed a           privacy regulation. The example also          Methods of Opting Out
person to satisfy the reasonable            illustrates that for notices provided by e-
opportunity standard by permitting the      mail to a consumer who had agreed to             Section 680.23 of the proposal set
consumer to exercise the opt-out in the     receive disclosures by e-mail from the        forth reasonable and simple methods of
same manner and giving the consumer         person sending the notice, a reasonable       opting out. This section generally
the same amount of time to exercise the     opportunity to opt out would include          tracked the examples of reasonable opt-
opt-out as provided in the GLBA             giving the consumer 30 days after the e-      out means from § 313.7(a)(2)(ii) of the
privacy notice and that the GLBA rule       mail is sent to elect to opt out by any       GLBA privacy regulation with certain
did not require ‘‘affirmative’’ consent.    reasonable means. The Commission              revisions to give effect to Congress’
   The Commission has renumbered the        does not believe that consumer                mandate that methods of opting out be
examples of a reasonable opportunity to     acknowledgment is necessary where the         simple. For instance, proposed
opt out as § 680.24(b) in the final rule,   consumer has agreed to receive                § 680.23(a)(2) referred to including a
and revised them as discussed below.        disclosures by e-mail.                        self-addressed envelope with the reply
The Commission believes the examples           The Commission has determined that         form and opt-out notice. The
are helpful in illustrating what            the electronic delivery of affiliate          Commission also contemplated that a
constitutes a reasonable opportunity to     marketing opt-out notices does not            toll-free telephone number would be
opt out.                                    require consumer consent in accordance        adequately designed and staffed to
   The generally applicable 30-day safe     with the E-Sign Act because neither           enable consumers to opt out in a single
harbor is retained in the final rule. The   section 624 of the FCRA nor this final        phone call.
Commission believes that providing a        rule requires that the notice be provided        Proposed § 680.23(b) set forth
generally applicable safe harbor of 30      in writing. Thus, the Commission does         methods of opting out that are not
days is helpful because it affords          not believe that the acknowledgment of        reasonable and simple, such as
certainty to entities that choose to        receipt trigger is beyond the scope of        requiring the consumer to write a letter
follow the 30-day waiting period.           their interpretive authority. Persons that    to the institution or to call or write to
Although 30 days is a safe harbor in all    provide affiliate marketing opt-out           obtain an opt-out form rather than
cases, a person providing an opt-out        notices under this part electronically        including it with the notice. This
notice may decide, at its option, to give   may do so pursuant to the agreement of        section generally tracked the examples
consumers more than 30 days in which        the consumer, as specified in this rule,      of unreasonable opt-out means from
to decide whether or not to opt out. A      or in accordance with the requirements        § 313.7(a)(2)(iii) of the GLBA privacy
shorter waiting period could be             of the E-Sign Act.                            rule. In addition, the proposal contained
adequate in certain situations,                The Commission believes that the           an example of a consumer who agrees
depending on the circumstances, in          example of a consumer who is required         to receive the opt-out notice in
accordance with the general test for a      to opt out as a necessary part of             electronic form only, such as by
reasonable opportunity to opt out. The      proceeding with the transaction should        electronic mail or by using a process at
use of examples and a 30-day safe           not be limited to electronic transactions.    a Web site. Such a consumer should not
harbor is consistent with the approach      However, rather than revising the             be required to opt out solely by
followed in the GLBA privacy rule.          electronic transactions example, the          telephone or paper mail.
However, the Commission believes that       Commission has retained the electronic           Many industry commenters asked the
the examples in this rule should differ     transactions example in § 680.24(b)(3)        Commission to clarify that the examples
to some extent from the examples in the     and added a new example for in-person         are not the only ways to comply with
GLBA privacy rule because the affiliate     transactions in § 680.24(b)(4). Together,     the rule. These commenters believed
marketing opt-out requires a one-time,      these examples illustrate that an             that, as drafted, the proposal could be
not an annual, notice. Further, the         abbreviated opt-out period is                 interpreted as an exclusive rule, rather
affiliate marketing notice may, but need    appropriate when the consumer is given        than as examples. These commenters
not, be included in the GLBA privacy        a ‘‘yes’’ or ‘‘no’’ choice and is not         asked the Commission to make clear in
notice.                                     permitted to proceed with the                 the final rule that the methods set out
   In the final rule, the Commission has    transaction unless the consumer makes         in the rule are examples and do not
retained the example of a reasonable        a choice. For in-person transactions,         exclude other reasonable and simple
opportunity to opt out by mail with         consumers could be provided a form            methods of opting out. A few industry
revisions for clarity. Commenters had       with a question that requires the             commenters believed that the final rule
no specific objections to this example.     consumer to write a ‘‘yes’’ or ‘‘no’’ to      should not include any examples of
   The Commission has revised the           indicate their opt-out preference or a        methods of opting out because of the
example of a reasonable opportunity to      form that contains two blank check            potential for civil liability.
61448         Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations

   Many industry commenters also urged       a general rule and examples in separate        through posting at an Internet Web site,
the Commission to use the same               paragraphs (a) and (b) respectively. This      to opt out solely by paper mail or by
examples used in the GLBA privacy            revision clarifies that the specific           visiting a different Web site without
rule. These commenters did not believe       methods identified in the rule are             providing a link to that site.
that Congress would allow coordinated        examples, not an exhaustive list of              Section 680.25(c) has been added to
and consolidated notices, but require        permissible methods.                           clarify that each consumer may be
different methods of opting out. For            The Commission believes that                required to opt out through a specific
instance, these commenters                   including examples in § 680.25(b) is           means, as long as that means is
recommended deleting the reference to        helpful. However, the Commission               reasonable and simple for that
a self-addressed envelope because there      declines to adopt the GLBA examples            consumer. This new section
is no such reference in the GLBA             without change. Section 624 of the             corresponds to a provision in the GLBA
privacy rule. One commenter noted that       FCRA requires the Commission to                privacy rule, 16 CFR § 313.7(a)(2)(iv).
its experience with self-addressed           ensure that the consumer is given
envelopes was negative because               reasonable and simple methods of               Section 680.26 Delivery of Opt-out
consumers often used the envelopes for       opting out. The GLBA did not require           Notices
other purposes resulting in misdirected      simple methods of opting out. The              General rule and examples
communications. Industry commenters          Commission believes that the methods
                                                                                               Section 680.24 of the proposal
also objected to requiring institutions to   of opting out can, in some instances, be
                                                                                            addressed the delivery of opt-out
provide an electronic opt-out                simpler than some of the reasonable
                                                                                            notices. Proposed § 680.24(a) provided
mechanism to a consumer who agrees to        methods illustrated in the GLBA privacy
                                                                                            that an institution would have to deliver
receive an opt-out notice in electronic      rule. To effectuate the statutory mandate
                                                                                            an opt-out notice so that each consumer
form. These commenters believed this         that consumers have simple methods of
                                                                                            could reasonably be expected to receive
example was unjustified and                  opting out, the Commission has
                                                                                            actual notice. This standard would not
inconsistent with the GLBA privacy           modified, for purposes of this
                                                                                            have required actual notice. The
rule. Commenters also indicated that         rulemaking, some of the examples of
                                                                                            supplementary information to the
some institutions may not have the           reasonable methods of opting out that
                                             were used in the GLBA privacy                  proposal also clarified that, for opt-out
technical capabilities to accept
                                             regulation.                                    notices delivered electronically, the
electronic opt-outs. Several commenters
                                                Most of the examples in the final rule      notices could be delivered either in
recommended that the Commission
                                             are substantially similar to those in          accordance with the electronic
clarify that an institution is not
                                             § 680.23(a) and (b) of the proposal with       disclosure provisions in this part or in
obligated to honor opt-outs submitted
                                             revisions for clarity. The example in          accordance with the E-Sign Act. For
through means other than those
                                             § 680.25(b)(1)(ii) has been revised to         example, the institution could e-mail its
designated by the institution.
   Consumer groups generally believed        reflect the Commission’s understanding         notice to a consumer who agreed to the
that the proposal appropriately tracked      that the reply form and self-addressed         electronic delivery of information or
the examples in the GLBA privacy             envelope would be included together            provide the notice on its Internet Web
regulation with revisions to give effect     with the opt-out notice. As in the             site for a consumer who obtained a
to Congress’ mandate that methods of         proposal, the Commission contemplates          product or service electronically from
opting out be simple. These commenters       that a toll-free telephone number that         that Web site. Commenters generally
believed, however, that the proposal         consumers may call to opt out, as              supported the reasonable expectation of
was inadequate because it provided           illustrated by the example in                  actual notice standard.
examples instead of requiring the use of     § 680.25(b)(1)(iv), would be adequately           Proposed § 680.24(b) provided
certain methods. These commenters            designed and staffed to enable                 examples to illustrate what would
believed that the final rule should          consumers to opt out in a single phone         constitute delivery of an opt-out notice.
require self-addressed envelopes and         call. In setting up a toll-free telephone      Commenters expressed concern about
require that toll-free numbers be            number that consumers may use to               the electronic notice example in
adequately designed and staffed to           exercise their opt-out rights, institutions    proposed paragraph (b)(1)(iii).
enable consumers to opt out in a single      should minimize extraneous messages            Consumer groups objected to this
phone call. According to these               directed to consumers who are in the           example by pointing to a growing trend
commenters, inadequate and poorly            process of opting out.                         in which companies require consumers
trained staff has been a shortcoming of         One new example in § 680.25(b)(1)(v)        to agree to electronic notices if they
the GLBA opt-out procedures. These           illustrates that reasonable and simple         conduct business on an Internet Web
commenters also recommended that             methods include allowing consumers to          site. These commenters believed that
consumers be given the opportunity to        exercise all of their opt-out rights           there was nothing to ensure that the
opt out by a simple check box on             described in a consolidated opt-out            notice would be clearly accessible to
payment coupons. Finally, these              notice that includes the GLBA privacy,         consumers on the Web site. These
commenters asked the Commission to           FCRA affiliate sharing, and FCRA               commenters believed that, at a
clarify that the federal standard is a       affiliate marketing opt-outs, by a single      minimum, the Commission should
floor and that if the notice is combined     method, such as by calling a single toll-      require the notice to be sent to the
with other choices made available under      free telephone number. This example            consumer’s e-mail address, rather than
other federal and state laws, the most       furthers the statutory directive to the        posted to an Internet Web site, where
consumer-friendly means for opting out       Commission to ensure that notices and          the consumer has expressly opted in to
should apply.                                disclosures may be coordinated and             the electronic delivery of notices. Some
   The Commission has renumbered the         consolidated. The final rule also              industry commenters objected to the
section addressing reasonable and            clarifies the example renumbered as            acknowledgment of receipt requirement
simple methods of opting out as              § 680.25(b)(2)(iii) to illustrate that it is   in this example as inconsistent with the
§ 680.25 in the final rule, and revised it   not reasonable or simple to require a          E-Sign Act. One of these commenters
as discussed below. The Commission           consumer who receives the opt-out              urged the Commission to explicitly
has restructured this section to include     notice in electronic form, such as             incorporate the E-Sign Act into the
             Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations                       61449

requirements for delivering opt-out         privacy rule and seems appropriate           be given to the consumer either a
notices.                                    where the notice is posted at an Internet    reasonable period of time before the
   The Commission has renumbered the        Web site.                                    expiration of the opt-out period, or any
general rule regarding delivery of opt-       The Commission declines to require         time after the expiration of the opt-out
out notices as § 680.26(a) in the final     the delivery of electronic notices by e-     period but before solicitations that
rule and divided the examples into          mail. Concerns about the security of e-      would have been prohibited by the
positive and negative examples in           mail, especially phishing, make it           expired opt-out are made to the
§§ 680.26(b) and (c) respectively. In the   inappropriate to require e-mail as the       consumer. The Commission did not
final rule, the Commission has retained     only permissible form of electronic          propose to set a fixed time for what
the reasonable expectation of actual        delivery for opt-out notices.                would constitute a reasonable period of
notice standard, which does not require                                                  time before the expiration of the opt-out
                                            Section 680 .27 Renewal of Opt-out
the institution to determine if the                                                      period to send an extension notice
consumer actually received the opt-out         Proposed § 680.26 described the           because a reasonable period of time may
notice. For example, mailing a printed      procedures for extension of an opt-out.      depend upon the amount of time
copy of the opt-out notice to the last      Proposed § 680.26(a) provided that a         afforded to the consumer for a
known mailing address of a consumer         receiving affiliate could not make or        reasonable opportunity to opt out, the
satisfies the requirement to deliver the    send solicitations to the consumer after     amount of time necessary to process
opt-out notice so that there is a           the expiration of the opt-out period         opt-outs, and other factors. Proposed
reasonable expectation that the             based on eligibility information it          § 680.26(e) made clear that sending an
consumer has received actual notice.        receives or has received from an             extension notice to the consumer before
   The Commission has revised some of       affiliate, unless the person responsible     the expiration of the opt-out period does
the examples of a reasonable                for providing the initial opt-out notice,    not shorten the five-year opt-out period.
expectation of actual notice for            or its successor, has given the consumer        A few industry commenters objected
electronic notices. The new example in      an extension notice and a reasonable         to the fact that the contents of the
§ 680.26(b)(3) illustrates that the         opportunity to extend the opt-out, and       extension notice would differ from the
reasonable expectation of actual notice     the consumer does not extend the opt-        contents of the initial notice by
standard would be satisfied by              out. Thus, if an extension notice was not    requiring that the extension notice
providing notice by e-mail to a             provided to the consumer, the opt-out        inform the consumer that the
consumer who has agreed to receive          period would continue indefinitely.          consumer’s prior opt-out has expired or
disclosures by e-mail from the person       Proposed § 680.26(b) provided that each      is about to expire, as applicable, and
providing the notice. The Commission        opt-out extension would have to be           that the consumer must opt out again to
reiterates that an acknowledgment of        effective for a period of at least five      keep the opt-out election in force. These
receipt is not necessary for a notice       years.                                       commenters argued that the added
provided by e-mail to such a consumer.         Proposed § 680.26(c) addressed the        disclosure requirement would be costly
Conversely, the example in                  contents of a clear, conspicuous, and        and provide little benefit to consumers.
§ 680.26(c)(2) illustrates that the         concise extension notice and provided        One commenter maintained that the
reasonable expectation of actual notice     flexibility to comply in either of two       added disclosure requirement would
standard would not be satisfied by          ways. Under one approach, the notice         make it difficult, if not impossible, to
providing notice by e-mail to a             would disclose the same items required       combine the extension notice with the
consumer who has not agreed to receive      to be disclosed in the initial opt-out       GLBA privacy notice. Commenters also
disclosures by e-mail from the person       notice, along with a statement               maintained that the language of the
providing the notice.                       explaining that the consumer’s prior         statute, particularly section 624(a)(1),
   The revised example in § 680.26(b)(4)    opt-out has expired or is about to expire,   contemplates that the same notice
illustrates that for a consumer who         as applicable, and that if the consumer      would satisfy the requirements for the
obtains a product or service                wishes to keep the consumer’s opt-out        initial and extension notices. Consumer
electronically, the reasonable              election in force, the consumer must opt     groups and NAAG recommended that
expectation standard would be satisfied     out again. Under a second approach, the      the Commission define a ‘‘reasonable
by posting the notice on the Internet       extension notice would provide: (1) that     opportunity’’ to extend the opt-out as a
Web site at which the consumer obtains      the consumer previously elected to limit     period of at least 45 days before shared
such product or services and requiring      an affiliate from using eligibility          eligibility information is used to make
the consumer to acknowledge receipt of      information about the consumer that it       solicitations to the consumer.
the notice. Conversely, the new example     obtains from the communicating                  The Commission has renumbered the
in § 680.26(c)(3) illustrates that the      affiliate to make or send solicitations to   provisions addressing the extension or
reasonable expectation standard would       the consumer; (2) that the consumer’s        renewal of opt-outs as § 680.27 in the
not be satisfied by posting the notice on   election has expired or is about to          final rule and revised them. For
the Internet Web site without requiring     expire, as applicable; (3) that the          purposes of clarity, the final rule refers
the consumer to acknowledge receipt of      consumer may elect to extend the             to a ‘‘renewal’’ notice, rather than an
the notice. As discussed above, the         consumer’s previous election; and (4) a      ‘‘extension’’ notice.
Commission has determined that the          reasonable and simple method for the            Section 680.27(a) contains the general
electronic delivery of opt-out notices      consumer to opt out. The                     rule, which provides that after the opt-
does not require consumer consent in        supplementary information to the             out period expires, a person may not
accordance with the E-Sign Act because      proposal clarified that institutions         make solicitations based on eligibility
neither section 624 of the FCRA nor the     would not need to provide extension          information received from an affiliate to
final rule require that the notice be       notices if they treated the consumer’s       a consumer who previously opted out
provided in writing. Thus, requiring an     opt-out election as valid in perpetuity,     unless the consumer has been given a
acknowledgment of receipt is within the     unless revoked by the consumer.              compliant renewal notice and a
scope of the Commission’s interpretive         Proposed § 680.26(d) addressed the        reasonable opportunity to opt out, and
authority. This example is also             timing of the extension notice and           the consumer does not renew the opt-
consistent with an example in the GLBA      provided that an extension notice could      out. This section also clarifies that a
61450         Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations

person can make solicitations to a              The Commission is not persuaded             expiration of the opt-out period may
consumer after expiration of the opt-out     that the additional content of the             confuse consumers. The Commission
period if one of the exceptions in           renewal notice will have any impact on         will deem a renewal notice provided on
§ 680.21(c) applies.                         the ability to combine the opt-out notice      or with the last annual privacy notice
   The Commission declines to set a          with the GLBA privacy notice. Even if          required by the GLBA privacy
fixed minimum time period for a              the language of the renewal notice were        provisions sent to the consumer before
reasonable opportunity to renew the          identical to the initial notice, it still      the expiration of the opt-out period to
opt-out as unnecessary and inconsistent      could be difficult to avoid honoring a         be reasonable in all cases.
with the approach taken elsewhere in         consumer’s opt-out in perpetuity if the          Proposed § 680.26(e) regarding the
this rule and in the GLBA privacy rule.      affiliate marketing opt-out notice is          effect of an extension or renewal notice
The provision regarding the duration of      incorporated into the GLBA privacy             on the existing opt-out period elicited
the renewed opt-out elicited no              notice. Privacy notices typically state        no comment. The Commission has
comment, and it has been retained in         that if a consumer has previously opted        renumbered this provision as
§ 680.27(a)(2) of the final rule.            out, it is not necessary for the consumer      § 680.27(d) in the final rule, and
   Section 680.27(a)(3) identifies the       to opt out again. This statement would         adopted it with technical changes.
affiliates who may provide the renewal       be accurate with respect to the affiliate
notice. A renewal notice must be                                                            Section 680.28 Effective Date,
                                             marketing opt-out only if the
provided either by the affiliate that                                                       Compliance Date, and Prospective
                                             consumer’s opt-out is honored in
provided the previous opt-out notice or                                                     Application
                                             perpetuity. It would not be accurate,
its successor, or as part of a joint         however, if the affiliate marketing opt-       Effective Date and Compliance Date
renewal notice from two or more              out is effective only for a limited period
members of an affiliated group of                                                              Consistent with the requirements of
                                             of time, subject to renewal by the             section 624 of the FCRA, the proposal
companies, or their successors, that         consumer at intervals of five years or
jointly provided the previous opt-out                                                       indicated that the final rule would
                                             longer. Thus, if the affiliate marketing       become effective six months after the
notice. This rule balances the               opt-out notice was consolidated with
Commission’s goal of ensuring that the                                                      date on which it would be issued in
                                             GLBA privacy notices and was effective         final form. The Commission requested
notice is provided by an entity known        for a limited period of time, the privacy
to the consumer with a recognition that                                                     comment on whether there was any
                                             notices would have to be modified to           need to delay the mandatory
flexibility is required to account for       make clear that statements that the
changes in the corporate structure that                                                     compliance date beyond the effective
                                             consumer does not have to opt out again        date specifically to permit institutions
may result from mergers and                  do not apply to the affiliate marketing
acquisitions, corporate name changes,                                                       to incorporate the affiliate marketing
                                             renewal notice. Therefore, the                 opt-out notice into their next annual
and other events.
                                             Commission does not believe that               GLBA privacy notice.
   The Commission recognizes that the
                                             requiring a renewal notice to contain             Most industry commenters believed
content of the extension or renewal
notice differs from the content of the       information not included in an initial         that the Commission should delay the
initial notice. Nothing in the statute,      notice will significantly affect the ability   mandatory compliance date until some
however, requires identical content in       to incorporate the affiliate marketing         time after the effective date of the final
the initial and renewal notices.             opt-out notice into GLBA privacy               rule. These commenters suggested
Moreover, the statute requires the           notices because consolidation of the           various periods for delaying the
Commission to provide specific               notices is most likely to occur when the       mandatory compliance date ranging
guidance to ensure that opt-out notices      affiliate marketing opt-out will be            from three months to more than 24
are clear, conspicuous, and concise. It is   honored in perpetuity. Entities that           months. Common recommendations
unreasonable to expect consumers,            prefer not to provide renewal notices          were for a delayed mandatory
upon receipt of a renewal notice, to         may do so by honoring the consumer’s           compliance date of six, 12, or 18
remember that they previously opted          opt-out in perpetuity. The contents of         months.
out five years ago (or longer) or, even if   the renewal notice are adopted in                 Some of these commenters suggested
they do remember, to know that they          § 680.27(b) with revisions that                a two-part mandatory compliance date
must opt out again in order to renew         incorporate the changes to § 680.23, as        consisting of a delayed mandatory
their opt-out decision. Therefore, to        discussed above. Section 680.27(b) of          compliance date of either three or six
ensure that the renewal notice is            the final rule also omits the alternative      months for new accounts or for general
meaningful, the Commission concludes         contents set forth in the proposal, which      application and a special mandatory
that the renewal notice must remind the      the Commission now believes would be           compliance date for institutions that
consumer that he or she previously           unnecessarily duplicative.                     intend to consolidate their affiliate
opted out, inform the consumer that the         Proposed § 680.26(d) addressed the          marketing opt-out notice with their
opt-out has expired or is about to expire,   timing of the extension or renewal             GLBA privacy notice. Under this special
and advise the consumer that he or she       notice and elicited no comment. The            mandatory compliance date, institutions
must opt out again to renew the opt-out      Commission has renumbered this                 would have to comply at the time they
and continue to limit solicitations from     provision as § 680.27(c) in the final rule     provide their next GLBA privacy notice
affiliates. Under the final rule, the        and adopted it with technical revisions.       following the effective date of the final
renewal notice can state that ‘‘the          As explained in the supplementary              rule or a date certain, whichever is
consumer’s election has expired or is        information to the proposal, providing         earlier.
about to expire.’’ The Commission has        the renewal notice a reasonable period            Industry commenters believed that a
deleted the words ‘‘as applicable’’ so       of time before the expiration of the opt-      delayed mandatory compliance date
that the notice does not have to be          out period would enable institutions to        was necessary in order to make
tailored to differentiate consumers for      begin marketing to consumers who do            significant changes to business practices
whom the election ‘‘has expired’’ from       not renew their opt-out upon expiration        and procedures, to implement necessary
those for whom the election ‘‘is about to    of the opt-out period. But giving a            operational and systems changes, and to
expire.’’                                    renewal notice too far in advance of the       design and provide opt-out notices.
              Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations                                61451

Industry commenters also noted that          language or reflect the intent of            apply to the new or updated eligibility
many institutions would like to send the     Congress. These commenters believed          information.
affiliate marketing opt-out notice with      that the final rule should grandfather all
                                                                                          Appendix C
their initial or annual GLBA privacy         information received by any financial
notices, both to minimize costs and to       institution or affiliate in a holding           Appendix A of the proposal contained
avoid consumer confusion. These              company prior to the mandatory               model forms to illustrate by way of
commenters noted that many large             compliance date, and not grandfather         example how institutions could comply
institutions provide GLBA privacy            only that information received prior to      with the notice and opt-out
notices on a rolling basis and that a        the mandatory compliance date by a           requirements of section 624 and the
delayed mandatory compliance date            person that intends to use the               proposed regulations. Appendix A
was necessary to enable institutions to      information to make solicitations to the     included three proposed model forms.
introduce the affiliate marketing opt-out    consumer. Some of these commenters           Model Form A-1 was a proposed form
notice into this cycle. One large            recommended, in the alternative, that        of an initial opt-out notice. Model Form
institution estimated that its first-year    the Commission clarify that any              A-2 was a proposed form of an
compliance costs would increase by a         information placed into a common             extension notice. Model Form A-3 was
minimum of $660,000 if it was not able       database by an affiliate should be           a proposed form that institutions may
to consolidate the affiliate marketing       deemed to have been provided to an           use if they offer consumers a broader
opt-out notice with its GLBA privacy         affiliated person if the Commission opts     right to opt out of marketing than is
notice. A few industry commenters            to retain the prospective application        required by law.
believed that Congress knew that an          provision as proposed. These                    The proposed model forms were
effective date is not necessarily the same   commenters argued that without such a        designed to convey the necessary
as a mandatory compliance date because                                                    information to consumers as simply as
                                             clarification, affiliated companies would
banking regulations commonly have                                                         possible. The Commission tested the
                                             have to undertake the costly
effective dates and mandatory                                                             proposed model forms using two widely
                                             deconstruction of existing databases to
compliance dates that differ.                                                             available readability tests, the Flesch
                                             ensure compliance.
   Consumer groups and NAAG believed                                                      reading ease test and the Flesch-Kincaid
                                                In the final rule, the provision          grade level test, each of which generates
that the effective date of the final rule
                                             addressing prospective application has       a readability score.14 Proposed Model
should be the mandatory compliance
                                             been renumbered as § 680.28(c), and          Form A-1 had a Flesch reading ease
date. These commenters believed that
institutions have had time to prepare for    revised. The Commission continues to         score of 53.7 and a Flesch-Kincaid grade
compliance since the FACT Act became         believe that the better interpretation of    level score of 9.9. Proposed Model Form
law in December 2003. Consumer               the non-retroactivity provision is that it   A-2 had a Flesch reading ease score of
groups believed that if institutions need    is tied to receipt of eligibility            57.5 and a Flesch-Kincaid grade level
more time to comply, affiliates should       information by a person that intends to      score of 9.6. Proposed Model Form A-
cease using eligibility information to       use the information to make                  3 had a Flesch reading ease score of 69.9
make solicitations until the notice and      solicitations to the consumer. The final     and a Flesch-Kincaid grade level score
opportunity to opt out is provided.          rule clarifies, however, that a person is    of 6.7.
   The final rule will become effective      deemed to receive eligibility                   Commenters generally supported the
January 1, 2008. Consistent with the         information from its affiliate when the      proposed model forms. As noted above,
statute’s directive that the Commission      affiliate places that information in a       some commenters had concerns about
ensure that notices may be consolidated      common database where it is accessible       the content of the initial and renewal
and coordinated, the mandatory               by the person, even if the person has not    notices. Some industry commenters
compliance date is delayed to give           accessed or used that information as of      expressed concern about requiring the
institutions a reasonable amount of time     the compliance date. For example,            notice to specify the applicable time
to include the affiliate marketing opt-out   assume that an affiliate obtains             period and the consumer’s right to
notice with their initial and annual         eligibility information about a consumer     renew the election once the opt-out
privacy notices. Accordingly,                as a result of having a pre-existing         expires. Industry commenters also
compliance with this part is required        business relationship with that              suggested revising the language of the
not later than October 1, 2008. The          consumer. The affiliate places that          notice to refer either to ‘‘financial’’
Commission believes that delaying the        information into a common database           information or ‘‘credit eligibility’’
mandatory compliance date for                that is accessible to other affiliates       information for clarity. One commenter
approximately one year will give all         before the mandatory compliance date.        suggested deleting the examples of the
institutions adequate time to develop        The final rule does not apply to that        types of information shared with
and distribute opt-out notices and give      information, and other affiliates may use    affiliates. Another commenter suggested
most institutions sufficient time to         that information for marketing to the        rephrasing the model forms in the
develop and distribute consolidated          consumer. On the other hand, if the          passive voice. One commenter
notices if they choose to do so.             affiliate obtains eligibility information    encouraged the Commission to clarify
                                             about the consumer before the                that use of the model forms provides a
Prospective Application                      mandatory compliance date, but does          safe harbor. Another commenter
  Proposed § 680.20(e) provided that         not either place that information into a     believed that the optional third
the provisions of this part would not        common database that is accessible to        paragraph of Model Form A-1 should be
apply to eligibility information that was    other affiliates or otherwise provide that   revised, or an alternate paragraph
received by a receiving affiliate prior to   information to another affiliate before      added, to provide guidance on how to
the date on which compliance with            the mandatory compliance date, the
these regulations would be required.         final rule will apply to that eligibility      14 The Flesch reading ease test generates a score

Some industry commenters supported           information. Further, if the database is     between zero and 100, where the higher score
                                                                                          correlates with improved readability. The Flesch-
this provision. Other industry               updated with new eligibility                 Kincaid grade level test generates a numerical
commenters, however, believed that the       information after the mandatory              assessment of the grade-level at which the text is
proposed rule did not track the statutory    compliance date, the final rule will         written.
61452         Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations

clearly disclose to consumers that the       form, use of the model privacy form will                 as the requirements of the regulation are
opt-out may not limit the sharing of         satisfy the requirement to provide an                    met. For example, although several of
contact information and other                initial affiliate marketing opt-out notice.              the model forms use five years as the
information that does not meet the              The final rule includes five model                    duration of the opt-out period, an opt-
definition of ‘‘consumer report.’’           forms. Model Form C-1 is the model for                   out period of longer than five years may
   Consumer groups and NAAG                  an initial notice provided by a single                   be used and the longer time period
commended the Commission for                 affiliate. Model Form C-2 is the model                   substituted in the opt-out notices.
reporting the Flesch reading ease score      for an initial notice provided as a joint                Alternatively, the consumer’s opt-out
and Flesch-Kincaid grade-level score for     notice from two or more affiliates.                      may be treated as effective in perpetuity
each of the model forms. These               Model Form C-3 is the model for a                        and, if so, the opt-out notice should
commenters urged the Commission to           renewal notice provided by a single                      omit any reference to the limited
modify the proposed rule to require that     affiliate. Model Form C-4 is the model                   duration of the opt-out period or the
any person that does not use the model       for a renewal notice provided as a joint                 right to renew the opt-out.
forms must provide a notice that             notice from two or more affiliates.                         The Commission has revised the
achieves readability scores at least as      Model Form C-5 is a model for a                          model forms so that the disclosure
good as the scores for the model forms.      voluntary ‘‘no marketing’’ opt-out.                      regarding the duration of the opt-out
Consumer groups also suggested adding           The Commission tested each of the                     may state that the opt-out applies either
a sentence about providing the form          model forms using two widely-available                   for a fixed number of years or ‘‘at least
annually to mitigate consumer                readability tests, the Flesch reading ease               5 years.’’ This revision permits
confusion. These commenters also             test and the Flesch-Kincaid grade level                  institutions that use a longer opt-out
urged the Commission to adopt a short-       test. In conducting these tests, the                     period or that subsequently extend their
form notice.                                 Commission eliminated parenthetical                      opt-out period to rely on the model
   The Commission has revised and            text wherever possible, included the                     language. The model form also contains
expanded the number of model forms to        optional clauses, and substituted the                    a reference to the consumer’s right to
reflect changes made to the final rule. In   names of fictional entities, for example,                revoke an opt-out. In addition, language
addition, the model forms have been          ABC Lender or the ABC group of                           has been added to the model forms to
renumbered as Appendix C to Part 698.        companies, as the names of the relevant                  clarify that, with an opt-out of limited
The Commission believes that model           entities to ensure that the test results                 duration, a consumer does not have to
forms are helpful for entities that give     were not skewed by the inclusion of                      opt out again until a renewal notice is
notices and beneficial for consumers.        descriptive text that would not be                       sent.
The model forms are provided as stand-       included in actual opt-out notices. The
alone documents. However, some                                                                        V. Paperwork Reduction Act
                                             results of these tests are summarized for
persons may choose to combine the opt-       each of the model forms in Table 1                          In accordance with the Paperwork
out notice with other consumer               below.                                                   Reduction Act (PRA), as amended, 44
disclosures, such as the GLBA privacy           Although the Commission encourages                    U.S.C. 3501-3521, the Commission staff
notice. Creating a consolidated model        the use of these tests as well as other                  has submitted the final rule and a PRA
form is beyond the scope of this             types of consumer testing in designing                   Supporting Statement to the Office of
rulemaking, but, as discussed above,         opt-out notices, the Commission                          Management and Budget (OMB) for
institutions can combine the affiliate       declines to adopt a prescriptive                         review. As required by the PRA, the
marketing opt-out notice with other          approach that requires notices to                        staff’s annual burden estimates take into
disclosures, including the GLBA privacy      achieve certain scores under the Flesch                  account the burden associated with the
notice.                                      reading ease or Flesch-Kincaid grade                     rule’s reporting, recordkeeping, and
   On March 31, 2006, the FTC, Board,                                                                 third-party disclosure requirements.15
                                             level tests. Some variation in readability
FDIC, NCUA, OCC, and SEC released a                                                                      As set forth in the notice of proposed
                                             scores is inevitable and may be caused
report entitled Evolution of a Prototype                                                              rulemaking (NPRM), the final rule
                                             by minor differences in the language of
Financial Privacy Notice, prepared by                                                                 likewise imposes disclosure
                                             the notice, such as the name of the
Kleimann Communication Group, Inc.,                                                                   requirements on certain affiliated
                                             entity providing the notice or the types
summarizing research that led to the                                                                  companies subject to the Commission’s
                                             of information that may be used for
development of a prototype short-form                                                                 jurisdiction. The final rule provides that
                                             marketing.
GLBA privacy notice. That prototype                                                                   if a company communicates certain
included an affiliate marketing opt-out                                                               information about a consumer
notice. The prototype assumed that the                             TABLE 1                            (‘‘eligibility information’’) to an affiliate,
notice would be provided by the                                                             Flesch-   the affiliate may not use that
affiliate that is sharing eligibility                                              Flesch             information to send solicitations to the
                                                                                            Kincaid
information. The Commission believes                                              reading
                                                                                    ease     grade    consumer unless the consumer is given
that providing model forms in this rule                                                      level    notice and an opportunity and a simple
                                                                                   score
for stand-alone opt-out notices that may                                                     score
                                                                                                      method to opt out of such use of the
be used in a more diverse set of              Model   Form   C-1   ............     50.2      11.5    information and the consumer does not
circumstances than a model privacy            Model   Form   C-2   ............     51.7      11.5    opt out. The final rule also contains
form is appropriate and consistent with       Model   Form   C-3   ............     54.6       9.7    model disclosures that companies may
efforts to develop a model privacy form.      Model   Form   C-4   ............     54.2       9.8    use to comply with the final rule’s
On March 29, 2007, the FTC, Board,            Model   Form   C-5   ............     81.3       3.8    requirements.
FDIC, NCUA, OCC, OTS, SEC, and the                                                                       The staff’s estimates reflect the
Commodity Futures Trading                       As noted in the proposal, use of the                  average amount of burden incurred by
Commission published for public              model forms is not mandatory.                            entities subject to the final rule, taking
comment in the Federal Register (72 FR       However, appropriate use of the model                    into account that some entities may not
14940) a model privacy form that             forms provides a safe harbor. There is                   share eligibility information with
includes the affiliate marketing opt-out.    flexibility to use or not use the model
Once such a notice is published in final     forms, or to modify the forms, so long                    15   44 U.S.C. 3502(2); 5 CFR 1320.3(b)
                  Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations                                                 61453

affiliates for the purpose of making                    cumulatively.17 In preparation for this                 entities will give notice only once
solicitations and other entities may                    publication, staff has revisited those                  during a three-year clearance period.
choose to rely on the exceptions to the                 estimates, refining its analysis. There                 Thus, averaged annually over that span,
final rule’s notice and opt-out                         are no program changes from the NPRM                    estimated burden for non-GLBA entities
requirements. In either of these cases,                 that impact staff’s prior PRA analysis.                 is 1,089,000 hours and $30,749,000 in
the notice would not be required, and                   Rather, staff has adjusted its previously               labor costs, rounded.21
the resulting burden would be zero.                     stated estimate of burden hours and the                    As stated in the NPRM, the number of
Moreover, the burden estimates take                     number of non-GLBA entities that may                    GLBA entities under the Commission’s
into account that a number of non-                      send the proposed affiliate marketing                   jurisdiction is 3,350.22 As before, staff
GLBA companies currently provide                        notice based on: (1) a refined numerical                estimates that GLBA entities would
notices and opt-out choices voluntarily                 estimate of non-GLBA entities with                      incur 6 hours of paperwork burden
as a service to their customers. Since                  affiliates under the Commission’s                       during the first year of the clearance
these entities already have systems and                 jurisdiction and thus subject to the final              period,23 given that the final rule
processes in place for providing the                    rule; and (2) recognition that an entity                provides model notices. This would
notice and implementing the opt-out,                    need only give a notice once during the                 thus approximate 20,000 hours,
the resulting PRA burden under the                      three-year clearance period. Thus, staff                cumulatively, during the first year of a
final rule for such entities would be de                now estimates the total average annual                  three-year OMB clearance period. Labor
minimis.                                                burden hours and labor costs over the                   costs, as adjusted, would approximate
   The staff’s estimates assume a higher                three-year clearance period to be                       $716,000.24 Allowing for increased
burden will be incurred during the first                1,105,000 and $31,302,000, respectively,                familiarity with procedure, the
year of the OMB clearance period with                   as further explained below.                             paperwork burden in ensuing years
a lesser burden incurred during the                        The staff estimates that approximately               would decline, with GLBA entities each
subsequent two years, since the notice                  1.17 million (rounded) non-GLBA                         incurring 4 hours of annual burden25
is only required to be given once for a                 entities under the jurisdiction of the                  during the remaining two years of the
minimum period of at least five (5)                     Commission have affiliates and would                    clearance period. At an estimated 3,350
years. The staff did not estimate the                   be affected by the final rule.18 As in the              GLBA entities under the Commission’s
burden for preparing and distributing                   NPRM, staff further estimates that there                jurisdiction, this amounts to 13,400
extension notices by persons that limit                 are an average of 5 businesses per family               hours and $472,000 in labor costs26 in
the duration of the opt-out time period                 or affiliated relationship, and that the                each of the ensuing two years. Thus,
because the minimum effective time                      affiliated entities will choose to send a               averaged over the three-year clearance
period for the opt-out is five years while              joint notice, as permitted by the final                 period, the estimated annual burden for
the relevant PRA clearance period is no                 rule. Thus an estimated 233,400                         GLBA entities is 15,600 hours and
more than three years. Moreover,                        (rounded) non-GLBA entities may send                    $533,000 in labor costs.
entities providing the notice and opt-out               the new affiliate marketing notice. The                    Combining estimates for GLBA and
may elect to have a longer opt-out                      staff estimates that the cumulative                     non-GLBA entities, total average annual
period, for example, ten years, or to                   burden per non-GLBA entity will total                   burden over a prospective three-year
make the opt-out election effective in                  14 hours19 over a three-year PRA                        clearance period, is approximately
perpetuity.                                             clearance cycle, not per year, as                       1,105,000 hours and $31,302,000 in
   The staff’s labor cost estimates take                previously set forth in the NPRM. Based                 labor costs, rounded. As noted in the
into account: managerial and                            on updated population data, the                         NPRM, GLBA entities are already
professional time for reviewing internal                Commission staff estimates that the total               providing notices to their customers so
policies and determining compliance                     burden for non-GLBA entities during                     there are no new capital or other non-
obligations; technical time for creating                the prospective three-year clearance                    labor costs, as this notice may be
the notice and opt-out, in either paper                 period would be approximately                           consolidated into their current notices.
or electronic form; incremental training;               3,268,000 hours and associated labor                    For non-GLBA entities, the final rule
and clerical time for disseminating the                 costs would be approximately                            provides for simple and concise model
notice and opt-out.16 In addition, the                  $92,247,000.20 However, non-GLBA                        forms that institutions may use to
staff’s cost estimates presume that the
availability of model disclosures and                     17  69 FR at 33335.                                   based on the BLS Employment Cost Index. The
                                                                                                                dollar total above is derived from the estimated 7
opt-out notices will simplify the                         18  This estimate is derived from an analysis of a
                                                                                                                hours of managerial labor at $34.21 per hour; 2
compliance review and implementation                    database of U.S. businesses based on SIC codes for
                                                                                                                hours of technical labor at $29.80 per hour; and 5
                                                        businesses that market goods or services to
processes, thereby significantly                        consumers, which included the following
                                                                                                                hours of clerical labor at $14.44 per hour—a
reducing the cost of compliance.                                                                                combined $371.27—multiplied by 1.06426 (a
                                                        industries: transportation services; communication;
                                                                                                                combined $395.13)—for the estimated 233,400+
Further, the final rule gives entities                  electric, gas, and sanitary services; retail trade;
                                                                                                                non-GLBA business families subject to the Rule.
flexibility to provide a single joint                   finance, insurance, and real estate; and services         21 3,268,000 hours ÷ 3 = 1,089,000; $92,247,000
                                                        (excluding business services and engineering,
notice on behalf of some or all of its                  management services). This estimate excludes            ÷ 3 = $30,749,000.
affiliates, which should further reduce                 businesses not subject to the Commission’s
                                                                                                                  22See 69 FR at 33334.
                                                                                                                  23 This estimate is based on 5 hours of managerial
the cost of compliance.                                 jurisdiction as well as businesses that do not use
                                                        data or information subject to the rule.                time and 1 hour of technical time to execute the
   The Commission staff previously                                                                              notice. As in the NPRM, staff excludes clerical time
                                                           19 This estimate, as in the NPRM, is based on a
estimated in the NPRM that the total                    projected apportionment of 7 hours managerial           from the estimate because the notice likely would
paperwork burden for the proposed rule                  time, 2 hours technical time, and 5 hours of clerical   be combined with existing GLBA notices.
over a standard three-year OMB grant of                 assistance.                                               24 3,350 GLBA entities x ($34.21 x 5 hours) +

clearance would be 2,715,000 hours and                     20 The hourly rates are based on average annual      ($29.80 x 1 hour)] x 1.06426 wage inflation
                                                        Bureau of Labor Statistics National Compensation        multiplier. See note 20.
$63,144,000 in labor costs for both                                                                               25 This estimate, carried over from the NPRM, is
                                                        Survey data, June 2005 (with 2005 as the most
GLBA and non-GLBA entities,                             recent whole year information available at the BLS      based on 3 hours of managerial time and 1 hour of
                                                        Web site). http://www.bls.gov/ncs/ocs/sp/               technical time.
   16 No clerical time was included in staff’s burden   ncbl0832.pdf (Table 1.1), and further adjusted by a       26 3,350 GLBA entities x [($34.21 x 3 hours) +

analysis for GLBA entities as the notice would          multiplier of 1.06426, a compounding for                ($29.80 x 1 hour)] x 1.06426 wage inflation
likely be combined with existing GLBA notices.          approximate wage inflation for 2005 and 2006,           multiplier. See note 20.
61454           Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations

comply. Thus, any capital or non-labor            business entities, legal and managerial       GLBA and FCRA notice and opt-out
costs associated with compliance for              review, employee training, and business       requirements, to meet the requirements
these entities are negligible.                    process changes. As an example, the           of this final rule. The Commission also
   The Commission staff recognized that           MBA stated that one of its members, a         believes that use of an average amount
the amount of time needed for any                 medium-sized mortgage banker,                 of time is appropriate because some
particular entity subject to the proposed         estimated that it would cost at least $5      persons may not share eligibility
requirements may be higher or lower,              million in direct costs to modify its data    information with affiliates for the
but believes that the above stated                warehouse computer system to                  purpose of making solicitations or may
averages are reasonable estimates. In             accommodate the opt-outs and to send          choose to rely on the exceptions to the
arriving at these estimates, staff                disclosures to all of its customers, plus     notice and opt-out requirement. In
determined that many entities do not              hundreds of thousands of dollars for          either of these cases, the notice would
have affiliates and are not covered by            indirect costs. The MBA stated that the       not be required, and the resulting
section 214 of the FACT Act or the rule.          NPRM did not consider the significant         burden would be zero.
Entities that have affiliates may choose          clerical effort needed to comply with            The Commission also believes that the
not to engage in the sharing of certain           the then-proposed rule. The MBA also          availability of model disclosures and
information or marketing to consumers             stated that companies that currently          opt-out notices may significantly reduce
covered by section 214 of the FACT Act            provide GLBA privacy and FCRA                 the cost of compliance. In addition, as
or the rule. Moreover, to minimize the            affiliate sharing opt-out notices would       stated earlier the final rule gives persons
compliance costs and burdens for                  still incur significant costs because: (1)    considerable flexibility to provide a
entities, particularly small businesses,          in contrast to the GLBA, the new opt-out      joint opt-out notice on behalf of
the final rule contains model                     right applies to the sharing of               multiple affiliates and to define the
disclosures and opt-out notices that may          information with affiliates; and (2) in       scope and the duration of the opt-out.
be used to satisfy the statutory                  contrast to the FCRA, the new opt-out         This flexibility may reduce the cost of
requirements. Finally, the final rule             right applies to transaction and              compliance by allowing covered
gives covered entities flexibility to             experience information. Finally, the          persons to make choices that are most
satisfy the notice and opt-out                    MBA stated that compliance with the           appropriate for their business.
requirement by sending the consumer a             then-proposed rule would be                   Moreover, because the notice is only
free-standing opt-out notice or by                particularly difficult because software       required to be given once for a
adding the opt-out notice to the privacy          modifications and employee training           minimum period of at least five years,
notices already provided to consumers,            will be required to ensure that both          the Commission’s estimates assume a
such as those provided in accordance              bank and mortgage company employees           higher burden will be incurred during
with the provisions of Title V of the             have access to consumers’ transaction         the first year of the OMB clearance
GLBA. For covered persons that choose             and experience information in order to        period with a lesser burden incurred
to prepare a free-standing opt-out                service their accounts, but they are          during the subsequent two years.
notice, the time necessary to prepare it          prevented from using such information         VI. Final Regulatory Flexibility
would be minimal because those                    to solicit business from consumers who        Analysis
persons could simply copy the model               have exercised their opt-out rights.             The Regulatory Flexibility Act
disclosure, making minor adjustments                 The Commission staff continues to          (‘‘RFA’’), 5 U.S.C. 601-612, requires that
as indicated by it. Similarly, for covered        believe that its estimate of the average      the Commission provide an Initial
persons that choose to incorporate the            amount of time to prepare and distribute      Regulatory Flexibility Analysis
opt-out notice into their GLBA privacy            an initial notice to consumers is             (‘‘IRFA’’) with a proposed rule and a
notices, the time necessary to integrate          reasonable. As a preliminary matter, the      Final Regulatory Flexibility Analysis
them would be minimal.                            Commission staff notes that the PRA           (‘‘FRFA’’), with the final rule, unless the
   In response to the PRA section of the          does not require an estimate all of the       Commission certifies that the rule will
NPRM, the Commission received one                 costs that may be associated with             not have a significant economic impact
comment, from the Mortgage Bankers                implementing the opt-out, but only the        on a substantial number of small
Association (‘‘MBA’’). The MBA                    information collection costs. The annual      business entities. See 5 U.S.C. 603-605.
expressed concern that the NPRM’s                 burden estimates take into account the        For the majority of entities subject to the
burden estimates convey a misleading              requisite burden associated with the          final rule, a small business entity is
impression of the cost of compliance              reporting, recordkeeping, and third-          defined by the Small Business
with the final rule.27 The MBA’s                  party disclosure requirements,                Administration as one whose average
principal objection was that the cost             including any incremental training costs      annual receipts do not exceed $6
estimates assume that the major cost is           that may be associated with                   million or that has fewer than 500
sending the disclosures, rather than              implementing the final rule’s                 employees. See http://www.sba.gov/
processing any opt-out requests and               requirements. Further, the                    size/indextableofsize.html.
ensuring that solicitations are not sent          Commission’s staff estimates are over-
to consumers who have opted out or                inclusive with respect to the number of       1. Statement of the need for, and
have not yet had a reasonable                     entities that must comply with the rule.      objectives of, the final rule.
opportunity to do so. The MBA added               As stated earlier, many entities                 The FACT Act amends the FCRA and
that the NPRM’s cost estimates did not            voluntarily provide consumers with the        was enacted, in part, for the purpose of
reflect the costs associated with                 right to opt out of advertising by            allowing consumers to limit the use of
building compliance systems, such as              affiliates, and thus will not be subject to   eligibility information received from an
costs attributed to significant database          the final rule’s requirements and             affiliate to make solicitations to the
programming, coordination across                  attendant costs. The Commission               consumer. Section 214 of the FACT Act
  27 The MBA’s comment is available at http://
                                                  continues to believe that institutions        generally prohibits a person from using
www.ftc.gov/os/comments/affiliate_marketing/04-
                                                  should be able to modify existing             certain information received from an
13481-0033.pdf. No other comments relating to     database systems and employee training        affiliate to make a solicitation for
paperwork burden were received.                   programs, used to comply with the             marketing purposes to a consumer,
              Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations                            61455

unless the consumer is given notice and      See http://www.sba.gov/size/                   with to provide the notice. The
an opportunity and simple method to          indextableofsize.html.                         Commission chose the alternative that
opt out of the making of such                   Although all small entities covered by      requires the affiliate with the
solicitations. Section 214 requires the      the Commission’s rule potentially could        relationship with the consumer to
Commission, together with the other          be subject to the final rule, small entities   provide the notice. See section IV,
agencies, to issue regulations               that do not have affiliates would not be       supra. This alternative is not expected
implementing the section in                  subject to the final rule. In addition,        to have a significant impact on small
consultation and coordination with each      small entities that have affiliates may        businesses since, as stated earlier, many
other. The Commission received no            choose not to engage in activities that        small businesses are not likely to be
comments on the reasons for the              would require compliance with the final        subject to the rule or they may opt not
proposed rule. The Commission is             rule. For example, small entities may          to engage in practices that would subject
adopting the final rule to implement         choose not to share eligibility                them to the rule’s requirements.
§ 214 of the FACT Act. The                   information with their affiliates for the
                                             purpose of making solicitations.               List of Subjects
SUPPLEMENTARY INFORMATION above
contains information on the objectives       Alternatively, small entities and their        16 CFR Part 680
of the final rule.                           affiliates may structure their marketing
                                                                                              Consumer reports, Consumer
                                             activities in a way that does not trigger
2. Summary of issues raised by                                                              reporting agencies, Credit, Fair Credit
                                             the requirement to comply with the
comments in response to the initial                                                         Reporting Act, Trade practices.
                                             final rule, such as by relying upon the
regulatory flexibility analysis.             exceptions to the notice requirement           16 CFR Part 698
  In accordance with Section 3(a) of the     contained in the final rule.                     Consumer reports, Consumer
RFA, the Commission conducted an             4. Recordkeeping, reporting, and other         reporting agencies, Credit, Fair Credit
initial regulatory flexibility analysis in   compliance requirements.                       Reporting Act, Trade practices.
connection with the proposed rule. One                                                      ■ The Federal Trade Commission
                                                The final rule requires small entities
commenter, the Mortgage Bankers                                                             amends chapter I, title 16, Code of
                                             to provide opt-out notices and renewal
Association (MBA), believed that the                                                        Federal Regulations, as follows:
                                             notices to consumers in certain
Commission and the other agencies had                                                       ■ 1. Add new part 680 as follows:
                                             circumstances, as discussed in the
underestimated the costs of compliance.
                                             SUPPLEMENTARY INFORMATION above. The           PART 680—AFFILIATE MARKETING
The issues raised by the MBA are
                                             final rule also requires small entities to
described in the Paperwork Reduction                                                        Sec.
                                             implement consumers’ opt-out
Act section above. The MBA’s concerns                                                       680.1 Purpose and scope.
                                             elections. The final rule contains no
applied equally to small entities and                                                       680.2 Examples.
                                             requirement to report information to the
larger entities. The MBA did not raise                                                      680.3 Definitions.
                                             Commission.                                    680.4–680.20 [Reserved]
any issues unique to small entities.            Small entities that have affiliates and     680.21	 Affiliate marketing opt-out and
3. Description and estimate of small         that share eligibility information with             exceptions.
entities affected by the final rule.         those affiliates for purposes of making        680.22 Scope and duration of opt-out.
                                             solicitations may be subject to the rule.      680.23	 Contents of opt-out notice;
   The affiliate marketing rule, which       Small entities that do not have affiliates,         consolidated and equivalent notices.
closely tracks the language of section       do not share eligibility information with      680.24 Reasonable opportunity to opt out.
214 of the FACT ACT, would apply to          their affiliates for marketing purposes,       680.25	 Reasonable and simple methods of
‘‘[a]ny person that receives from another    use shared eligibility information for              opting out.
person related to it by common                                                              680.26 Delivery of opt-out notices
                                             purposes of making solicitations only in       680.27 Renewal of opt-out.
ownership or affiliated by corporate         accordance with one of the exceptions          680.28	 Effective date, compliance date, and
control a communication of information       set forth in the final rule, or structure           prospective application.
that would be a consumer report, but for     their marketing activities to eliminate
clauses (i), (ii), and (iii) of section                                                       Authority: Sec. 214(b), Pub. L. 108-159; 15
                                             the need to provide an opt-out notice          U.S.C. 1681s-3
603(d)(2)(A).’’ In short, section 214        would not be subject to the final rule.
applies to any entity that (1) is under      The professional skills necessary for          § 680.1 Purpose and scope.
the Commission’s jurisdiction pursuant       preparation of the opt-out notice                 (a) Purpose. The purpose of this part
to the FCRA and (2) receives consumer        include compliance and/or privacy              is to implement section 214 of the Fair
report information from an affiliate and     specialists and computer programmers.          and Accu-rate Credit Transactions Act
uses that information to make a                                                             of 2003, which (by adding section 624
marketing solicitation to the consumer.      5. Steps taken to minimize the economic
                                             impact on small entities.                      to Fair Credit Reporting Act) regulates
The entities covered by the                                                                 the use, for marketing solicitation
Commission’s rule would include non-            The Commission has attempted to             purposes, of consumer information
bank lenders, insurers, retailers,           minimize the economic impact on small          provided by persons affiliated with the
landlords, mortgage brokers, automobile      entities by adopting a rule that is            person making the solicitation.
dealers, telecommunication firms, and        consistent with the other federal                 (b) Scope. This part applies to any
any other business that shares eligibility   agencies and choosing alternatives that        person over which the Federal Trade
information with its affiliates. It is not   provide for joint notices and model            Commission has jurisdiction that uses
readily feasible to determine a precise      forms small institutions may, but are not      information from its affiliates for the
number of small entities that will be        required to, use to minimize the cost of       purpose of marketing solicitations, or
subject to the rule, but it is not likely    compliance.                                    provides information to its affiliates for
that many of the entities covered by this       Some commenters suggested an                that purpose.
new rule are small as defined by the         alternative that would allow any
Small Business Administration since          affiliate to provide the opt-out notice to     § 680.2 Examples.
most of the entities with affiliates are     consumers instead of requiring the               The examples in this part are not
likely to be above the $6 million level.     affiliate the consumer has a relationship      exclusive. Compliance with an example,
61456           Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations

to the extent applicable, constitutes         which would be a consumer report if           existing business relationship with the
compliance with this part. Examples in        the exclusions from the definition of         consumer and can use eligibility
a paragraph illustrate only the issue         ‘‘consumer report’’ in section                information it receives from its affiliates
described in the paragraph and do not         603(d)(2)(A) of the Act did not apply.        to make solicitations to the consumer
illustrate any other issue that may arise     Eligibility information does not include      about its products or services for 18
in this part.                                 aggregate or blind data that does not         months after the date it sells the loan,
                                              contain personal identifiers such as          and the investor has a pre-existing
§ 680.3   Definitions.                        account numbers, names, or addresses.         business relationship with the consumer
   As used in this part:                         (i) Person. The term ‘‘person’’ means      upon purchasing the loan. If, however,
   (a) Act. The term ‘‘Act’’ means the        any individual, partnership,                  the mortgage lender sells a fractional
Fair Credit Reporting Act (15 U.S.C.          corporation, trust, estate, cooperative,      interest in the consumer’s loan to an
1681 et seq.).                                association, government or                    investor but also retains an ownership
   (b) Affiliate. The term ‘‘affiliate’’      governmental subdivision or agency, or        interest in the loan, the mortgage lender
means any company that is related by          other entity.                                 continues to have a pre-existing
common ownership or common                       (j) Pre-existing business relationship—    business relationship with the
corporate control with another                (1) In general. The term ‘‘pre-existing       consumer, but the investor does not
company.                                      business relationship’’ means a               have a pre-existing business
   (c) Clear and conspicuous. The term        relationship between a person, or a           relationship with the consumer. If the
‘‘clear and conspicuous’’ means               person’s licensed agent, and a consumer       mortgage lender retains ownership of
reasonably under-standable and                based on—                                     the loan, but sells ownership of the
designed to call attention to the nature         (i) A financial contract between the       servicing rights to the consumer’s loan,
and significance of the information           person and the consumer which is in           the mortgage lender continues to have a
presented.                                    force on the date on which the                pre-existing business relationship with
   (d) Common ownership or common             consumer is sent a solicitation covered       the consumer. The purchaser of the
corporate control. The term ‘‘common          by this part;                                 servicing rights also has a pre-existing
ownership or common corporate                    (ii) The purchase, rental, or lease by
                                                                                            business relationship with the consumer
control’’ means a relationship between        the consumer of the persons’ goods or
                                                                                            as of the date it purchases ownership of
two companies under which:                    services, or a financial transaction
                                                                                            the servicing rights, but only if it
   (1) One company has, with respect to       (including holding an active account or
                                                                                            collects payments from or otherwise
the other company:                            a policy in force or having another
                                                                                            deals directly with the consumer on a
   (i) Ownership, control, or the power       continuing relationship) between the
                                                                                            continuing basis.
to vote 25 percent or more of the             consumer and the person, during the 18-
                                                                                               (iv) If a consumer applies to a creditor
outstanding shares of any class of voting     month period immediately preceding
                                                                                            for a product or service that it offers, but
security of a company, directly or            the date on which the consumer is sent
                                                                                            does not obtain a product or service
indirectly, or acting through one or          a solicitation covered by this part; or
                                                 (iii) An inquiry or application by the     from or enter into a financial contract or
more other persons;
   (ii) Control in any manner over the        consumer regarding a product or service       transaction with the creditor, the
election of a majority of the directors,      offered by that person during the three-      creditor has a pre-existing business
trustees, or general partners (or             month period immediately preceding            relationship with the consumer and can
individuals exercising similar functions)     the date on which the consumer is sent        therefore use eligibility information it
of a company; or                              a solicitation covered by this part.          receives from an affiliate to make
   (iii) The power to exercise, directly or      (2) Examples of pre-existing business      solicitations to the consumer about its
indirectly, a controlling influence over      relationships. (i) If a consumer has an       products or services for three months
the management or policies of a               existing loan account with a creditor,        after the date of the application.
company, as the Commission                    the creditor has a pre-existing business         (v) If a consumer makes a telephone
determines; or                                relationship with the consumer and can        inquiry to a creditor about its products
   (2) Any person has, with respect to        use eligibility information it receives       or services and provides contact
both companies, a relationship                from its affiliates to make solicitations     information to the creditor, but does not
described in paragraphs (d)(1)(i) through     to the consumer about its products or         obtain a product or service from or enter
(d)(1)(iii) of this section.                  services.                                     into a financial contract or transaction
   (e) Company. The term ‘‘company’’             (ii) If a consumer obtained a mortgage     with the creditor, the creditor has a pre-
means any corporation, limited liability      from a mortgage lender, but refinanced        existing business relationship with the
company, business trust, general or           the mortgage loan with a different            consumer and can therefore use
limited partnership, association, or          lender when the mortgage loan came            eligibility information it receives from
similar organization.                         due, the first mortgage lender has a pre-     an affiliate to make solicitations to the
   (f) Concise—(1) In general. The term       existing business relationship with the       consumer about its products or services
‘‘concise’’ means a reasonably brief          consumer and can use eligibility              for three months after the date of the
expression or statement.                      information it receives from its affiliates   inquiry.
   (2) Combination with other required        to make solicitations to the consumer            (vi) If a consumer makes an inquiry to
disclosures. A notice required by this        about its products or services for 18         a creditor by e-mail about its products
part may be concise even if it is             months after the date the outstanding         or services, but does not obtain a
combined with other disclosures               balance of the loan is paid and the loan      product or service from or enter into a
required or authorized by federal or          is closed.                                    financial contract or transaction with
state law.                                       (iii) If a consumer obtains a mortgage,    the creditor, the creditor has a pre-
   (g) Consumer. The term ‘‘consumer’’        the mortgage lender has a pre-existing        existing business relationship with the
means an individual.                          business relationship with the                consumer and can therefore use
   (h) Eligibility information. The term      consumer. If the mortgage lender sells        eligibility information it receives from
‘‘eligibility information’’ means any         the consumer’s entire loan to an              an affiliate to make solicitations to the
information the communication of              investor, the mortgage lender has a pre-      consumer about its products or services
              Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations                           61457

for three months after the date of the            (i) Based on eligibility information      information received from its insurance
inquiry.                                       communicated to that person by its           affiliate to make solicitations to the
   (vii) If a consumer has an existing         affiliate as described in this part; and     consumer about its home equity loan
relationship with a creditor that is part         (ii) Intended to encourage the            products unless the consumer is given
of a group of affiliated companies,            consumer to purchase or obtain such          a notice and opportunity to opt out and
makes a telephone call to the                  product or service.                          the consumer does not opt out.
centralized call center for the group of          (2) Exclusion of marketing directed at       (3) Affiliates who may provide the
affiliated companies to inquire about          the general public. A solicitation does      notice. The notice required by this
products or services offered by the            not include marketing communications         paragraph (a) must be provided:
insurance affiliate, and provides contact      that are directed at the general public.        (i) By an affiliate that has or has
information to the call center, the call       For example, television, general             previously had a pre-existing business
constitutes an inquiry to the insurance        circulation magazine, and billboard          relationship with the consumer; or
affiliate that offers those products or        advertisements do not constitute                (ii) As part of a joint notice from two
services. The insurance affiliate has a        solicitations, even if those                 or more members of an affiliated group
pre-existing business relationship with        communications are intended to               of companies, provided that at least one
the consumer and can therefore use             encourage consumers to purchase              of the affiliates on the joint notice has
eligibility information it receives from       products and services from the person        or has previously had a pre-existing
its affiliated creditor to make                initiating the communications.               business relationship with the
solicitations to the consumer about its           (3) Examples of solicitations. A          consumer.
products or services for three months          solicitation would include, for example,        (b) Making solicitations—(1) In
after the date of the inquiry.                 a telemarketing call, direct mail, e-mail,   general. For purposes of this part, you
   (3) Examples where no pre-existing          or other form of marketing                   make a solicitation for marketing
business relationship is created. (i) If a     communication directed to a particular       purposes if—
consumer makes a telephone call to a           consumer that is based on eligibility           (i) You receive eligibility information
centralized call center for a group of         information received from an affiliate.      from an affiliate;
affiliated companies to inquire about the         (l) You means a person described in          (ii) You use that eligibility
consumer’s existing account with a             § 680.1(b).                                  information to do one or more of the
creditor, the call does not constitute an
                                                                                            following:
inquiry to any affiliate other than the        §§ 680.4–680.20   [Reserved]
creditor that holds the consumer’s                                                             (A) Identify the consumer or type of
account and does not establish a pre-          § 680.21 Affiliate marketing opt-out and     consumer to receive a solicitation;
existing business relationship between
                                               exceptions.                                     (B) Establish criteria used to select the
the consumer and any affiliate of the             (a) Initial notice and opt-out            consumer to receive a solicitation; or
account-holding creditor.                      requirement—(1) In general. You may             (C) Decide which of your products or
   (ii) If a consumer who has a loan           not use eligibility information about a      services to market to the consumer or
account with a creditor makes a                consumer that you receive from an            tailor your solicitation to that consumer;
telephone call to an af-filiate of the         affiliate to make a solicitation for         and
creditor to ask about the affiliate’s retail   marketing purposes to the consumer,             (iii) As a result of your use of the
locations and hours, but does not make         unless—                                      eligibility information, the consumer is
an inquiry about the affiliate’s products         (i) It is clearly and conspicuously       provided a solicitation.
or services, the call does not constitute      disclosed to the consumer in writing or,        (2) Receiving eligibility information
an inquiry and does not establish a pre-       if the consumer agrees, electronically, in   from an affiliate, including through a
existing business relationship between         a concise notice that you may use            common database. You may receive
the consumer and the affiliate. Also, the      eligibility information about that           eligibility information from an affiliate
affiliate’s capture of the consumer’s          consumer received from an affiliate to       in various ways, including when the
telephone number does not constitute           make solicitations for marketing             affiliate places that information into a
an inquiry and does not establish a pre-       purposes to the consumer;                    common database that you may access.
existing business relationship between            (ii) The consumer is provided a              (3) Receipt or use of eligibility
the consumer and the affiliate.                reasonable opportunity and a reasonable      information by your service provider.
   (iii) If a consumer makes a telephone       and simple method to ‘‘opt out,’’ or         Except as provided in paragraph (b)(5)
call to a creditor in response to an           prohibit you from using eligibility          of this section, you receive or use an
advertisement that offers a free               information to make solicitations for        affiliate’s eligibility information if a
promotional item to consumers who call         marketing purposes to the consumer;          service provider acting on your behalf
a toll-free number, but the                    and                                          (whether an affiliate or a nonaffiliated
advertisement does not indicate that              (iii) The consumer has not opted out.     third party) receives or uses that
creditor’s products or services will be           (2) Example. A consumer has a             information in the manner described in
marketed to consumers who call in              homeowner’s insurance policy with an         paragraphs (b)(1)(i) or (b)(1)(ii) of this
response, the call does not create a pre-      insurance company. The insurance             section. All relevant facts and
existing business relationship between         company furnishes eligibility                circumstances will determine whether a
the consumer and the creditor because          information about the consumer to its        person is acting as your service provider
the consumer has not made an inquiry           affiliated creditor. Based on that           when it receives or uses an affiliate’s
about a product or service offered by the      eligibility information, the creditor        eligibility information in connection
creditor, but has merely responded to an       wants to make a solicitation to the          with marketing your products and
offer for a free promotional item.             consumer about its home equity loan          services.
   (k) Solicitation—(1) In general. The        products. The creditor does not have a          (4) Use by an affiliate of its own
term ‘‘solicitation’’ means the marketing      pre-existing business relationship with      eligibility information. Unless you have
of a product or service initiated by a         the consumer and none of the other           used eligibility information that you
person to a particular consumer that           exceptions apply. The creditor is            receive from an affiliate in the manner
is—                                            prohibited from using eligibility            described in paragraph (b)(1)(ii) of this
61458         Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations

section, you do not make a solicitation       manner described in paragraph (b)(1)(ii)    information through the common
subject to this part if your affiliate:       of this section.                            database as provided in paragraph (b)(2)
   (i) Uses its own eligibility information      (ii) Writing requirements. (A) The       of this section, it did not use that
that it obtained in connection with a         requirements of paragraphs (b)(5)(i)(A)     information to identify consumers or
pre-existing business relationship it has     and (C) of this section must be set forth   establish selection criteria; instead, the
or had with the consumer to market            in a written agreement between your         creditor used its own eligibility
your products or services to the              affiliate and the service provider; and     information. Therefore, pursuant to
consumer; or                                     (B) The specific terms and conditions    paragraph (b)(4)(i) of this section, the
   (ii) Directs its service provider to use   established by your affiliate as provided   insurance company has not made a
the affiliate’s own eligibility information   in paragraph (b)(5)(i)(B) of this section   solicitation to the consumer.
that it obtained in connection with a         must be set forth in writing.                  (iv) The same facts as in the example
pre-existing business relationship it has        (6) Examples of making solicitations.    in paragraph (b)(6)(iii) of this section,
or had with the consumer to market            (i) A consumer has a loan account with      except that the creditor provides the
your products or services to the              a creditor, which is affiliated with an     insurance company’s criteria to the
consumer, and you do not communicate          insurance company. The insurance            creditor’s service provider and directs
directly with the service provider            company receives eligibility information    the service provider to use the creditor’s
regarding that use.                           about the consumer from the creditor.       eligibility information to identify
   (5) Use of eligibility information by a    The insurance company uses that             creditor consumers who meet the
service provider. (i) In general. You do      eligibility information to identify the     criteria and to send the insurance
not make a solicitation subject to this       consumer to receive a solicitation about    company’s marketing materials to those
part if a service provider (including an      insurance products, and, as a result, the   consumers. The insurance company
affiliated or third-party service provider    insurance company provides a                does not communicate directly with the
that maintains or accesses a common           solicitation to the consumer about its      service provider regarding the use of the
database that you may access) receives        insurance products. Pursuant to             creditor’s information to market its
eligibility information from your             paragraph (b)(1) of this section, the       products to the creditor’s consumers.
affiliate that your affiliate obtained in     insurance company has made a                Pursuant to paragraph (b)(4)(ii) of this
connection with a pre-existing business       solicitation to the consumer.               section, the insurance company has not
relationship it has or had with the              (ii) The same facts as in the example    made a solicitation to the consumer.
consumer and uses that eligibility            in paragraph (b)(6)(i) of this section,        (v) An affiliated group of companies
information to market your products or        except that after using the eligibility     includes a creditor, an insurance
services to the consumer, so long as—         information to identify the consumer to     company, and a service provider. Each
   (A) Your affiliate controls access to      receive a solicitation about insurance      affiliate in the group places information
and use of its eligibility information by     products, the insurance company asks        about its consumers into a common
the service provider (including the right     the creditor to send the solicitation to    database. The service provider has
to establish the specific terms and           the consumer and the creditor does so.      access to all information in the common
conditions under which the service            Pursuant to paragraph (b)(1) of this        database. The creditor controls access to
provider may use such information to          section, the insurance company has          and use of its eligibility information by
market your products or services);            made a solicitation to the consumer         the service provider. This control is set
   (B) Your affiliate establishes specific    because it used eligibility information     forth in a written agreement between the
terms and conditions under which the          about the consumer that it received from    creditor and the service provider. The
service provider may access and use the       an affiliate to identify the consumer to    written agreement also requires the
affiliate’s eligibility information to        receive a solicitation about its products   service provider to establish reasonable
market your products and services (or         or services, and, as a result, a            policies and procedures designed to
those of affiliates generally) to the         solicitation was provided to the            ensure that the service provider uses the
consumer, such as the identity of the         consumer about the insurance                creditor’s eligibility information in
affiliated companies whose products or        company’s products.                         accordance with specific terms and
services may be marketed to the                  (iii) The same facts as in the example   conditions established by the creditor
consumer by the service provider, the         in paragraph (b)(6)(i) of this section,     relating to the marketing of the products
types of products or services of affiliated   except that eligibility information about   and services of all affiliates, including
companies that may be marketed, and           consumers that have loan accounts with      the insurance company. In a separate
the number of times the consumer may          the creditor is placed into a common        written communication, the creditor
receive marketing materials, and              database that all members of the            specifies the terms and conditions
periodically evaluates the service            affiliated group of companies may           under which the service provider may
provider’s compliance with those terms        independently access and use. Without       use the creditor’s eligibility information
and conditions;                               using the creditor’s eligibility            to market the insurance company’s
   (C) Your affiliate requires the service    information, the insurance company          products and services to the creditor’s
provider to implement reasonable              develops selection criteria and provides    consumers. The specific terms and
policies and procedures designed to           those criteria, marketing materials, and    conditions are: a list of affiliated
ensure that the service provider uses the     related instructions to the creditor. The   companies (including the insurance
affiliate’s eligibility information in        creditor reviews eligibility information    company) whose products or services
accordance with the terms and                 about its own consumers using the           may be marketed to the creditor’s
conditions established by the affiliate       selection criteria provided by the          consumers by the service provider; the
relating to the marketing of your             insurance company to determine which        specific products or types of products
products or services;                         consumers should receive the insurance      that may be marketed to the creditor’s
   (D) Your affiliate is identified on or     company’s marketing materials and           consumers by the service provider; the
with the marketing materials provided         sends marketing materials about the         categories of eligibility information that
to the consumer; and                          insurance company’s products to those       may be used by the service provider in
   (E) You do not directly use your           consumers. Even though the insurance        marketing products or services to the
affiliate’s eligibility information in the    company has received eligibility            creditor’s consumers; the types or
              Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations                         61459

categories of the creditor’s consumers to     the current employment relationship or       consumer has been given an opt-out
whom the service provider may market          status of the individual as a participant    notice, but has not elected to opt out.
products or services of creditor              or beneficiary of an employee benefit        The creditor asks a service provider to
affiliates; the number and/or types of        plan;                                        send the solicitation to the consumer on
marketing communications that the                (3) To perform services on behalf of      its behalf. The service provider may
service provider may send to the              an affiliate, except that this paragraph     send the solicitation on behalf of the
creditor’s consumers; and the length of       shall not be construed as permitting you     creditor because, as a result of the
time during which the service provider        to send solicitations on behalf of an        consumer’s not opting out, the creditor
may market the prod-ucts or services of       affiliate if the affiliate would not be      is permitted to make the solicitation.
the creditor’s affiliates to its consumers.   permitted to send the solicitation as a         (3) Examples of consumer-initiated
The creditor periodically evaluates the       result of the election of the consumer to    communications. (i) A consumer who
service provider’s compliance with            opt out under this part;                     has a consumer loan account with a
these terms and conditions. The                  (4) In response to a communication        finance company initiates a
insurance company asks the service            about your products or services initiated    communication with the creditor’s
provider to market insurance products         by the consumer;                             mortgage lending affiliate to request
to certain consumers who have loan               (5) In response to an authorization or    information about a mortgage. The
accounts with the creditor. Without           request by the consumer to receive           mortgage lender affiliate may use
using the creditor’s eligibility              solicitations; or                            eligibility information about the
information, the insurance company               (6) If your compliance with this part     consumer it obtains from the finance
develops selection criteria and provides      would prevent you from complying             company or any other affiliate to make
those criteria, marketing materials, and      with any provision of State insurance        solicitations regarding mortgage
related instructions to the service           laws pertaining to unfair discrimination     products in response to the consumer-
provider. The service provider uses the       in any State in which you are lawfully       initiated communication.
creditor’s eligibility information from       doing business.                                 (ii) A consumer who has a loan
the common database to identify the              (d) Examples of exceptions—(1)            account with a creditor contacts the
creditor’s consumers to whom insurance        Example of the pre-existing business         creditor to request information about
products will be marketed. When the           relationship exception. A consumer has       how to save and invest for a child’s
insurance company’s marketing                 a loan account with a creditor. The          college education without specifying the
materials are provided to the identified      consumer also has a relationship with        type of product in which the consumer
consumers, the name of the creditor is        the creditor’s securities affiliate for      may be interested. Information about a
displayed on the insurance marketing          management of the consumer’s                 range of different products or services
materials, an introductory letter that        securities portfolio. The creditor           offered by the creditor and one or more
accompanies the marketing materials,          receives eligibility information about       affiliates of the creditor may be
an account statement that accompanies         the consumer from its securities affiliate   responsive to that communication. Such
the marketing materials, or the envelope      and uses that information to make a          products or services may include the
containing the marketing materials. The       solicitation to the consumer about the       following: mutual funds offered by the
re-quirements of paragraph (b)(5) of this     creditor’s wealth management services.       creditor’s mutual fund affil-iate; section
section have been satisfied, and the          The creditor may make this solicitation      529 plans offered by the creditor, its
insurance company has not made a              even if the consumer has not been given      mutual fund affiliate, or another
solicitation to the consumer.                 a notice and opportunity to opt out          securities affiliate; or trust services
   (vi) The same facts as in the example      because the creditor has a pre-existing      offered by a different creditor in the
in paragraph (b)(6)(v) of this section,       business relationship with the               affiliated group. Any affiliate offering
except that the terms and conditions          consumer.                                    investment products or services that
permit the service provider to use the           (2) Examples of service provider          would be responsive to the consumer’s
creditor’s eligibility information to         exception. (i) A consumer has an             request for information about saving and
market the products and services of           insurance policy issued by an insurance      investing for a child’s college education
other affiliates to the creditor’s            company. The insurance company               may use eligibility information to make
consumers whenever the service                furnishes eligibility information about      solicitations to the consumer in
provider deems it appropriate to do so.       the consumer to an affiliated creditor.      response to this communication.
The service provider uses the creditor’s      Based on that eligibility information, the      (iii) A credit card issuer makes a
eligibility information in accordance         creditor wants to make a solicitation to     marketing call to the consumer without
with the discretion af-forded to it by the    the consumer about its credit products.      using eligibility information received
terms and conditions. Because the terms       The creditor does not have a pre-            from an affiliate. The issuer leaves a
and conditions are not specific, the          existing business relationship with the      voice-mail message that invites the
requirements of paragraph (b)(5) of this      consumer and none of the other               consumer to call a toll-free number to
section have not been satisfied.              exceptions in para-graph (c) of this         apply for the issuer’s credit card. If the
   (c) Exceptions. The provisions of this     section apply. The consumer has been         consumer calls the toll-free number to
part do not apply to you if you use           given an opt-out notice and has elected      inquire about the credit card, the call is
eligibility information that you receive      to opt out of receiving such                 a consumer-initiated communication
from an affiliate:                            solicitations. The creditor asks a service   about a product or service and the credit
   (1) To make a solicitation for             provider to send the solicitation to the     card issuer may now use eligibility
marketing purposes to a consumer with         consumer on its behalf. The service          information it receives from its affiliates
whom you have a pre-existing business         provider may not send the solicitation       to make solicitations to the consumer.
relationship;                                 on behalf of the creditor because, as a         (iv) A consumer calls a creditor to ask
   (2) To facilitate communications to an     result of the consumer’s opt-out             about retail locations and hours, but
individual for whose benefit you              election, the creditor is not permitted to   does not request information about
provide employee benefit or other             make the solicitation.                       products or services. The creditor may
services pursuant to a contract with an          (ii) The same facts as in paragraph       not use eligibility information it
employer related to and arising out of        (d)(2)(i) of this section, except the        receives from an affiliate to make
61460        Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations

solicitations to the consumer about its     authorized or requested solicitations            (3) No continuing relationship—(i) In
products or services because the            from the store’s affiliates.                  general. If there is no continuing
consumer-initiated communication does          (iv) The terms and conditions of a         relationship between a consumer and
not relate to the creditor’s products or    credit account agreement contain              you or your affiliate, and you or your
services. Thus, the use of eligibility      preprinted boilerplate language stating       affiliate obtain eligibility information
information received from an affiliate      that by applying to open an account the       about a consumer in connection with a
would not be responsive to the              consumer authorizes or requests to            transaction with the consumer, such as
communication and the exception does        receive solicitations from the creditor’s     an isolated transaction or a credit
not apply.                                  affiliates. The consumer has not              application that is denied, an opt-out
   (v) A consumer calls a creditor to ask   authorized or requested solicitations         notice provided to the consumer only
about office locations and hours. The       from the creditor’s affiliates.               applies to eligibility information
customer service representative asks the       (e) Relation to affiliate-sharing notice   obtained in connection with that
consumer if there is a particular product   and opt-out. Nothing in this part limits      transaction.
or service about which the consumer is      the responsibility of a person to comply         (ii) Examples of isolated transactions.
seeking information. The consumer           with the notice and opt-out provisions        An isolated transaction occurs if—
responds that the consumer wants to         of section 603(d)(2)(A)(iii) of the Act          (A) The consumer uses your or your
stop in and find out about second           where applicable.                             affiliate’s ATM to withdraw cash from
mortgage loans. The customer service                                                      an account at a financial institution; or
                                            § 680.22 Scope and duration of opt-out.          (B) You or your affiliate sells the
representative offers to provide that         (a) Scope of opt-out—(1) In general.        consumer a money order, airline tickets,
information by telephone and mail           Except as otherwise provided in this          travel insurance, or traveler’s checks in
additional information and application      section, the consumer’s election to opt       isolated transactions.
materials to the consumer. The              out prohibits any affiliate covered by the       (4) Menu of alternatives. A consumer
consumer agrees and provides or             opt-out notice from using eligibility         may be given the opportunity to choose
confirms contact information for receipt    information received from another             from a menu of alternatives when
of the materials to be mailed. The          affiliate as described in the notice to       electing to prohibit solicitations, such as
creditor may use eligibility information    make solicitations to the consumer.           by electing to prohibit solicitations from
it receives from an affiliate to make          (2) Continuing relationship—(i) In         certain types of affiliates covered by the
solicitations to the consumer about         general. If the consumer establishes a        opt-out notice but not other types of
mortgage loan products because such         continuing relationship with you or           affiliates covered by the notice, electing
solicitations respond to the consumer-      your affiliate, an opt-out notice may         to prohibit solicitations based on certain
initiated communication about products      apply to eligibility information obtained     types of eligibility information but not
or services.                                in connection with—                           other types of eligibility information, or
   (4) Examples of consumer                    (A) A single continuing relationship       electing to prohibit solicitations by
authorization or request for                or multiple continuing relationships          certain methods of delivery but not
solicitations. (i) A consumer who           that the consumer establishes with you        other methods of delivery. However,
obtains a mortgage from a mortgage          or your affiliates, including continuing      one of the alternatives must allow the
lender authorizes or requests               relationships established subsequent to       consumer to prohibit all solicitations
information about homeowner’s               delivery of the opt-out notice, so long as    from all of the affiliates that are covered
insurance offered by the mortgage           the notice adequately describes the           by the notice.
lender’s insurance affiliate. Such          continuing relationships covered by the          (5) Special rule for a notice following
authorization or request, whether given     opt-out; or                                   termination of all continuing
to the mortgage lender or to the               (B) Any other transaction between the      relationships—(i) In general. A
insurance affiliate, would permit the       consumer and you or your affiliates as        consumer must be given a new opt-out
insurance affiliate to use eligibility      described in the notice.                      notice if, after all continuing
information about the consumer it              (ii) Examples of continuing                relationships with you or your
obtains from the mortgage lender or any     relationships. A consumer has a               affiliate(s) are terminated, the consumer
other affiliate to make solicitations to    continuing relationship with you or           subsequently establishes another
the consumer about homeowner’s              your affiliate if the consumer—               continuing relationship with you or
insurance.                                     (A) Opens a credit account with you
                                                                                          your affiliate(s) and the consumer’s
   (ii) A consumer completes an online      or your affiliate;
                                               (B) Obtains a loan for which you or        eligibility information is to be used to
application to apply for a credit card                                                    make a solicitation. The new opt-out
                                            your affiliate owns the servicing rights;
from a department store. The store’s           (C) Purchases an insurance product         notice must apply, at a minimum, to
online application contains a blank         from you or your affiliate;                   eligibility information obtained in
check box that the consumer may check          (D) Holds an investment product            connection with the new continuing
to authorize or request information from    through you or your affiliate, such as        relationship. Consistent with paragraph
the store’s affiliates. The consumer        when you act or your affiliate acts as a      (b) of this section, the consumer’s
checks the box. The consumer has            custodian for securities or for assets in     decision not to opt out after receiving
authorized or requested solicitations       an individual retirement arrangement;         the new opt-out notice would not
from store’s affiliates.                       (E) Enters into an agreement or            override a prior opt-out election by the
   (iii) A consumer completes an online     understanding with you or your affiliate      consumer that applies to eligibility
application to apply for a credit card      whereby you or your affiliate undertakes      information obtained in connection
from a department store. The store’s        to arrange or broker a home mortgage          with a terminated relationship,
online application contains a pre-          loan for the consumer;                        regardless of whether the new opt-out
selected check box indicating that the         (F) Enters into a lease of personal        notice applies to eligibility information
consumer authorizes or requests             property with you or your affiliate; or       obtained in connection with the
information from the store’s affiliates.       (G) Obtains financial, investment, or      terminated relationship.
The consumer does not deselect the          economic advisory services from you or           (ii) Example. A consumer has an
check box. The consumer has not             your affiliate for a fee.                     automobile loan account with a creditor
              Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations                          61461

that is part of an affiliated group. The       notice may indicate that it applies to        opt out of receiving marketing than is
consumer pays off the loan. After paying       multiple companies with the ABC name          required by this part, the requirements
off the loan, the consumer subsequently        or multiple companies in the ABC group        of this section may be satisfied by
obtains a second mortgage loan from the        or family of companies, for example, by       providing the consumer with a clear,
creditor. The consumer must be given a         stating that the notice is provided by        conspicuous, and concise notice that
new notice and opportunity to opt out          ‘‘all of the ABC companies,’’ ‘‘the ABC       accurately discloses the consumer’s opt-
before the creditor’s affiliates may make      banking, credit card, insurance, and          out rights.
solicitations to the consumer using            securities companies,’’ or by listing the       (4) Model notices. Model notices are
eligibility information obtained by the        name of each affiliate providing the          provided in Appendix C of Part 698 of
creditor in connection with the new            notice. But if the affiliates covered by      this chapter.
mortgage relationship, regardless of           the notice do not all share a common            (b) Coordinated and consolidated
whether the consumer opted out in              name, then the notice must either             notices. A notice required by this part
connection with the automobile loan            separately identify each covered affiliate    may be coordinated and consolidated
account.                                       by name or identify each of the common        with any other notice or disclosure
   (b) Duration of opt-out. The election       names used by those affiliates, for           required to be issued under any other
of a consumer to opt out must be               example, by stating that the notice           provision of law by the entity providing
effective for a period of at least five        applies to ‘‘all of the ABC and XYZ           the notice, including but not limited to
years (the ‘‘opt-out period’’) beginning       companies’’ or to ‘‘the ABC banking and       the notice de-scribed in section
when the consumer’s opt-out election is        credit card companies and the XYZ             603(d)(2)(A)(iii) of the Act and the
received and implemented, unless the           insurance companies;’’                        Gramm-Leach-Bliley Act privacy notice.
consumer subsequently revokes the opt-            (iii) A general description of the types     (c) Equivalent notices. A notice or
out in writing or, if the consumer agrees,     of eligibility information that may be        other disclosure that is equivalent to the
electronically. An opt-out period of           used to make solicitations to the             notice required by this part, and that is
more than five years may be established,       consumer;                                     provided to a consumer together with
including an opt-out period that does             (iv) That the consumer may elect to        disclosures required by any other
not expire unless revoked by the               limit the use of eligibility information to   provision of law, satisfies the
consumer.                                      make solicitations to the consumer;           requirements of this section.
   (c) Time of opt-out. A consumer may            (v) That the consumer’s election will
opt out at any time.                           apply for the specified period of time        § 680.24 Reasonable opportunity to opt
                                               stated in the notice and, if applicable,      out.
§ 680.23 Contents of opt-out notice;           that the consumer will be allowed to             (a) In general. You must not use
consolidated and equivalent notices.                                                         eligibility information about a consumer
                                               renew the election once that period
   (a) Contents of opt-out notice—(1) In       expires;                                      that you receive from an affiliate to
general. A notice must be clear,                  (vi) If the notice is provided to          make a solicitation to the consumer
conspicuous, and concise, and must             consumers who may have previously             about your products or services, unless
accurately disclose:                           opted out, such as if a notice is provided    the consumer is provided a reasonable
   (i) The name of the affiliate(s)            to consumers annually, that the               opportunity to opt out, as required by
providing the notice. If the notice is         consumer who has chosen to limit                 § 680.21(a)(1)(ii) of this part.
provided jointly by multiple affiliates        solicitations does not need to act again         (b) Examples of a reasonable
and each affiliate shares a common             until the consumer receives a renewal         opportunity to opt out. The consumer is
name, such as ‘‘ABC,’’ then the notice         notice; and                                   given a reasonable opportunity to opt
may indicate that it is being provided by         (vii) A reasonable and simple method       out if:
multiple companies with the ABC name           for the consumer to opt out.                     (1) By mail. The opt-out notice is
or multiple companies in the ABC group            (2) Joint relationships. (i) If two or     mailed to the consumer. The consumer
or family of companies, for example, by        more consumers jointly obtain a product       is given 30 days from the date the notice
stating that the notice is provided by         or service, a single opt-out notice may       is mailed to elect to opt out by any
‘‘all of the ABC companies,’’ ‘‘the ABC        be provided to the joint consumers. Any       reasonable means.
banking, credit card, insurance, and           of the joint consumers may exercise the          (2) By electronic means. (i) The opt-
securities companies,’’ or by listing the      right to opt out.                             out notice is provided electronically to
name of each affiliate providing the              (ii) The opt-out notice must explain       the consumer, such as by posting the
notice. But if the affiliates providing the    how an opt-out direction by a joint           notice at an Internet Web site at which
joint notice do not all share a common         consumer will be treated. An opt-out          the consumer has obtained a product or
name, then the notice must either              direction by a joint consumer may be          service. The consumer acknowledges
separately identify each affiliate by          treated as applying to all of the             receipt of the electronic notice. The
name or identify each of the common            associated joint consumers, or each joint     consumer is given 30 days after the date
names used by those affiliates, for            consumer may be permitted to opt out          the consumer acknowledges receipt to
example, by stating that the notice is         separately. If each joint consumer is         elect to opt out by any reasonable
provided by ‘‘all of the ABC and XYZ           permitted to opt out separately, one of       means.
companies’’ or by ‘‘the ABC banking            the joint consumers must be permitted            (ii) The opt-out notice is provided to
and credit card companies and the XYZ          to opt out on behalf of all of the joint      the consumer by e-mail where the
insurance companies;’’                         consumers and the joint consumers             consumer has agreed to receive
   (ii) A list of the affiliates or types of   must be permitted to exercise their           disclosures by e-mail from the person
affiliates whose use of eligibility            separate rights to opt out in a single        sending the notice. The consumer is
information is covered by the notice,          response.                                     given 30 days after the e-mail is sent to
which may include companies that                  (iii) It is impermissible to require all   elect to opt out by any reasonable
become affiliates after the notice is          joint consumers to opt out before             means.
provided to the consumer. If each              implementing any opt-out direction.              (3) At the time of an electronic
affiliate covered by the notice shares a          (3) Alternative contents. If the           transaction. The opt-out notice is
common name, such as ‘‘ABC,’’ then the         consumer is afforded a broader right to       provided to the consumer at the time of
61462         Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations

an electronic transaction, such as a              (v) Allowing consumers to exercise all       (1) Only posts the notice on a sign in
transaction conducted on an Internet           of their opt-out rights described in a        a branch or office or generally publishes
Web site. The consumer is required to          consolidated opt-out notice that              the notice in a newspaper;
decide, as a necessary part of                 includes the privacy opt-out under the          (2) Sends the notice via e-mail to a
proceeding with the transaction,               Gramm-Leach-Bliley Act, 15 U.S.C.             consumer who has not agreed to receive
whether to opt out before completing           6801 et seq., the affiliate sharing opt-out   electronic disclosures by e-mail from
the transaction. There is a simple             under the Act, and the affiliate              the affiliate providing the notice; or
process that the consumer may use to           marketing opt-out under the Act, by a           (3) Posts the notice on an Internet
opt out at that time using the same            single method, such as by calling a           Web site without requiring the
mechanism through which the                    single toll-free telephone number.            consumer to acknowledge receipt of the
transaction is conducted.                         (2) Opt-out methods that are not           notice.
   (4) At the time of an in-person             reasonable and simple. Reasonable and
                                                                                             § 680.27 Renewal of opt-out.
transaction. The opt-out notice is             simple methods for exercising an opt-
provided to the consumer in writing at         out right do not include—                        (a) Renewal notice and opt-out
the time of an in-person transaction.             (i) Requiring the consumer to write        requirement—(1) In general. After the
The consumer is required to decide, as         his or her own letter;                        opt-out period expires, you may not
a necessary part of proceeding with the           (ii) Requiring the consumer to call or     make solicitations based on eligibility
transaction, whether to opt out before         write to obtain a form for opting out,        information you receive from an affiliate
completing the transaction, and is not         rather than including the form with the       to a consumer who previously opted
permitted to complete the transaction          opt-out notice;                               out, unless:
                                                  (iii) Requiring the consumer who              (i) The consumer has been given a
without making a choice. There is a
                                               receives the opt-out notice in electronic     renewal notice that complies with the
simple process that the consumer may
                                               form only, such as through posting at an      requirements of this section and
use during the course of the in-person
                                               Internet Web site, to opt out solely by       §§ 680.24 through 680.26 of this part,
transaction to opt out, such as
                                               paper mail or by visiting a different Web     and a reasonable opportunity and a
completing a form that requires
                                               site without providing a link to that site.   reasonable and simple method to renew
consumers to write a ‘‘yes’’ or ‘‘no’’ to
                                                  (c) Specific opt-out means. Each           the opt-out, and the consumer does not
indicate their opt-out preference or that
                                               consumer may be required to opt out           renew the opt-out; or
requires the consumer to check one of                                                           (ii) An exception in § 680.21(c) of this
two blank check boxes—one that allows          through a specific means, as long as that
                                               means is reasonable and simple for that       part applies.
consumers to indicate that they want to                                                         (2) Renewal period. Each opt-out
opt out and one that allows consumers          consumer.
                                                                                             renewal must be effective for a period of
to indicate that they do not want to opt       § 680.26 Delivery of opt-out notices.         at least five years as provided in
out.                                              (a) In general. The opt-out notice must    § 680.22(b) of this part.
   (5) By including in a privacy notice.       be provided so that each consumer can            (3) Affiliates who may provide the
The opt-out notice is included in a            reasonably be expected to receive actual      notice. The notice required by this
Gramm-Leach-Bliley Act privacy notice.         notice. For opt-out notices provided          paragraph must be provided:
The consumer is allowed to exercise the        electronically, the notice may be                (i) By the affiliate that provided the
opt-out within a reasonable period of          provided in compliance with either the        previous opt-out notice, or its successor;
time and in the same manner as the opt-        electronic disclosure provisions in this      or
out under that privacy notice.                 part or the provisions in section 101 of         (ii) As part of a joint renewal notice
§ 680.25 Reasonable and simple methods         the Electronic Signatures in Global and       from two or more members of an
of opting out.                                 National Commerce Act, 15 U.S.C. 7001         affiliated group of companies, or their
                                               et seq.                                       successors, that jointly provided the
  (a) In general. You must not use                                                           previous opt-out notice.
                                                  (b) Examples of reasonable
eligibility information about a consumer                                                        (b) Contents of renewal notice. The
                                               expectation of actual notice. A
that you receive from an affiliate to                                                        renewal notice must be clear,
                                               consumer may reasonably be expected
make a solicitation to the consumer                                                          conspicuous, and concise, and must
                                               to receive actual notice if the affiliate
about your products or services, unless                                                      accurately disclose:
                                               providing the notice:
the consumer is provided a reasonable                                                           (1) The name of the affiliate(s)
                                                  (1) Hand-delivers a printed copy of
and simple method to opt out, as                                                             providing the notice. If the notice is
                                               the notice to the consumer;
required by § 680.21(a)(1)(ii) of this part.                                                 provided jointly by multiple affiliates
                                                  (2) Mails a printed copy of the notice
   (b) Examples—(1) Reasonable and             to the last known mailing address of the      and each affiliate shares a common
simple opt-out methods. Reasonable and         consumer;                                     name, such as ‘‘ABC,’’ then the notice
simple methods for exercising the opt-            (3) Provides a notice by e-mail to a       may indicate that it is being provided by
out right include—                             consumer who has agreed to receive            multiple companies with the ABC name
   (i) Designating a check-off box in a        electronic disclosures by e-mail from         or multiple companies in the ABC group
prominent position on the opt-out form;        the affiliate providing the notice; or        or family of companies, for example, by
   (ii) Including a reply form and a self-        (4) Posts the notice on the Internet       stating that the notice is provided by
addressed envelope together with the           Web site at which the consumer                ‘‘all of the ABC companies,’’ ‘‘the ABC
opt-out notice;                                obtained a product or service                 banking, credit card, insurance, and
   (iii) Providing an electronic means to      electronically and requires the               securities companies,’’ or by listing the
opt out, such as a form that can be            consumer to acknowledge receipt of the        name of each affiliate providing the
electronically mailed or processed at an       notice.                                       notice. But if the affiliates providing the
Internet Web site, if the consumer agrees         (c) Examples of no reasonable              joint notice do not all share a common
to the electronic delivery of information;     expectation of actual notice. A               name, then the notice must either
   (iv) Providing a toll-free telephone        consumer may not reasonably be                separately identify each affiliate by
number that consumers may call to opt          expected to receive actual notice if the      name or identify each of the common
out; or                                        affiliate providing the notice:               names used by those affiliates, for
              Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations                                    61463

example, by stating that the notice is        before expiration of the opt-out period         provides. Acceptable changes include, for
provided by ‘‘all of the ABC and XYZ          is a reasonable period of time before           example:
companies’’ or by ‘‘the ABC banking           expiration of the opt-out in all cases.            1. Rearranging the order of the references
and credit card companies and the XYZ            (d) No effect on opt-out period. An          to ‘‘your income,’’ ‘‘your account history,’’
                                                                                              and ‘‘your credit score.’’
insurance companies;’’                        opt-out period may not be shortened by             2. Substituting other types of information
   (2) A list of the affiliates or types of   sending a renewal notice to the                 for ‘‘income,’’ ‘‘account history,’’ or ‘‘credit
affiliates whose use of eligibility           consumer before expiration of the opt-          score’’ for accuracy, such as ‘‘payment
information is covered by the notice,         out period, even if the consumer does           history,’’ ‘‘credit history,’’ ‘‘payoff status,’’ or
which may include companies that              not renew the opt out.                          ‘‘claims history.’’
become affiliates after the notice is                                                            3. Substituting a clearer and more accurate
provided to the consumer. If each             § 680.28 Effective date, compliance date,       description of the affiliates providing or
                                              and prospective application.                    covered by the notice for phrases such as
affiliate covered by the notice shares a
common name, such as ‘‘ABC,’’ then the           (a) Effective date. This part is effective   ‘‘the [ABC] group of companies,’’ including
                                              January 1, 2008.                                without limitation a statement that the entity
notice may indicate that it applies to
                                                 (b) Mandatory compliance date.               providing the notice recently purchased the
multiple companies with the ABC name                                                          consumer’s account.
or multiple companies in the ABC group        Compliance with this part is required
                                                                                                 4. Substituting other types of affiliates
or family of companies, for example, by       not later than October 1, 2008.                 covered by the notice for ‘‘credit card,’’
stating that the notice is provided by           (c) Prospective application. The             ‘‘insurance,’’ or ‘‘securities’’ affiliates.
‘‘all of the ABC companies,’’ ‘‘the ABC       provisions of this part shall not prohibit         5. Omitting items that are not accurate or
banking, credit card, insurance, and          you from using eligibility information          applicable. For example, if a person does not
securities companies,’’ or by listing the     that you receive from an affiliate to           limit the duration of the opt-out period, the
name of each affiliate providing the          make solicitations to a consumer if you         notice may omit information about the
                                              receive such information prior to               renewal notice.
notice. But if the affiliates covered by
                                              October 1, 2008. For purposes of this              6. Adding a statement informing
the notice do not all share a common                                                          consumers how much time they have to opt
name, then the notice must either             section, you are deemed to receive
                                                                                              out before shared eligibility information may
separately identify each covered affiliate    eligibility information when such               be used to make solicitations to them.
by name or identify each of the common        information is placed into a common                7. Adding a statement that the consumer
names used by those affiliates, for           database and is accessible by you.              may exercise the right to opt out at any time.
example, by stating that the notice                                                              8. Adding the following statement, if
applies to ‘‘all of the ABC and XYZ           PART 698—AMENDED                                accurate: ‘‘If you previously opted out, you
companies’’ or to ‘‘the ABC banking and                                                       do not need to do so again.’’
                                              ■ 2. Revise the authority citation for Part        9. Providing a place on the form for the
credit card companies and the XYZ             698 to read as follows:                         consumer to fill in identifying information,
insurance companies;’’                                                                        such as his or her name and address.
   (3) A general description of the types       Authority: 15 U.S.C. 1681e, 1681g, 1681j,
of eligibility information that may be        1681m, 1681s, and 1681s-3; sections 211(d)      C-1 Model Form for Initial Opt-out notice
                                              and 214(b), Pub. L. 108-159, 117 Stat.1952.       (Single-Affiliate Notice)
used to make solicitations to the
                                              ■ 3. Amend § 698.1 by revising                  C-2 Model Form for Initial Opt-out notice
consumer;
                                              paragraph (b) to read as follows:                 (Joint Notice)
   (4) That the consumer previously                                                           C-3 Model Form for Renewal Notice (Single-
elected to limit the use of certain           § 698.1 Authority and purpose.                    Affiliate Notice)
information to make solicitations to the                                                      C-4 Model Form for Renewal Notice (Joint
consumer;                                     *      *    *    *      *
                                                                                                Notice)
   (5) That the consumer’s election has          (b) Purpose. The purpose of this part        C-5 Model Form for Voluntary ‘‘No
expired or is about to expire;                is to comply with sections 607(d),                Marketing’’ Notice
   (6) That the consumer may elect to         609(c), 609(d), 612(a), 615(d), and 624 of
                                              the Fair Credit Reporting Act, as               C-1 Model Form for Initial Opt-out Notice
renew the consumer’s previous election;                                                       (Single-Affiliate Notice)
   (7) If applicable, that the consumer’s     amended by the Fair and Accurate
election to renew will apply for the          Credit Transactions Act of 2003, and              [Your Choice to Limit Marketing]/
                                              sections 211(d) and 214(b) of the Fair          [Marketing Opt-out]
specified period of time stated in the
notice and that the consumer will be          and Accurate Credit Transactions Act of         — [Name of Affiliate] is providing this
allowed to renew the election once that       2003.                                               notice.
period expires; and                           ■ 4. Add Appendix C to Part 698 as
                                                                                              — [Optional: Federal law gives you the right
   (8) A reasonable and simple method                                                             to limit some but not all marketing from
                                              follows:                                            our affiliates. Federal law also requires
for the consumer to opt out.                                                                      us to give you this notice to tell you
   (c) Timing of the renewal notice—(1)       APPENDIX C TO PART 698—MODEL
                                              FORMS FOR AFFILIATE MARKETING                       about your choice to limit marketing
In general. A renewal notice may be                                                               from our affiliates.]
provided to the consumer either—              OPT-OUT NOTICES
                                                                                              — You may limit our affiliates in the [ABC]
   (i) A reasonable period of time before        A. Although use of the model forms is not        group of companies, such as our [credit
the expiration of the opt-out period; or      required, use of the model forms in this            card, insurance, and securities] affiliates,
   (ii) Any time after the expiration of      Appendix (as applicable) complies with the          from marketing their products or services
the opt-out period but before                 requirement in section 624 of the Act for           to you based on your personal
solicitations that would have been            clear, conspicuous, and concise notices.            information that we collect and share
prohibited by the expired opt-out are            B. Certain changes may be made to the            with them. This information includes
made to the consumer.                         language or format of the model forms               your [income], your [account history
   (2) Combination with annual privacy        without losing the protection from liability        with us], and your [credit score].
                                              afforded by use of the model forms. These       — Your choice to limit marketing offers from
notice. If you provide an annual privacy      changes may not be so extensive as to affect        our affiliates will apply [until you tell us
notice under the Gramm-Leach-Bliley           the substance, clarity, or meaningful               to change your choice]/[for x years from
Act, 15 U.S.C. 6801 et seq., providing a      sequence of the language in the model forms.        when you tell us your choice]/[for at
renewal notice with the last annual           Persons making such extensive revisions will        least 5 years from when you tell us your
privacy notice provided to the consumer       lose the safe harbor that this Appendix             choice]. [Include if the opt-out period
61464           Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations

    expires.] Once that period expires, you            opted out.] If you have already made a         — The [ABC group of companies] is
    will receive a renewal notice that will            choice to limit marketing offers from the          providing this notice.
    allow you to continue to limit marketing           [ABC] companies, you do not need to act        — [Optional: Federal law gives you the right
    offers from our affiliates for [another x          again until you receive the renewal                to limit some but not all marketing from
    years]/[at least another 5 years].                 notice.                                            the [ABC] companies. Federal law also
— [Include, if applicable, in a subsequent         To limit marketing offers, contact us                  requires us to give you this notice to tell
    notice, including an annual notice, for        [include all that apply]:                              you about your choice to limit marketing
    consumers who may have previously                                                                     from the [ABC] companies.]
    opted out.] If you have already made a         — By telephone: 1-877-###–####
                                                   — On the Web: www.—.com                            — You previously chose to limit the [ABC
    choice to limit marketing offers from our                                                             companies], such as the [ABC credit
    affiliates, you do not need to act again       — By mail: check the box and complete the
                                                      form below, and send the form to:                   card, insurance, and securities] affiliates,
    until you receive the renewal notice.
                                                                                                          from marketing their products or services
To limit marketing offers, contact us                [Company name] 
                                     to you based on your personal
[include all that apply]:                            [Company address] 
                                  information that they receive from other
— By telephone: 1-877-###–####                       __ Do not allow any company [in the ABC              [ABC] companies. This information
— On the Web: www.—.com                            group of companies] to use my personal                 includes your [income], your [account
— By mail: check the box and complete the          information to market to me.                           history], and your [credit score].
   form below, and send the form to:               C-3 Model Form for Renewal Notice (Single-         — Your choice has expired or is about to
                                                   Affiliate Notice)                                      expire.
  [Company name] 

  [Company address] 
                                [Renewing Your Choice to Limit                     To renew your choice to limit marketing
                                                   Marketing]/[Renewing Your Marketing Opt-           for [x] more years, contact us [include all
  __ Do not allow your affiliates to use my
personal information to market to me.              out]                                               that apply]:
                                                   — [Name of Affiliate] is providing this            — By telephone: 1-877-###–####
C-2 Model Form for Initial Opt-out Notice
                                                       notice.                                        — On the Web: www.—.com
(Joint Notice)
                                                   — [Optional: Federal law gives you the right       — By mail: check the box and complete the
   [Your Choice to Limit Marketing]/                   to limit some but not all marketing from          form below, and send the form to:
[Marketing Opt-out]                                    our affiliates. Federal law also requires
                                                       us to give you this notice to tell you           [Company name] 

— The [ABC group of companies] is                                                                       [Company address] 

    providing this notice.                             about your choice to limit marketing
— [Optional: Federal law gives you the right           from our affiliates.]                            __ Renew my choice to limit marketing for
    to limit some but not all marketing from       — You previously chose to limit our affiliates     [x] more years.
    the [ABC] companies. Federal law also              in the [ABC] group of companies, such
    requires us to give you this notice to tell        as our [credit card, insurance, and            C-5 Model Form for Voluntary ‘‘No
    you about your choice to limit marketing           securities] affiliates, from marketing their   Marketing’’ Notice
    from the [ABC] companies.]                         products or services to you based on             Your Choice to Stop Marketing
— You may limit the [ABC companies], such              your personal information that we share
                                                       with them. This information includes           — [Name of Affiliate] is providing this
    as the [ABC credit card, insurance, and
                                                       your [income], your [account history               notice.
    securities] affiliates, from marketing their
                                                       with us], and your [credit score].             — You may choose to stop all marketing from
    products or services to you based on
    your personal information that they            — Your choice has expired or is about to               us and our affiliates.
    receive from other [ABC] companies.                expire.
                                                                                                      To stop all marketing offers, contact us
    This information includes your [income],       To renew your choice to limit marketing for        [include all that apply]:
    your [account history], and your [credit       [x] more years, contact us [include all that
                                                   apply]:                                            — By telephone: 1-877-###–####
    score].
                                                                                                      — On the Web: www.—.com
— Your choice to limit marketing offers from       — By telephone: 1-877-###–####
    the [ABC] companies will apply [until                                                             — By mail: check the box and complete the
                                                   — On the Web: www.—.com                               form below, and send the form to:
    you tell us to change your choice]/[for x      — By mail: check the box and complete the
    years from when you tell us your                  form below, and send the form to:                 [Company name] 

    choice]/[for at least 5 years from when                                                             [Company address] 

    you tell us your choice]. [Include if the        [Company name] 

                                                     [Company address] 
                                __ Do not market to me.
    opt-out period expires.] Once that period
    expires, you will receive a renewal              __ Renew my choice to limit marketing for          The Federal Trade Commission. 

    notice that will allow you to continue to      [x] more years.                                      Dated: October 22, 2007. 

    limit marketing offers from the [ABC]                                                               By direction of the Commission. 

    companies for [another x years]/[at least      C-4 Model Form for Renewal Notice (Joint
                                                   Notice)                                            Donald S. Clark,
    another 5 years].
                                                                                                      Secretary.
— [Include, if applicable, in a subsequent           [Renewing Your Choice to Limit
    notice, including an annual notice, for        Marketing]/[Renewing Your Marketing Opt-           [FR Doc. E7–21348 Filed 10–29–07: 8:45 am]
    consumers who may have previously              out]                                               BILLING CODE 6750–01–S

								
To top
;