Docstoc

Federal Trade Commission

Document Sample
Federal Trade Commission Powered By Docstoc
					                                                                                                                              Tuesday,
                                                                                                                              October 30, 2007




                                                                                                                              Part II

                                                                                                                              Federal Trade
                                                                                                                              Commission
                                                                                                                              16 CFR Parts 680 and 698
                                                                                                                              Affiliate Marketing Rule; Final Rule
pwalker on PROD1PC71 with RULES2




                                   VerDate Aug<31>2005   20:51 Oct 29, 2007   Jkt 214001   PO 00000   Frm 00001   Fmt 4717   Sfmt 4717   E:\FR\FM\30OCR2.SGM   30OCR2
                                        61424            Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations

                                        FEDERAL TRADE COMMISSION                                consumer reporting agency.1 In                         consumer; or (4) to make a solicitation
                                                                                                addition, the communication of such                    that has been authorized or requested by
                                        16 CFR Parts 680 and 698                                transaction or experience information                  the consumer. Unlike the FCRA affiliate
                                                                                                among affiliates will not result in any                sharing opt-out and the Gramm-Leach-
                                        [Regulation No. 411006]                                 affiliate becoming a consumer reporting                Bliley Act, 15 U.S.C. 6801 et seq.,
                                                                                                agency. See FCRA §§ 603(d)(2)(A)(i) and                (GLBA) non-affiliate sharing opt-out,
                                        RIN 3084-AA94
                                                                                                (ii).                                                  which apply indefinitely, section 624
                                        Affiliate Marketing Rule                                   Section 603(d)(2)(A)(iii) of the FCRA               provides that a consumer’s affiliate
                                                                                                provides that a person may                             marketing opt-out election must be
                                        AGENCY:    Federal Trade Commission                     communicate ‘‘other’’ information—that                 effective for a period of at least five
                                        ACTION:   Final rule.                                   is, information that is not transaction or             years. Upon expiration of the opt-out
                                                                                                experience information—among its                       period, the consumer must be given a
                                        SUMMARY: The Federal Trade                              affiliates without becoming a consumer                 renewal notice and an opportunity to
                                        Commission (FTC or Commission) is                       reporting agency if it is clearly and                  renew the opt-out before information
                                        publishing a final rule to implement the                conspicuously disclosed to the                         received from an affiliate may be used
                                        affiliate marketing provisions in section               consumer that such information may be                  to make solicitations to the consumer.
                                        214 of the Fair and Accurate Credit                     communicated among affiliates and the
                                        Transactions Act of 2003, which                                                                                   Section 624 governs the use of
                                                                                                consumer is given an opportunity,
                                        amends the Fair Credit Reporting Act.                   before the information is                              information by an affiliate, not the
                                        The final rule generally prohibits a                    communicated, to ‘‘opt out’’ or direct                 sharing of information among affiliates,
                                        person from using information received                  that the information not be                            and thus is distinct from the affiliate
                                        from an affiliate to make a solicitation                communicated among such affiliates,                    sharing opt-out under section
                                        for marketing purposes to a consumer,                   and the consumer has not opted out.                    603(d)(2)(A)(iii) of the FCRA.
                                        unless the consumer is given notice and                                                                        Nevertheless, the affiliate marketing and
                                        a reasonable opportunity and a                          The Fair and Accurate Credit                           affiliate sharing opt-outs and the
                                        reasonable and simple method to opt                     Transactions Act of 2003                               information subject to the two opt-outs
                                        out of the making of such solicitations.                   The President signed into law the Fair              overlap to some extent. As noted above,
                                        The FACT Act requires certain other                     and Accurate Credit Transactions Act of                the FCRA allows transaction or
                                        federal agencies to publish similar rules,              2003 (FACT Act) on December 4, 2003.                   experience information to be shared
                                        and mandates that the FTC and other                     Pub. L. 108-159, 117 Stat. 1952. In                    among affiliates without giving the
                                        agencies consult and cooperate so that                  general, the FACT Act amends the                       consumer notice and an opportunity to
                                        their regulations implementing this                     FCRA to enhance the ability of                         opt out, but provides that ‘‘other’’
                                        provision are consistent and comparable                 consumers to combat identity theft,                    information, such as information from
                                        with one another.                                       increase the accuracy of consumer                      credit reports and credit applications,
                                        DATES: This rule is effective on January                reports, restrict the use of medical                   may not be shared among affiliates
                                        1, 2008. The mandatory compliance                       information in credit eligibility                      without giving the consumer notice and
                                        date for this rule is October 1, 2008.                  determinations, and allow consumers to                 an opportunity to opt out. The new
                                                                                                exercise greater control regarding the                 affiliate marketing opt-out applies to
                                        FOR FURTHER INFORMATION CONTACT:
                                                                                                type and number of solicitations they                  both transaction or experience
                                        Loretta Garrison and Anthony                                                                                   information and ‘‘other’’ information.
                                                                                                receive.
                                        Rodriguez, Attorneys, Federal Trade                        Section 214 of the FACT Act added a                 Thus, certain information will be
                                        Commission, (202) 326-2252, Division                    new section 624 to the FCRA. This                      subject to two opt-outs, a sharing opt-
                                        of Privacy and Identity Protection,                     provision gives consumers the right to                 out and a marketing use opt-out.
                                        Federal Trade Commission, 601 New                       restrict a person from using certain
                                        Jersey Avenue, NW, Washington, DC                                                                                 Section 214(b) of the FACT Act
                                                                                                information obtained from an affiliate to              requires the FTC, the Federal banking
                                        20580.                                                  make solicitations to that consumer.                   agencies,2 the Securities and Exchange
                                        SUPPLEMENTARY INFORMATION:                              Section 624 generally provides that if a               Commission (SEC), and the National
                                                                                                person receives certain consumer                       Credit Union Administration (NCUA) to
                                        I. Background
                                                                                                eligibility information from an affiliate,             prescribe regulations, in consultation
                                        The Fair Credit Reporting Act                           the person may not use that information                and coordination with each other, to
                                           The Fair Credit Reporting Act (FCRA                  to make solicitations to the consumer                  implement the FCRA’s affiliate
                                        or Act), which was enacted in 1970, sets                about its products or services, unless the             marketing opt-out provisions. In
                                        standards for the collection,                           consumer is given notice and an                        adopting its regulation, the Commission
                                        communication, and use of information                   opportunity and a simple method to opt                 must ensure that the affiliate marketing
                                        bearing on a consumer’s credit                          out of such use of the information, and                notification methods provide a simple
                                        worthiness, credit standing, credit                     the consumer does not opt out. The                     means for consumers to make choices
                                        capacity, character, general reputation,                statute also provides that section 624                 under section 624, consider the affiliate
                                        personal characteristics, or mode of                    does not apply, for example, to a person               sharing notification practices employed
                                        living. 15 U.S.C. 1681-1681x. In 1996,                  using eligibility information: (1) to make             on the date of enactment by persons
                                        the Consumer Credit Reporting Reform                    solicitations to a consumer with whom                  subject to section 624, and ensure that
                                        Act extensively amended the FCRA.                       the person has a pre-existing business                 notices may be coordinated and
                                        Pub. L. 104-208, 110 Stat. 3009.                        relationship; (2) to perform services for              consolidated with other notices required
                                           The FCRA, as amended, provides that                  another affiliate subject to certain                   by law.
                                                                                                conditions; (3) in response to a
pwalker on PROD1PC71 with RULES2




                                        a person may communicate to an
                                        affiliate or a non-affiliated third party               communication initiated by the                           2 The Federal banking agencies are the Board of

                                        information solely as to transactions or                                                                       Governors of the Federal Reserve System (Board),
                                                                                                  1 The FCRA creates substantial obligations for a     the Office of the Comptroller of the Currency (OCC),
                                        experiences between the consumer and                    person that meets the definition of a ‘‘consumer       the Federal Deposit Insurance Corporation (FDIC),
                                        the person without becoming a                           reporting agency’’ in section 603(f) of the statute.   and the Office of Thrift Supervision (OTS).



                                   VerDate Aug<31>2005   20:51 Oct 29, 2007   Jkt 214001   PO 00000   Frm 00002   Fmt 4701   Sfmt 4700   E:\FR\FM\30OCR2.SGM   30OCR2
                                                          Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations                                           61425

                                        II. The Proposed Regulation                              other affiliates. The Commission                     persons covered by this part of the
                                           The Commission published its notice                   designed this approach to provide                    Commission’s rule.
                                        of proposed rulemaking in the Federal                    flexibility and to facilitate the use of a
                                                                                                                                                      Section 680.2 Examples
                                        Register on June 15, 2004 (69 FR 33324)                  single coordinated notice, while taking
                                                                                                 into account existing affiliate sharing                 Proposed § 680.2 described the scope
                                        to implement section 214 of the FACT
                                                                                                 notification practices. At the same time,            and effect of the examples included in
                                        Act.3
                                           The proposal defined the key terms                    the approach sought to ensure that the               the proposed rule. Most commenters
                                        ‘‘pre-existing business relationship’’ and               notice would be effective because it                 supported the proposed use of non-
                                        ‘‘solicitation’’ essentially as defined in               generally would be provided by or on                 exclusive examples to illustrate the
                                        the statute. The Commission did not                      behalf of an entity from which the                   operation of the rule. One commenter,
                                        propose to include additional                            consumer would expect to receive                     concerned that the use of examples
                                        circumstances within the meaning of                      important notices, and would not be                  would increase the risk of litigation,
                                        ‘‘pre-existing business relationship’’ or                provided along with solicitations.                   urged the Commission to delete all
                                        other types of communications within                        The proposal also provided guidance               examples.
                                        the meaning of ‘‘solicitation.’’                         on the contents of the opt-out notice,                  The Commission does not believe the
                                           To address the scope of the affiliate                 what constitutes a reasonable                        use of illustrative examples will
                                        marketing opt-out, the proposal defined                  opportunity to opt out, reasonable and               materially increase the risk of litigation,
                                        ‘‘eligibility information’’ to mean any                  simple methods of opting out, and the                but rather will provide useful guidance
                                        information the communication of                         delivery of opt-out notices. Finally, the            for compliance purposes, which may
                                        which would be a ‘‘consumer report’’ if                  proposal provided guidance on the                    alleviate litigation risks for institutions.
                                        the statutory exclusions from the                        effect of the limited duration of the opt-              As § 680.2 states, examples in a
                                        definition of ‘‘consumer report’’ in                     out and the requirement to provide an                paragraph illustrate only the issue
                                        section 603(d)(2)(A) of the FCRA for                     extension notice upon expiration of the              described in the paragraph and do not
                                        transaction or experience information                    opt-out period.                                      illustrate any other issue that may arise
                                        and for ‘‘other’’ information that is                                                                         in the part. Similarly, the examples do
                                                                                                 III. Overview of Comments Received                   not illustrate any issues that may arise
                                        subject to the affiliate-sharing opt-out
                                        did not apply. The Commission                              The Commission received 49                         under other laws or regulations.
                                        substituted the term ‘‘eligibility                       comments. In addition, the Commission                Section 680.3 Definitions
                                        information’’ for the more complicated                   considered the comments submitted to
                                                                                                 the Federal banking agencies, the                       Section 680.3 of the proposal
                                        statutory language regarding the
                                                                                                 NCUA, and the SEC. Many commenters                   contained definitions for the following
                                        communication of information that
                                                                                                 sent copies of the same letter to more               terms: ‘‘Act,’’ ‘‘affiliate’’ (as well as the
                                        would be a consumer report, but for
                                                                                                 than one agency. The Commission                      related terms ‘‘company’’ and
                                        clauses (i), (ii), and (iii) of section
                                                                                                 received comments from a variety of                  ‘‘control’’); ‘‘clear and conspicuous’’;
                                        603(d)(2)(A) of the FCRA.4 In addition,
                                                                                                 banks, thrifts, credit unions, credit card           ‘‘consumer’’; ‘‘eligibility information’’;
                                        the proposal incorporated each of the
                                                                                                 companies, mortgage lenders, other non-              ‘‘person’’; ‘‘pre-existing business
                                        scope limitations contained in the
                                                                                                 bank creditors, and industry trade                   relationship’’; ‘‘solicitation’’; and,
                                        statute, such as the pre-existing business
                                                                                                 associations. The Commission also                    ‘‘you.’’
                                        relationship exception.                                                                                          Those definitions that elicited
                                           Section 624 does not state which                      received comments from consumer
                                                                                                 groups, the National Association of                  comment are discussed below.
                                        affiliate must give the consumer the
                                        affiliate marketing opt-out notice. The                  Attorneys General (‘‘NAAG’’), and                    Affiliate, Common Ownership or
                                        proposal provided that the person                        individual consumers.                                Common Corporate Control, and
                                        communicating information about a                          Most industry commenters objected to               Company
                                        consumer to its affiliate would be                       several key aspects of the proposal. The                The proposed rule included
                                        responsible for satisfying the notice                    most significant areas of concern raised             definitions for ‘‘affiliate’’ as well as for
                                        requirement, if applicable. A rule of                    by industry commenters related to                    the related terms ‘‘control’’ and
                                        construction provided flexibility to                     which affiliate would be responsible for             ‘‘company.’’ For the reasons discussed
                                        allow the notice to be given by the                      providing the notice, the scope of                   below, the final rule substituted
                                        person that communicates information                     certain exceptions to the notice and opt-            ‘‘common ownership or common
                                        to its affiliate, by the person’s agent, or              out requirement, and the content or the              corporate control’’ as a substitute for the
                                        through a joint notice with one or more                  inclusion of definitions for terms such              definition of ‘‘control,’’ and renumbered
                                                                                                 as ‘‘clear and conspicuous’’ and ‘‘pre-              it as § 680.3(d). The term ‘‘company’’ is
                                           3 On July 15, 2004, the Federal banking agencies      existing business relationship.’’                    renumbered as § 680.3(e).
                                        and the NCUA published their proposed affiliate          Consumer groups and NAAG generally                      Several FCRA provisions apply to
                                        marketing rule in the Federal Register (69 FR            supported the proposal, although these
                                        42502). The SEC published its proposed affiliate                                                              information sharing with persons
                                        marketing rule in the Federal Register on July 14,       commenters believed that the proposal                ‘‘related by common ownership or
                                        2004 (69 FR 42301).                                      could be strengthened in certain                     affiliated by corporate control,’’ ‘‘related
                                           4 Under section 603(d)(1) of the FCRA, a              respects. A more detailed discussion of              by common ownership or affiliated by
                                        ‘‘consumer report’’ means any written, oral, or other    the comments is contained in the
                                        communication of any information by a consumer                                                                common corporate control,’’ or
                                        reporting agency bearing on a consumer’s credit
                                                                                                 Section-by-Section Analysis below.                   ‘‘affiliated by common ownership or
                                        worthiness, credit standing, credit capacity,            IV. Section-by-Section Analysis                      common corporate control.’’ E.g., FCRA,
                                        character, general reputation, personal
                                        characteristics, or mode of living which is used or
                                                                                                                                                      sections 603(d)(2), 615(b)(2), and
                                                                                                 Section 680.1 Purpose and Scope                      625(b)(2). Each of these provisions was
                                        expected to be used or collected in whole or in part
pwalker on PROD1PC71 with RULES2




                                        for the purpose of serving as a factor in establishing     Section 680.1 of the proposal set forth            enacted as part of the 1996 amendments
                                        the consumer’s eligibility for credit or insurance to    the purpose and scope of the regulation.             to the FCRA. Similarly, section 2 of the
                                        be used primarily for personal, family, or household
                                        purposes, employment purposes, or any other
                                                                                                 The Commission received few                          FACT Act defines the term ‘‘affiliate’’ to
                                        purpose authorized in section 604 of the FCRA. 15        comments on this section. Section                    mean ‘‘persons that are related by
                                        U.S.C. 1681a(d).                                         680.1(b) of the final rule identifies the            common ownership or affiliated by


                                   VerDate Aug<31>2005   20:51 Oct 29, 2007   Jkt 214001   PO 00000   Frm 00003   Fmt 4701   Sfmt 4700   E:\FR\FM\30OCR2.SGM   30OCR2
                                        61426             Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations

                                        corporate control.’’ In contrast, the                    Information Privacy Act in August                      litigation and civil liability. Although
                                        GLBA defines ‘‘affiliate’’ to mean ‘‘any                 2003.6 Congress, however, did not                      these commenters recognized that the
                                        company that controls, is controlled by,                 incorporate these exceptions from                      proposed definition was derived from
                                        or is under common control with                          California law into the definition of                  the GLBA privacy regulations, they
                                        another company.’’ See 15 U.S.C.                         ‘‘affiliate’’ when it enacted the FACT                 noted that compliance with the GLBA
                                        6809(6).                                                 Act at the end of 2003. Accordingly, the               privacy regulations is enforced
                                           In the proposal, the Commission                       Commission believes that the approach                  exclusively through administrative
                                        sought to harmonize the various FCRA                     adopted here best effectuates the intent               action, not through private litigation.
                                        and FACT Act formulations by defining                    of Congress.                                           These commenters also stated that the
                                        ‘‘affiliate’’ to mean ‘‘any person that is                  Under the GLBA privacy rule, the                    Federal Reserve Board had withdrawn a
                                        related by common ownership or                           definition of ‘‘control’’ determines                   similar proposal to define ‘‘clear and
                                        common corporate control with another                    whether two or more entities meet the                  conspicuous’’ for purposes of
                                        person.’’ Industry commenters generally                  definition of ‘‘affiliate.’’7 The                      Regulations B, E, M, Z, and DD, in part
                                        supported the Commission’s goal of                       Commission included the same                           because of concerns about civil liability.
                                        harmonizing the various FCRA                             definition of ‘‘control’’ in the proposal              Some industry commenters believed
                                        definitions of ‘‘affiliate’’ for consistency.            and received no comments on the                        that it was not necessary to define the
                                        Many of these commenters, however,                       proposed definition. The Commission                    term in order for consumers to receive
                                        believed that the most effective way to                  interprets the phrase ‘‘related by                     clear and conspicuous disclosures based
                                        do this was for the Commission to                        common ownership or common                             on industry’s experience in providing
                                        incorporate into the FCRA the definition                 corporate control’’ used in the FACT                   clear and conspicuous affiliate sharing
                                        of ‘‘affiliate’’ used in the GLBA privacy                Act to have the same meaning as                        opt-out notices. Consumer groups
                                        regulations. In addition, a few industry                 ‘‘control’’ in the GLBA privacy rule. For              believed that incorporation of the
                                        commenters urged the Commission to                       example, if an individual owns 25                      standard and examples from the GLBA
                                        incorporate into the definition of                       percent of two companies, the                          privacy regulations was not adequate
                                        ‘‘affiliate’’ certain concepts from                      companies would be affiliates under                    because they did not believe that the
                                        California’s Financial Information                       both the GLBA and FCRA definitions.                    existing standard has proven sufficient
                                        Privacy Act so as to exempt certain                      However, the individual would not be                   to ensure effective privacy notices.
                                        classes of corporate affiliates from the                 considered an affiliate of the companies                  Except for certain non-substantive
                                        restrictions on affiliate sharing or                     because the definition of ‘‘affiliate’’ is             changes made for purposes of clarity,
                                        marketing.5                                              limited to companies.                                  the definition of ‘‘clear and
                                           The Commission does not believe                          The proposal also defined the term                  conspicuous’’ is the same as in the
                                        there is a substantive difference between                ‘‘company’’ to mean any corporation,                   proposal and is substantively the same
                                        the FACT Act definition of ‘‘affiliate’’                 limited liability company, business                    as the definition used in the GLBA
                                        and the definition of ‘‘affiliate’’ in                   trust, general or limited partnership,                 privacy rule. The Commission believes
                                        section 509 of the GLBA. The                             association, or similar organization. The              that the clear and conspicuous standard
                                        Commission is not aware of any                           proposed definition of ‘‘company’’                     for the affiliate marketing opt-out
                                        circumstances in which two entities                      excluded some entities that are                        notices should be substantially similar
                                        would be affiliates for purposes of the                  ‘‘persons’’ under the FCRA, including                  to the standard that applies to GLBA
                                        FCRA but not for purposes of the GLBA                    estates, cooperatives, and governments                 privacy notices because the affiliate
                                        privacy rule, or vice versa. Also, even                  or governmental subdivisions or                        marketing opt-out notice may be
                                        though affiliated entities have had to                   agencies, as well as individuals.                      provided on or with the GLBA privacy
                                        comply with different FCRA and GLBA                                                                             notice.
                                        formulations of the ‘‘affiliate’’ definition             Clear and Conspicuous                                     In defining ‘‘clear and conspicuous,’’
                                        since 1999, commenters did not identify                     Proposed § 680.3(c) defined the term                the Commission believes it is more
                                        any specific compliance difficulties or                  ‘‘clear and conspicuous’’ to mean                      appropriate to focus on the affiliate
                                        uncertainty resulting from the fact that                 reasonably understandable and                          marketing opt-out notices that are the
                                        the two statutes use somewhat different                  designed to call attention to the nature               subject of this rulemaking, rather than
                                        wording to describe what constitutes an                  and significance of the information                    adopting a generally applicable
                                        affiliate.                                               presented. Under this definition,                      definition governing all consumer
                                           Consistent with the definition of                     institutions would retain flexibility in               disclosures under the FCRA. This
                                        ‘‘affiliate’’ adopted by the Federal                     determining how best to meet the clear                 approach gives the Commission the
                                        banking agencies in the final medical                    and conspicuous standard. The                          flexibility to refine or clarify the clear
                                        information rules, the Commission                        supplementary information to the                       and conspicuous requirement for
                                        declines to incorporate into the                         proposal provided guidance regarding a                 different disclosures, if necessary.
                                        definition of ‘‘affiliate’’ exceptions for               number of practices that institutions                     The statute directs the Commission to
                                        entities regulated by the same or similar                might wish to consider in making their                 provide specific guidance regarding
                                        functional regulators, entities in the                   notices clear and conspicuous. These                   how to comply with the clear and
                                        same line of business, or entities that                  practices were derived largely from                    conspicuous standard. See 15 U.S.C.
                                        share a common brand or identity. See                    guidance included in the GLBA privacy                  1681s-3(a)(2)(B). For that reason, the
                                        70 FR 70664-70665 (Nov. 22, 2005).                       rule.                                                  Commission does not agree with
                                        These exceptions were incorporated                          Industry commenters urged the                       commenters that requested the
                                        into the California Financial                            Commission not to define ‘‘clear and                   elimination of the definition of ‘‘clear
                                                                                                 conspicuous’’ in the final rule. The                   and conspicuous’’ and related guidance.
                                           5 These commenters noted that the California law      principal objection these commenters                   Rather, the Commission believes it is
pwalker on PROD1PC71 with RULES2




                                        places no restriction on information sharing among       raised was that this definition would                  necessary to define ‘‘clear and
                                        affiliates if they: (1) are regulated by the same or                                                            conspicuous’’ in the final rule and
                                        similar functional regulators; (2) are involved in the
                                                                                                 significantly increase the risk of
                                        same broad line of business, such as banking,
                                                                                                                                                        provide specific guidance for how to
                                        insurance, or securities; and (3) share a common          6 See   Cal. Financial Code § 4053(c).                satisfy that standard in connection with
                                        brand identity.                                           7 See   16 C.F.R. 313.3(g).                           this notice.


                                   VerDate Aug<31>2005   20:51 Oct 29, 2007   Jkt 214001   PO 00000   Frm 00004    Fmt 4701   Sfmt 4700    E:\FR\FM\30OCR2.SGM   30OCR2
                                                         Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations                                         61427

                                           Accordingly, the final rule contains                 may include using distinctive type                    Finally, the proposal clarified that the
                                        two types of specific guidance on                       sizes, styles, fonts, paragraphs,                     requirement for a concise notice would
                                        satisfying the requirement to provide a                 headings, graphic devices, and                        be satisfied by the appropriate use of
                                        clear and conspicuous opt-out notice.                   appropriate groupings of information.                 one of the model forms contained in
                                        First, as in the proposal, the                          However, there is no need to use                      proposed Appendix A to the
                                        supplementary information to the final                  distinctive features, such as distinctive             Commission’s rule, although use of the
                                        rule describes certain techniques that                  type sizes, styles, or fonts, to                      model forms is not required. The
                                        may be used to make notices clear and                   differentiate an affiliate marketing opt-             Commission received no comments on
                                        conspicuous. These techniques are                       out notice from other components of a                 the proposed definition of ‘‘concise.’’
                                        described below. Second, the                            required disclosure, for example, where               The final rule renumbers the definition
                                        Commission has adopted model forms                      a GLBA privacy notice combines several                of ‘‘concise’’ as § 680.3(f). The reference
                                        that may, but are not required to, be                   opt-out disclosures in a single notice.               to the model forms has been moved to
                                        used to facilitate compliance with the                  Moreover, nothing in the clear and                    Appendix C to Part 698, but otherwise
                                        affiliate marketing notice requirements.                conspicuous standard requires                         the definition is adopted as proposed.
                                        The requirement for clear and                           segregation of the affiliate marketing
                                                                                                                                                      Consumer
                                        conspicuous notices would be satisfied                  opt-out notice when it is combined with
                                        by the appropriate use of one of the                    a GLBA privacy notice or other required                  Proposed paragraph (e) defined the
                                        model forms.                                            disclosures.                                          term ‘‘consumer’’ to mean an
                                           As noted in the supplementary                           The Commission recognizes that it                  individual. This definition is identical
                                        information to the proposal, institutions               will not be feasible or appropriate to                to the definition of ‘‘consumer’’ in
                                        may wish to consider a number of                        incorporate all of the methods described              section 603(c) of the FCRA.
                                        methods to make their notices clear and                 above all the time. The Commission                       Several commenters asked the
                                        conspicuous. The various methods                        recommends, but does not require, that                Commission to narrow the proposed
                                        described below for making a notice                     institutions consider the methods                     definition to apply only to individuals
                                        clear and conspicuous are suggestions                   described above in designing their opt-               who obtain financial products or
                                        that institutions may wish to consider in               out notices. The Commission also                      services primarily for personal, family,
                                        designing their notices. Use of any of                  encourages the use of consumer or other               or household purposes, in part to
                                        these methods alone or in combination                   readability testing to devise notices that            achieve consistency with the definition
                                        is voluntary. Institutions are not                      are understandable to consumers.                      of ‘‘consumer’’ in the GLBA. The
                                        required to use any particular method or                   Finally, although the Commission                   FCRA’s definition of ‘‘consumer,’’
                                        combination of methods to make their                    understands the concerns of some                      however, differs from, and is broader
                                        disclosures clear and conspicuous.                      industry commenters about the                         than, the definition of that term in the
                                        Rather, the particular facts and                        potential for civil liability, the                    GLBA. The Commission believes that
                                        circumstances will determine whether a                  Commission believes that these                        the use of distinct definitions of
                                        disclosure is clear and conspicuous.                    concerns are mitigated by the safe                    ‘‘consumer’’ in the two statutes reflects
                                           A notice or disclosure may be made                   harbors afforded by the model forms in                differences in the scope and objectives
                                        reasonably understandable through                       Appendix C to Part 698. The                           of each statute. For purposes of this
                                        various methods that include: using                     Commission notes that the affiliate                   definition, an individual acting through
                                        clear and concise sentences, paragraphs,                sharing opt-out notice under section                  a legal representative would qualify as
                                        and sections; using short explanatory                   603(d)(2)(A)(iii) of the FCRA, which                  a consumer. The final rule renumbers
                                        sentences; using bullet lists; using                    may be enforced through private rights                ‘‘consumer’’ as § 680.3(g) but otherwise
                                        definite, concrete, everyday words;                     of action, must be included in the GLBA               adopts it without change.
                                        using active voice; avoiding multiple                   privacy notice. Therefore, the affiliate
                                                                                                                                                      Eligibility Information
                                        negatives; avoiding legal and highly                    sharing opt-out notice generally is
                                        technical business terminology; and                     disclosed in a manner consistent with                    Proposed § 680.3(g) defined the term
                                        avoiding explanations that are imprecise                the clear and conspicuous standard set                ‘‘eligibility information’’ to mean any
                                        and are readily subject to different                    forth in the GLBA privacy regulations.                information the communication of
                                        interpretations. In addition, a notice or               Commenters did not identify any                       which would be a consumer report if
                                        disclosure may be designed to call                      litigation that has resulted from the                 the exclusions from the definition of
                                        attention to the nature and significance                requirement to provide a clear and                    ‘‘consumer report’’ in section
                                        of the information in it through various                conspicuous affiliate sharing opt-out                 603(d)(2)(A) of the FCRA did not apply.
                                        methods that include: using a plain-                    notice. The Commission believes that                  As proposed, eligibility information
                                        language heading; using a typeface and                  compliance with the examples and use                  would include a person’s own
                                        type size that are easy to read; using                  of the model forms, although optional,                transaction or experience information,
                                        wide margins and ample line spacing;                    should minimize the risk of litigation.               such as information about a consumer’s
                                        and using boldface or italics for key                                                                         account history with that person, and
                                        words. Further, institutions that provide               Concise                                               ‘‘other’’ information under section
                                        the notice on a Web page may use text                      Proposed § 680.21(b) defined the term              603(d)(2)(A)(iii), such as information
                                        or visual cues to encourage scrolling                   ‘‘concise’’ to mean a reasonably brief                from consumer reports or applications.
                                        down the page, if necessary, to view the                expression or statement. The proposal                    Most commenters generally supported
                                        entire notice and may take steps to                     also provided that a notice required by               the proposed definition of ‘‘eligibility
                                        ensure that other elements on the Web                   this part may be concise even if it is                information’’ as an appropriate means of
                                        site (such as text, graphics, hyperlinks,               combined with other disclosures                       simplifying the statutory terminology
                                        or sound) do not distract attention from                required or authorized by federal or                  without changing the scope of the
pwalker on PROD1PC71 with RULES2




                                        the notice. When a notice or disclosure                 state law. Such disclosures include, but              information covered by the rule. A
                                        is combined with other information,                     are not limited to, a GLBA privacy                    number of commenters requested that
                                        methods for designing the notice or                     notice, an affiliate sharing notice under             the Commission clarify that certain
                                        disclosure to call attention to the nature              section 603(d)(2)(A)(iii) of the FCRA,                types of information do not constitute
                                        and significance of the information in it               and other consumer disclosures.                       eligibility information, such as name,


                                   VerDate Aug<31>2005   20:51 Oct 29, 2007   Jkt 214001   PO 00000   Frm 00005   Fmt 4701   Sfmt 4700   E:\FR\FM\30OCR2.SGM   30OCR2
                                        61428            Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations

                                        address, telephone number, Social                       commenter asked how the                               regulation other circumstances that
                                        Security number, and other identifying                  supplementary information’s discussion                qualify as a pre-existing business
                                        information. One commenter requested                    of agents might affect the scope                      relationship, the Commission did not
                                        the exclusion of publicly available                     provisions of the rule.                               propose to exercise this authority. In the
                                        information from the definition.                           The supplementary information to the               final rule, the definition of ‘‘pre-existing
                                        Another commenter requested                             proposal stated that a person may act                 business relationship’’ has been
                                        additional clarification regarding the                  through an agent, including but not                   renumbered as §680.3(j).
                                        term ‘‘transaction or experience                        limited to a licensed agent (in the case                 Industry commenters suggested
                                        information.’’ A few commenters                         of an insurance company) or a trustee.                certain revisions to the proposed
                                        suggested that the Commission include                   The supplementary information also                    definition of ‘‘pre-existing business
                                        examples of what is and is not included                 provided that actions taken by an agent               relationship.’’ Many industry
                                        within ‘‘eligibility information.’’                     on behalf of a person that are within the             commenters asked the Commission to
                                        Finally, one commenter urged the                        scope of the agency relationship would                include in the definition statutory
                                        Commission to revise the definition to                  be treated as actions of that person. The             language relating to ‘‘a person’s licensed
                                        restate much of the statutory definition                Commission included these statements                  agent.’’ A number of these commenters
                                        of ‘‘consumer report’’ to eliminate the                 to address comprehensively the status of              noted that this concept was particularly
                                        need for cross-references.                              agents and to eliminate the need to refer             important to the insurance industry
                                           The final rule renumbers the                         specifically to licensed agents in the                where independent, licensed agents
                                        definition of ‘‘eligibility information’’ as            proposed definition of ‘‘pre-existing                 frequently act as the main point of
                                        680.3(h). The Commission has revised                    business relationship.’’ As discussed                 contact between the consumer and the
                                        the definition to clarify that the term                 below, many commenters believed that                  insurance company.
                                        ‘‘eligibility information’’ does not                    licensed agents should be expressly                      In the final rule, the phrase ‘‘or a
                                        include aggregate or blind data that does               included in the definition of ‘‘pre-                  person’s licensed agent’’ has been added
                                        not contain personal identifiers.                       existing business relationship.’’ The                 to the definition of ‘‘pre-existing
                                        Examples of personal identifiers include                Commission has revised the final rule in              business relationship’’ to track the
                                        account numbers, names, or addresses,                   response to those comments. By                        statutory language. For example, assume
                                        as indicated in the definition, as well as              specifically addressing licensed agents,              that a person is a licensed agent for the
                                        Social Security numbers, driver’s                       the final rule does not alter the general             affiliated ABC life, auto, and
                                        license numbers, telephone numbers, or                  principles of principal-agent                         homeowners’ insurance companies. A
                                        other types of information that,                        relationships that apply to all agents,               consumer purchases an ABC auto
                                        depending on the circumstances or                       not just licensed agents. The                         insurance policy through the licensed
                                        when used in combination, could                         Commission will treat actions taken by                agent. The licensed agent may use
                                        identify the individual.                                an agent on behalf of a person that are               eligibility information about the
                                           The Commission also believes that                    within the scope of the agency                        consumer obtained in connection with
                                        further clarification of, or exclusions                 relationship as actions of that person,               the ABC auto policy it sold to the
                                        from, the term ‘‘eligibility information,’’             regardless of whether the agent is a                  consumer to market ABC life and
                                        such as the categorical exclusion of                    licensed agent or not. The final rule                 homeowner’s insurance policies to the
                                        names, addresses, telephone numbers,                    renumbers the definition of ‘‘person’’ as             consumer for the duration of the pre-
                                        other identifying information, or                       § 680.3(i).                                           existing business relationship without
                                        publicly available information, would                                                                         offering the consumer the opportunity
                                                                                                Pre-Existing Business Relationship                    to opt out of that use.
                                        directly implicate the definitions of
                                        ‘‘consumer report’’ and ‘‘consumer                         Proposed § 680.3(i) defined the term                  Regarding the first basis for a pre-
                                        reporting agency’’ in sections 603(d) and               ‘‘pre-existing business relationship’’ to             existing business relationship (a
                                        (f), respectively, of the FCRA. The                     mean a relationship between a person                  financial contract in force), several
                                        Commission decided not to define the                    and a consumer based on the following:                industry commenters asked the
                                        terms ‘‘consumer report’’ and                           (1) a financial contract between the                  Commission to clarify that a financial
                                        ‘‘consumer reporting agency’’ in this                   person and the consumer that is in                    contract includes any in-force contract
                                        rulemaking and not to interpret the                     force; (2) the purchase, rental, or lease             that relates to a financial product or
                                        meaning of terms used in those                          by the consumer of that person’s goods                service covered by title V of the GLBA.
                                        definitions, such as ‘‘transaction or                   or services, or a financial transaction               One commenter objected to the
                                        experience’’ information. The                           (including holding an active account or               requirement that the contract be in force
                                        Commission also notes that financial                    a policy in force or having another                   on the date of the solicitation. This
                                        institutions have relied on these                       continuing relationship) between the                  commenter believed that the
                                        statutory definitions for many years.                   consumer and that person, during the                  Commission should interpret the statute
                                                                                                18-month period immediately preceding                 to permit the exception to apply if a
                                        Person                                                  the date on which a solicitation covered              contract is in force at the time the
                                          Proposed paragraph (h) defined the                    by this part is sent to the consumer; or              affiliate uses the information, rather
                                        term ‘‘person’’ to mean any individual,                 (3) an inquiry or application by the                  than when the solicitation is sent,
                                        partnership, corporation, trust, estate,                consumer regarding a product or service               noting that there may be a delay
                                        cooperative, association, government or                 offered by that person during the three-              between the use and the solicitation.
                                        governmental subdivision or agency, or                  month period immediately preceding                       The Commission has adopted the first
                                        other entity. This definition is identical              the date on which a solicitation covered              prong of the definition of ‘‘pre-existing
                                        to the definition of ‘‘person’’ in section              by this part is sent to the consumer.                 business relationship’’ as proposed.
                                        603(b) of the FCRA.                                        The proposed definition generally                  Although a comprehensive definition of
pwalker on PROD1PC71 with RULES2




                                          One commenter requested                               tracked the statutory definition                      the term ‘‘financial contract’’ has not
                                        clarification of how the proposed                       contained in section 624 of the FCRA,                 been included in the final rule, the
                                        definition of ‘‘person’’ would affect                   with certain revisions for clarity.                   Commission construes the statutory
                                        other provisions of the affiliate                       Although the statute gave the                         term ‘‘financial contract’’ at least to
                                        marketing rule. Specifically, this                      Commission the authority to identify by               include a contract that relates to a


                                   VerDate Aug<31>2005   20:51 Oct 29, 2007   Jkt 214001   PO 00000   Frm 00006   Fmt 4701   Sfmt 4700   E:\FR\FM\30OCR2.SGM   30OCR2
                                                         Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations                                                  61429

                                        consumer’s purchase or lease of a                       used in the definition of ‘‘pre-existing              relationship based on a consumer’s call
                                        financial product or service that a                     business relationship.’’                              to a central call center about a specific
                                        financial holding company could offer                      More generally, however, even though               product or service offered by an affiliate.
                                        under section 4(k) of the Bank Holding                  a ‘‘financial transaction’’ would include                In the supplementary information to
                                        Company Act of 1956 (12 U.S.C.                          in virtually all cases a financial contract           the proposal, the Commission noted that
                                        1843(k)). In addition, a financial                      which is in force, as noted above, the                certain elements of the definition of
                                        contract which is in force will, in                     Commission does not believe it is                     ‘‘pre-existing business relationship’’
                                        virtually all instances, qualify as a                   appropriate to state that the 18-month                were substantially similar to the
                                        ‘‘financial transaction,’’ as that term is              period begins to run when all                         definition of ‘‘established business
                                        used in the second prong of the                         outstanding contractual responsibilities              relationship’’ under the amended
                                        definition of ‘‘pre-existing business                   of both parties expire, regardless of                 Telemarketing Sales Rule (TSR) (16 CFR
                                        relationship.’’ The Commission does not                 whether specific transactions occur.                  310.2(n)). The TSR definition was
                                        agree with the suggestion that the                      Such a clarification would not                        informed by Congress’ intent that the
                                        financial contract should be in force on                appropriately address circumstances                   ‘‘established business relationship’’
                                        the date of use rather than on the date                 such as charge-offs, bankruptcies, early              exemption to the ‘‘do not call’’
                                        the solicitation is sent. The approach                  terminations, or extended periods of                  provisions of the Telephone Consumer
                                        taken in the proposed and final rule is                 credit inactivity that could trigger                  Protection Act (47 U.S.C. 227 et seq.)
                                        consistent with the approach used in                    commencement of the 18-month period.                  should be grounded on the reasonable
                                        the other two prongs of the statutory                   In addition, some contract provisions,                expectations of the consumer.8 The
                                        definition.                                             such as arbitration clauses and choice of             Commission observed that Congress’
                                           Industry commenters also suggested                   law provisions, may continue to have                  incorporation of similar language in the
                                        certain clarifications to the second basis              legal effect after all contractual                    definition of ‘‘pre-existing business
                                        for a pre-existing business                             performance has ended. The                            relationship’’9 suggested that it would
                                        relationship—a purchase, rental, or                     Commission does not believe that the                  be appropriate to consider the
                                        lease by the consumer of the person’s                   continued effectiveness of such                       reasonable expectations of the consumer
                                        goods or services, or a financial                       provisions should delay commencement                  in determining the scope of this
                                        transaction between the consumer and                    of the 18-month period.                               exception. Thus, the Commission
                                        the person during the preceding 18                         Nevertheless, the Commission                       explained that, for purposes of this
                                        months. Several industry commenters                     believes that a few examples may                      regulation, an inquiry would include
                                        noted that, notwithstanding the example                 provide useful guidance to facilitate                 any affirmative request by a consumer
                                        in the proposal regarding a lapsed                      compliance. For example, in the case of               for information after which the
                                        insurance policy, it was not clear from                 a closed-end mortgage or auto loan, the               consumer would reasonably expect to
                                        what point in time the 18-month period                  18-month period generally would begin                 receive information from the affiliate
                                        begins to run in the case of many                       to run when the consumer pays off the                 about its products or services.10
                                        purchase, rental, lease, or financial                   outstanding balance on the loan. In a                 Moreover, a consumer would not
                                        transactions. These commenters asked                    lease or rental transaction, the 18-month             reasonably expect to receive information
                                        the Commission to clarify that the 18-                  period generally would begin to run                   from the affiliate if the consumer did
                                        month period begins to run at the time                  when the lease or rental agreement                    not request information or did not
                                        all contractual responsibilities of either              expires or is terminated by mutual                    provide contact information to the
                                        party under the purchase, rental, lease,                agreement. In the case of general                     affiliate.
                                        or financial transaction expire. In                     purpose credit cards that are issued                     Industry commenters objected to the
                                        addition, some commenters indicated                     with an expiration date, the 18-month                 discussion in the supplementary
                                        that the term ‘‘active account’’ should be              period generally would begin to run                   information. Some of these commenters
                                        clarified to mean any account with                      when the consumer pays off the                        believed that looking to the reasonable
                                        outstanding contractual responsibilities                outstanding balance on the card and the               expectations of the consumer would
                                        on either side of an account                            card is either cancelled or expires                   narrow the scope of the exception and
                                        relationship, regardless of whether                     without being renewed.                                impose on institutions a subjective
                                        specific transactions do or do not occur                   Commenters also made certain                       standard that depended upon the
                                        on that account.                                        suggestions regarding the third basis for             consumer’s state of mind. These
                                           The Commission has adopted the                       a pre-existing business relationship—an               commenters also maintained that the
                                        second prong of the definition of ‘‘pre-                inquiry or application by the consumer                availability of the exception should not
                                        existing business relationship’’ as                     regarding a product or service offered by             depend upon the consumer both
                                        proposed. The Commission declines to                    the person during the preceding three                 requesting information and providing
                                        interpret the term ‘‘active account’’ as                months. Consumer groups urged the                     contact information to the affiliate.
                                        requested by some commenters. The                       Commission to clarify that an inquiry                 Some commenters noted that either
                                        Commission notes that section 603(r)(4)                 must be made of the specific affiliate,               requesting information or providing
                                        of the FCRA defines the term ‘‘account’’                rather than a general inquiry about a                 contact information should suffice to
                                        to have the same meaning as in section                  product or service. Industry commenters               establish an expectation of receiving
                                        903 of the Electronic Fund Transfer Act                 expressed concern about certain                       solicitations. Other commenters noted
                                        (EFTA). Under the EFTA, the term                        statements in the supplementary                       that consumers would not provide
                                        ‘‘account’’ means a demand deposit,                     information that explained the meaning
                                        savings deposit, or other asset account                 of an inquiry.                                           8 H.R. Rep. No. 102-317, at 14-15 (1991). See also
                                        established primarily for personal,                        The Commission does not agree that                 68 FR 4580, 4591-94 (Jan. 29, 2003).
                                        family, or household purposes. Some                     an inquiry must be made of a specific                    9 149 Cong. Rec. S13,980 (daily ed. Nov. 5, 2003)
pwalker on PROD1PC71 with RULES2




                                        commenters, however, apparently                         affiliate. Many affiliated institutions use           (statement of Senator Feinstein) (noting that the
                                        believed that the term ‘‘active account’’               a central call center to handle consumer              ‘‘pre-existing business relationship’’ definition ‘‘is
                                                                                                                                                      the same definition developed by the Federal Trade
                                        included extensions of credit. Credit                   inquiries. The clarification urged by                 Commission in creating a national ‘Do Not Call’
                                        extensions presumably would qualify as                  consumer groups could preclude the                    registry for telemarketers.’’)
                                        ‘‘another continuing relationship,’’ as                 establishment of a pre-existing business                 10See 68 FR at 4594.




                                   VerDate Aug<31>2005   20:51 Oct 29, 2007   Jkt 214001   PO 00000   Frm 00007   Fmt 4701   Sfmt 4700   E:\FR\FM\30OCR2.SGM   30OCR2
                                        61430            Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations

                                        contact information if they believed that               product information. According to these               overly broad, is not necessary given the
                                        the affiliate would already have the                    commenters, manufacturers also send                   breadth of the statutory definition of
                                        consumer’s contact information or                       solicitations to consumers about their                ‘‘pre-existing business relationship,’’
                                        would obtain it from the consumer’s                     products and services, drawing in part                and could result in circumvention of the
                                        financial institution. Some commenters                  on transaction or experience                          notice requirement.
                                        believed that the consumer should not                   information from the captive finance                     Proposed § 680.20(d)(1) provided four
                                        have to make an affirmative request for                 company. These commenters asked the                   examples of the pre-existing business
                                        information in order to have an inquiry.                Commission to clarify that the                        relationship exception. In the final rule,
                                        Commenters also expressed concern                       relationship between a manufacturer                   these examples have been renumbered
                                        that the discussion in the                              and a consumer qualifies as a pre-                    as § 680.3(j)(2)(i)-(iv), and revised to
                                        supplementary information would                         existing business relationship based on               illustrate the definition of ‘‘pre-existing
                                        require consumers to use specific words                 the purchase, rental, or lease of the                 business relationship,’’ rather than the
                                        to trigger the exception.                               manufacturer’s goods, or, alternatively,              corresponding exception.
                                           The Commission has adopted the                       to exercise its authority to add this                    The two examples relating to the first
                                        third prong of the definition of ‘‘pre-                 relationship as an additional basis for a             and second prongs of the definition of
                                        existing business relationship’’ as                     pre-existing business relationship. One               ‘‘pre-existing business relationship’’
                                        proposed. The Commission continues to                   commenter asked the Commission to                     have been revised in § 680.3(j)(2)(i) and
                                        believe that it is appropriate to consider              clarify that a pre-existing business                  (ii) to focus on a loan account creditor
                                        what the consumer says in determining                   relationship could be established even if             as the person with the pre-existing
                                        whether the consumer has made an                        the person provides a product or service              business relationship, but are otherwise
                                        inquiry about a product or service. It                  to the consumer without charging a fee.               substantively similar to the proposal.
                                        may not be necessary, however, for the                     The Commission does not believe it is              One commenter recommended
                                        consumer to provide contact                             necessary to add any additional bases                 expanding the example now contained
                                        information in all cases. As discussed                  for a pre-existing business relationship.             in § 680.3(j)(2)(i) to refer to the licensed
                                        below, the Commission has revised the                   The Commission acknowledges that a                    agent that wrote the policy or services
                                        examples of inquiries to illustrate                     pre-existing business relationship exists             the relationship. The Commission
                                        different circumstances.                                where a person owns the servicing                     believes that adding the term ‘‘licensed
                                           Consumer groups and NAAG urged                       rights to a consumer’s loan and such                  agent’’ to the definition is sufficient and
                                        the Commission not to expand the                        person collects payments from, or                     sees no reason to further complicate this
                                        definition of ‘‘pre-existing business                   otherwise deals directly with, the                    example to illustrate how the definition
                                        relationship’’ to include any additional                consumer. In the Commission’s view,                   applies to licensed agents.
                                        types of relationships. Industry                        however, that situation qualifies as a                   Section 680.3(j)(2)(iii) is new and
                                        commenters suggested a number of                        financial transaction and thus falls                  illustrates when a pre-existing business
                                        additional bases for establishing a pre-                within the second prong of the                        relationship is created in the context of
                                        existing business relationship. Several                 definition of ‘‘pre-existing business                 a mortgage loan. This example
                                        industry commenters believed that the                   relationship.’’ The Commission has                    specifically addresses circumstances
                                        term ‘‘pre-existing business                            included an example, discussed below,                 where either the loan or ownership of
                                        relationship’’ should be defined to                     to illustrate how the ownership of                    the servicing rights to the loan is sold
                                        include relationships arising out of the                servicing rights can create a pre-existing            to a third party. As this example
                                        ownership of servicing rights, a                        business relationship.                                illustrates, sale of the entire loan by the
                                        participation interest in lending                          A pre-existing business relationship               original lender terminates the financial
                                        transactions, and similar relationships.                does not arise solely from a                          transaction between the consumer and
                                        These commenters provided no further                    participation interest in a lending                   that lender and creates a new financial
                                        explanation for why such an expansion                   transaction because such an interest                  transaction between the consumer and
                                        was necessary. One commenter urged                      does not result in a financial contract or            the purchaser of the loan. However, the
                                        the Commission to expand the                            a financial transaction between the                   original lender’s sale of a fractional
                                        definition of ‘‘pre-existing business                   consumer and the participating party.                 interest in the loan to an investor does
                                        relationship’’ to apply to affiliates that              The Commission declines to add a                      not create a new financial transaction
                                        share a common trade name, share the                    specific provision for franchised                     between the consumer and the investor.
                                        same employees or representatives,                      dealers. The statute contains no special              When the original lender sells a
                                        operate out of the same physical                        provision addressing franchised dealers,              fractional interest in the consumer’s
                                        location or locations, and offer similar                as it does for licensed agents. Moreover,             loan to an investor but also retains an
                                        products.                                               a franchised dealer and a manufacturer                ownership interest in the loan, however,
                                           In addition, a number of industry                    generally are not affiliates and thus are             the original lender continues to have a
                                        commenters requested clarification of                   subject to the GLBA privacy rule                      pre-existing business relationship with
                                        the term ‘‘pre-existing business                        relating to information sharing with                  the consumer because the consumer
                                        relationship’’ as applied to                            non-affiliated third parties. The                     obtained a loan from the lender and the
                                        manufacturers that make sales through                   Commission also finds no basis for                    lender continues to own an interest in
                                        dealers. These commenters explained                     including within the meaning of ‘‘pre-                the loan. In addition, the ownership of
                                        that automobile manufacturers do not                    existing business relationship’’ any                  servicing rights coupled with direct
                                        sell vehicles directly to consumers, but                affiliate that shares a common trade                  dealings with the consumer results in a
                                        through franchised dealers. Vehicle                     name or representatives, or that operates             financial transaction between the
                                        financing may be arranged through a                     from the same location or offers similar              consumer and the owner of the
                                        manufacturer’s captive finance company                  products. Finally, the Commission                     servicing rights, thereby creating a pre-
pwalker on PROD1PC71 with RULES2




                                        or independent sources of financing.                    declines to add a provision that would                existing business relationship between
                                        These commenters noted that                             create a pre-existing business                        the consumer and the owner of the
                                        manufacturers often provide consumers                   relationship when a consumer obtains a                servicing rights. The Commission notes
                                        with information about warranty                         product or service without charge from                that a financial institution that owns
                                        coverage, recall notices, and other                     a person. Such a provision would be                   servicing rights generally has a customer


                                   VerDate Aug<31>2005   20:51 Oct 29, 2007   Jkt 214001   PO 00000   Frm 00008   Fmt 4701   Sfmt 4700   E:\FR\FM\30OCR2.SGM   30OCR2
                                                         Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations                                        61431

                                        relationship with the consumer and an                   opportunity to ask for the consumer’s                 encourage consumers to purchase
                                        obligation to provide a GLBA privacy                    contact information.                                  products and services from the person
                                        notice to the consumer.                                    Industry commenters recommended                    initiating the communications.
                                           The example in proposed                              deleting the example in proposed                         Congress gave the Commission the
                                        § 680.20(d)(1)(iii) regarding applications              § 680.20(d)(1)(iv) illustrating a call                authority to determine by regulation
                                        and inquiries elicited comment. Some                    center scenario where a consumer                      that other communications do not
                                        industry commenters urged the                           would not reasonably expect to receive                constitute a solicitation. The
                                        Commission to revise this example so                    information from an affiliate. In the final           Commission does not propose to
                                        that it does not depend upon the                        rule, the Commission has included a                   exercise this authority. The Commission
                                        consumer’s expectations or the                          positive example of an inquiry made by                solicited comment on whether, and to
                                        consumer providing contact                              a consumer through a call center in                   what extent, various tools used in
                                        information. These commenters noted,                    § 680.3(j)(2)(vii), while retaining the               Internet marketing, such as pop-up ads,
                                        for example, that the contact                           negative example from the proposal in                 may constitute solicitations as opposed
                                        information would be self-evident if the                § 680.3(j)(3)(i). In addition, the                    to communications directed at the
                                        consumer makes an e-mail request or                     Commission has included in                            general public, and whether further
                                        provides a return address on an                         § 680.3(j)(3)(ii) an example of a                     guidance was needed to address Internet
                                        envelope. These commenters also                         consumer call to ask about retail                     marketing.
                                        believed that in the case of a telephone                locations and hours, which does not                      Most commenters believed that the
                                        call initiated by a consumer, a captured                create a pre-existing business                        proposed definition tracked the
                                        telephone number should be sufficient                   relationship. This example is                         statutory definition contained in section
                                        to create an inquiry if the consumer                    substantively similar to the example                  624 of the FCRA. A number of industry
                                        requests information about products or                  from proposed § 680.20(d)(2)(iii).                    commenters, however, believed that the
                                        services.                                                  A new example in § 680.3(j)(3)(iii)                proposed definition misstated the types
                                                                                                illustrates a case where a consumer                   of marketing that would not qualify as
                                           In the final rule, the Commission has
                                                                                                responds to an advertisement that offers              a solicitation. Specifically, the first
                                        crafted three separate examples from
                                                                                                a free promotional item, but the                      sentence of proposed § 680.3(j)(2)
                                        proposed § 680.20(d)(1)(iii). Section
                                                                                                advertisement does not indicate that an               provided that ‘‘[a] solicitation does not
                                        680.3(j)(2)(iv) provides an example
                                                                                                affiliate’s products or services will be              include communications that are
                                        where a consumer applies for a product
                                                                                                marketed to consumers who respond to                  directed at the general public and
                                        or service, but does not obtain the
                                                                                                the advertisement. The example                        distributed without the use of eligibility
                                        product or service for which she
                                                                                                illustrates that the consumer’s response              information communicated by an
                                        applied. Contact information is not                     does not create a pre-existing business               affiliate.’’ These commenters believed
                                        mentioned in this example because the                   relationship because the consumer has                 that a solicitation should not include
                                        consumer presumably would have                          not made an inquiry about a product or                either marketing directed at the general
                                        supplied it on the application.                         service, but has merely responded to an               public or marketing distributed without
                                           Section 680.3(j)(2)(v) provides an                   offer for a free promotional item.                    the use of eligibility information
                                        example where a consumer makes a                        Similarly, if a consumer is directed by               communicated by an affiliate. Several
                                        telephone inquiry about a product or                    a company with which the consumer                     industry commenters also requested that
                                        service offered by a depository                         has a pre-existing business relationship              the Commission include the phrase ‘‘of
                                        institution and provides contact                        to contact the company’s affiliate to                 a product or service’’ in the introductory
                                        information to the institution, but does                receive a promotional item but the                    language for consistency with the
                                        not obtain a product or service from or                 company does not mention the                          statutory definition. Some industry
                                        enter into a financial transaction with                 affiliate’s products or services, the                 commenters sought clarification that
                                        the institution. The Commission does                    consumer’s contact with the affiliate                 certain types of communications would
                                        not believe that an institution’s capture               about the promotional item does not                   not constitute solicitations, for example,
                                        of a consumer’s telephone number                        create a pre-existing business                        marketing announcements delivered via
                                        during a telephone conversation with                    relationship between the consumer and                 pre-recorded call center messages,
                                        the consumer about the institution’s                    the affiliate.                                        automated teller machine screens, or
                                        products or services is sufficient to                                                                         Internet sites, or product information
                                        create an inquiry. In that circumstance,                Solicitation
                                                                                                                                                      provided at or through educational
                                        to ensure that an inquiry has been made,                   Proposed § 680.3(j) defined the term               seminars, customer appreciation events,
                                        the institution should ask the consumer                 ‘‘solicitation’’ to mean marketing                    or newsletters.
                                        to provide his or her contact                           initiated by a person to a particular                    NAAG urged the Commission to
                                        information, or confirm with the                        consumer that is based on eligibility                 clarify the portion of the definition that
                                        consumer that the consumer has a pre-                   information communicated to that                      refers to ‘‘a particular consumer.’’
                                        existing business relationship with an                  person by its affiliate and is intended to            NAAG believed that mass mailings of
                                        affiliate.                                              encourage the consumer to purchase a                  the same or similar marketing materials
                                           Section 680.3(j)(2)(vi) provides an                  product or service. The proposed                      to a large group of consumers could fall
                                        example where the consumer makes an                     definition further clarified that a                   within the definition of ‘‘solicitation,’’
                                        e-mail inquiry about a product or                       communication, such as a telemarketing                so long as the marketing is based on
                                        service offered by a creditor, but does                 solicitation, direct mail, or e-mail,                 eligibility information received from an
                                        not separately provide contact                          would be a solicitation if it is directed             affiliate. NAAG expressed concern that
                                        information. In that case, the consumer                 to a specific consumer based on                       some might construe the term
                                        provides the creditor with contact                      eligibility information. The proposed                 ‘‘particular’’ to narrow the meaning of a
pwalker on PROD1PC71 with RULES2




                                        information in the form of the                          definition did not, however, include                  ‘‘solicitation.’’
                                        consumer’s e-mail address. In addition,                 communications that were directed at                     With regard to Internet marketing,
                                        e-mail communications, unlike                           the general public without regard to                  industry commenters urged the
                                        telephone communications, do not                        eligibility information, even if those                Commission not to address such
                                        provide institutions with the same                      communications were intended to                       practices in this rulemaking. These


                                   VerDate Aug<31>2005   20:51 Oct 29, 2007   Jkt 214001   PO 00000   Frm 00009   Fmt 4701   Sfmt 4700   E:\FR\FM\30OCR2.SGM   30OCR2
                                        61432            Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations

                                        commenters believed that the definition                 solicitation depends upon the facts and               by proposing to place certain
                                        of ‘‘solicitation’’ should provide specific             circumstances. The Commission has                     responsibilities on the ‘‘communicating
                                        guidance that ‘‘pop-up’’ ads and other                  decided not to make those                             affiliate’’ and other responsibilities on
                                        forms of Internet marketing generally                   determinations in this rulemaking.                    the ‘‘receiving affiliate.’’
                                        were directed to the general public and                 Thus, the Commission is not adopting                     Proposed § 680.20(a) set forth the
                                        not based on eligibility information                    special rules or guidance regarding                   duties of a communicating affiliate. That
                                        received from an affiliate, or that such                Internet-based marketing; whether                     section required the communicating
                                        marketing would fall within an                          Internet-based marketing is a                         affiliate to provide a notice to the
                                        exception. NAAG believed that such                      solicitation in a particular case will be             consumer before a receiving affiliate
                                        advertisements should be treated as                     determined according to the same                      could use eligibility information to
                                        solicitations if they were based on any                 criteria that apply to other means of                 make or send solicitations to the
                                        eligibility information received from an                marketing. The Commission also                        consumer. Under the proposal, the opt-
                                        affiliate. Consumer groups believed that                declines to exclude categorically from                out notice would state that eligibility
                                        if an affiliate’s pop-up ads and other                  the definition of ‘‘solicitation’’                    information may be communicated to
                                        Internet marketing were the result of                   marketing messages on voice response                  and used by the receiving affiliate to
                                        specific actions by the consumer or                     units, ATM screens, or other forms of                 make or send solicitations to the
                                        information collected based upon a                      media. Marketing delivered via such                   consumer regarding the affiliate’s
                                        consumer’s experience on the Internet,                  media may be solicitations if such                    products and services, and would give
                                        then such marketing should be                           marketing is targeted to a particular                 the consumer a reasonable opportunity
                                        considered solicitations. These                         consumer based on eligibility                         and a simple method to opt out.
                                        commenters also believed that pop-up                    information received from an affiliate.                  Proposed § 680.20(a) also contained
                                        ads and other Internet marketing                        For example, a marketing message on an                two rules of construction relating to the
                                        targeted to all customers of a company                  ATM screen would be a solicitation if it              communicating affiliate’s duty to
                                        should be treated as solicitations if                   is targeted to a particular consumer                  provide the notice. The first rule of
                                        based on the consumer’s experience on                   based on eligibility information received             construction would have allowed the
                                        the Internet.                                           from an affiliate, but would not be a                 notice to be provided either in the name
                                           Section 680.3(k) of the final rule                   solicitation if it is delivered to all                of a person with which the consumer
                                        contains the definition of ‘‘solicitation.’’            consumers that use the ATM.                           currently does or previously has done
                                        The definition has been revised to track                   Similarly, the Commission declines to              business or in one or more common
                                        the statutory language more closely. The                exclude educational seminars, customer                corporate names shared by members of
                                        phrase ‘‘of a product or service’’ has                  appreciation events, focus group                      an affiliated group of companies that
                                        been added to the definition, as                        invitations, and similar forms of                     includes the common corporate name
                                        requested by some commenters. To                        communication from the definition of                  used by that person. The rule of
                                        ensure consistency with the definition                  ‘‘solicitation.’’ The Commission believes             construction also would have provided
                                        of ‘‘pre-existing business relationship,’’              that such activities must be evaluated                alternatives regarding the manner in
                                        the phrase ‘‘or obtain’’ has been retained              according to the facts and circumstances              which the notice could be given, such
                                        so that the definition of ‘‘solicitation’’              and some of those activities may be                   as by allowing the communicating
                                        will include marketing for the rental or                coupled with, or a prelude to, a                      affiliate to provide the notice either
                                        lease of goods or services, financial                   solicitation. For example, an invitation              directly to the consumer, through an
                                        transactions, and financial contracts.                  to a financial educational seminar                    agent, or through a joint notice with one
                                        The Commission has also deleted as                      where the invitees are selected based on              or more of its affiliates. The second rule
                                        unnecessary the reference to                            eligibility information received from an              of construction would have clarified
                                        communications ‘‘distributed without                    affiliate may be a solicitation if the                that, to avoid duplicate notices, it would
                                        the use of eligibility information                      seminar is used to solicit the consumer               not be necessary for each affiliate that
                                        communicated by an affiliate.’’                         to purchase investment products or                    communicates the same eligibility
                                        Marketing that is undertaken without                    services.                                             information to provide an opt-out notice
                                        the use of eligibility information                                                                            to the consumer, so long as the notice
                                        received from an affiliate is not covered               You                                                   provided by the affiliate that initially
                                        by the affiliate marketing rule.                          The term ‘‘you’’ is defined as persons              communicated the information was
                                        Moreover, there is no restriction on                    described in § 680.1(a) and the                       broad enough to cover use of that
                                        using eligibility information received                  definition has been renumbered as                     information by each affiliate that
                                        from an affiliate in marketing directed at              § 680.3(l).                                           received and used it to make
                                        the general public, such as radio,                                                                            solicitations. The proposal included
                                                                                                Section 680.21 Affiliate Marketing Opt-               examples to illustrate how each of these
                                        television, or billboard advertisements.
                                                                                                out and Exceptions                                    rules of construction would work.
                                        The phrase ‘‘to a particular consumer’’
                                        has been retained because it is part of                    The Commission proposed to                            Proposed § 680.20(b) set forth the
                                        the statutory definition. The                           establish certain rules relating to the               general duties of a receiving affiliate.
                                        Commission does not believe that the                    requirement to provide the consumer                   That section would have prohibited the
                                        phrase ‘‘to a particular consumer’’                     with notice and a reasonable                          receiving affiliate from using eligibility
                                        excludes large-scale marketing                          opportunity and a simple method to opt                information it received from an affiliate
                                        campaigns from the definition of                        out of a person’s use of eligibility                  to make solicitations to the consumer
                                        ‘‘solicitation’’ because, within such                   information that it obtained from an                  unless, prior to such use, the consumer
                                        campaigns, eligibility information                      affiliate for the purpose of making or                was provided an opt-out notice that
                                        received from an affiliate may be used                  sending solicitations to the consumer.                applied to that affiliate’s use of
pwalker on PROD1PC71 with RULES2




                                        to target individual consumers.                         The Commission noted that the statute                 eligibility information to make
                                           The definition of ‘‘solicitation’’ does              is ambiguous because it does not specify              solicitations and a reasonable
                                        not distinguish between different                       which affiliate must provide the opt-out              opportunity and simple method to opt
                                        mediums. A determination of whether a                   notice to the consumer. The                           out, and the consumer did not opt out
                                        marketing communication constitutes a                   Commission addressed this ambiguity                   of that use.


                                   VerDate Aug<31>2005   20:51 Oct 29, 2007   Jkt 214001   PO 00000   Frm 00010   Fmt 4701   Sfmt 4700   E:\FR\FM\30OCR2.SGM   30OCR2
                                                         Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations                                        61433

                                           Most industry commenters                             § 680.20(b) into proposed § 680.20(a) to              unlikely to be an entity from which the
                                        maintained that the final rule should                   focus exclusively on the responsibilities             consumer would expect to receive
                                        not require any specific entity to                      of the receiving affiliate. One                       important communications. NAAG also
                                        provide the opt-out notice, but should                  commenter identified certain drafting                 requested that the Commission revise
                                        only require that the consumer be                       problems it believed arose from the fact              certain portions of the proposed rules of
                                        provided an opt-out notice covering an                  that the proposal focused alternately on              construction, for example, by deleting
                                        affiliate’s use of eligibility information              the communicating affiliate and the                   from proposed § 680.20(a)(2)(i) the
                                        before a solicitation is made to the                    receiving affiliate and that those two                phrase ‘‘or previously has done
                                        consumer. These commenters believed                     entities may be regulated by different                business’’ based on concerns that it
                                        the final rule should provide flexibility               regulatory agencies.                                  would render the notice partially
                                        and allow either the receiving affiliate,                  A few industry commenters                          ineffective because, even without this
                                        the communicating affiliate, or any                     acknowledged that the Commission had                  phrase, the notice would not be required
                                        other affiliate to provide the opt-out                  raised legitimate concerns in the                     for 18 months after a customer
                                        notice. These commenters maintained                     supplementary information to the                      relationship ends. NAAG also requested
                                        that the statute is not ambiguous and                   proposal about how meaningful a notice                that the Commission revise proposed
                                        does not impose any obligations on a                    could be when provided by a receiving                 §§ 680.20(a)(2)(B)(2) and (a)(2)(C) to
                                        specific entity, such as the                            affiliate that the consumer may not                   clarify that the common name used
                                        communicating affiliate, to provide the                 recognize. These commenters believed                  must be one that includes the name
                                        opt-out notice. Some of these                           that this concern could be addressed                  used by the person providing the opt-
                                        commenters acknowledged, however,                       through other means. One commenter,                   out notice.
                                        that the communicating affiliate would,                 for example, suggested the following                     In the proposal, the Commission did
                                        as a practical matter, most likely give                 introductory language in paragraph                    not require the opt-out notice to be
                                        the opt-out notice.                                     (a)(2): ‘‘The notice required by this                 provided in writing. The Commission
                                           A number of industry commenters                      paragraph (a) may be provided either in               noted, however, that it contemplated
                                        expressed concern that the proposed                     the name of the bank receiving the                    that the opt-out notice would be
                                        rule would create a basis for civil                     information (provided that such bank                  provided to the consumer in writing or,
                                        liability against the communicating                     also identifies the affiliate which                   if the consumer agrees, electronically.
                                        affiliate under section 624 because that                provided such information), in the name               The proposal solicited comment on
                                        section is covered by the FCRA’s private                of the affiliate which provided such                  whether there were circumstances in
                                        right of action provisions in sections                  information, or in one or more common                 which it would be necessary and
                                        616 and 617. Some commenters noted                      corporate names shared by such bank                   appropriate to allow oral notice and opt
                                        that, to avoid exposure to civil liability,             and the affiliate which provided the                  out and how an oral notice could satisfy
                                        a communicating affiliate would have to                 information, and may be provided in the               the clear and conspicuous standard in
                                        require receiving affiliates to commit to               following manner . . .’’ Another industry             the statute.
                                        not using the information to make                       commenter expressed support for the                      Industry commenters believed that
                                        solicitations, give an opt-out notice                   rules of construction with revisions to               the final rule should permit oral notices.
                                        whenever they share eligibility                         allow the use of brand names and trade                These commenters identified
                                        information with affiliates, or never                   names, as well as the actual ‘‘corporate’’            circumstances in which a relationship is
                                        share eligibility information with                      name, and to allow an agent or affiliate              established by telephone as an example
                                        affiliates. These commenters maintained                 to send a common notice that uses more                of when oral notice would be
                                        that, in many cases, none of these                      than one common name in a non-                        appropriate. Some industry commenters
                                        solutions would be practical, for                       deceptive manner.                                     also noted that an oral notice should be
                                        example, where a receiving affiliate                       Consumer group commenters                          permitted because the affiliate sharing
                                        negligently failed to comply with a                     supported making the communicating                    opt-out notice under section
                                        commitment not to make solicitations                    affiliate responsible for providing the               603(d)(2)(A)(iii) may be given orally, as
                                        unless notice has been given to the                     notice and opportunity to opt out. These              well as in writing or electronically.
                                        consumer.                                               commenters believed that allowing the                 Several industry commenters noted that
                                           Several industry commenters noted                    receiving affiliate to send the opt-out               the Commission in the Telemarketing
                                        that the language in section 624(a)(1)(A)               notice would invite consumer confusion                Sales Rule and the OCC in regulations
                                        that ‘‘information may be                               as to whether or not the opt-out notice               relating to debt cancellation contracts
                                        communicated’’ could be included in an                  itself is a solicitation. These                       and debt suspension agreements have
                                        opt-out notice provided by the receiving                commenters also believed that the                     permitted clear and conspicuous oral
                                        affiliate. These commenters also                        Commission should require the names                   notices. These commenters did not
                                        believed that the statutory requirement                 of the receiving affiliates to be clearly             believe that allowing oral notice in these
                                        that the Commission consider existing                   disclosed to the consumer. Consumer                   circumstances had created any
                                        affiliate sharing notification practices                groups also believed that the proposed                enforcement difficulties for the
                                        and permit coordinated and                              rules of construction struck a reasonable             Commission or OCC. Other industry
                                        consolidated notices did not imply that                 balance by allowing commonly named                    commenters noted that institutions
                                        the communicating affiliate should be                   affiliates to share a notice while making             could demonstrate compliance through
                                        responsible for providing the opt-out                   clear that a notice from an affiliate with            the use of scripts or by monitoring or
                                        notice.                                                 whom the consumer is not familiar will                recording calls.
                                           Industry commenters made several                     not be effective. They also suggested                    Consumer groups believed that a
                                        suggestions for revising the language of                that the company with the pre-existing                written opt-out notice should be
                                        the proposal. Some suggested revising                   business relationship should be clearly               required in all cases. These commenters
pwalker on PROD1PC71 with RULES2




                                        proposed § 680.20(a) to omit any                        marked on the opt-out notice.                         believed that, with an oral notice, it is
                                        reference to the communicating affiliate                   NAAG believed that a receiving                     impossible to ensure that a consumer
                                        and to incorporate the passive voice                    affiliate should not be permitted to give             receives the appropriate notice or
                                        used in the statute. Others suggested                   the opt-out notice solely on its own                  information on the right to opt out. They
                                        various ways of merging proposed                        behalf because a receiving affiliate is               believed that allowing oral notices


                                   VerDate Aug<31>2005   20:51 Oct 29, 2007   Jkt 214001   PO 00000   Frm 00011   Fmt 4701   Sfmt 4700   E:\FR\FM\30OCR2.SGM   30OCR2
                                        61434            Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations

                                        would create enforcement barriers for                   related opt-out notices. The Commission               proposal did little to address those
                                        regulators. Consumer groups also                        is not persuaded that there are any                   concerns. For practical reasons, the
                                        believed that institutions have strong                  circumstances where it would be                       Commission believes that affiliate
                                        economic incentives to prevent                          necessary to provide an oral opt-out                  marketing opt-out notices typically
                                        consumers from opting out and would                     notice. A number of key exceptions to                 would be provided by an affiliate that
                                        engage in misrepresentations or                         the initial notice and opt-out                        has or has previously had a pre-existing
                                        otherwise use language in their scripts                 requirement, such as the pre-existing                 business relationship with the
                                        that is designed to discourage                          business relationship exception,                      consumer, or as part of a joint notice,
                                        consumers from opting out. NAAG                         consumer-initiated communication                      whether or not required by the rule.
                                        believed that oral notices would not                    exception, and consumer authorization                    The Commission appreciates industry
                                        meet the statutory requirement for a                    or request exception, may be triggered                concerns about civil liability and has
                                        clear, conspicuous, and concise notice,                 by an oral communication with the                     revised the final rule to address those
                                        that consumers would be less likely to                  consumer. It also could be more difficult             concerns. Specifically, in contrast to the
                                        comprehend oral notices, and                            for the Commission to monitor and                     proposal, the final rule does not impose
                                        enforcement would be more difficult if                  enforce compliance with the final rule                duties on any affiliate other than the
                                        oral opt-out notices were allowed.                      if oral opt-out notices were allowed.                 affiliate that intends to use shared
                                           Section 680.21(a) of the final rule                  Accordingly, the final rule requires the              eligibility information to make
                                        contains the revised provisions                         opt-out notice to be provided in writing              solicitations to the consumer. Although
                                        regarding the initial notice and opt-out                or, if the consumer agrees,                           an opt-out notice must be provided by
                                        requirement. Although the language of                   electronically.                                       an affiliate that has or has previously
                                        this section has been revised and                          Section 680.21(a)(3) identifies those              had a pre-existing business relationship
                                        simplified, the substance of this                       affiliates who may provide the initial                with the consumer (or as part of a joint
                                        provision is substantially similar to the               opt-out notice. This section provides                 notice), that affiliate has no duty to
                                        proposal.                                               that the initial opt-out notice must be               provide such a notice. Instead, the final
                                           Section 680.21(a)(1) sets forth the                  provided either by an affiliate that has              rule provides that absent such a notice,
                                        general rule. This section contains the                 or has previously had a pre-existing                  an affiliate must not use shared
                                        three conditions that must be met before                business relationship with the                        eligibility information to make
                                        a person may use eligibility information                consumer, or as part of a joint notice                solicitations to the consumer. Industry
                                        about a consumer that it receives from                  from two or more members of an                        concerns about civil liability also may
                                        an affiliate to make a solicitation for                 affiliated group of companies, provided               be mitigated to some extent by the
                                        marketing purposes to the consumer.                     that at least one of the affiliates on the            Supreme Court’s recent decision in
                                        First, it must be clearly and                           joint notice has or has previously had a              Safeco Ins. Co. of America v. Burr, 127
                                        conspicuously disclosed to the                          pre-existing business relationship with               S. Ct. 2201 (June 4, 2007).
                                        consumer in writing or, if the consumer                 the consumer. The final rule follows the                 Finally, many institutions currently
                                        agrees, electronically, in a concise                    general approach taken in the proposal                require consumers to provide their
                                        notice that the person may use shared                   to ensure that the notice is provided by              Social Security numbers when
                                        eligibility information to make                         an entity known to the consumer, while                exercising their existing GLBA and
                                        solicitations to the consumer. Second,                  eliminating potentially ambiguous and                 FCRA opt-out rights. The Commission
                                        the consumer must be provided a                         confusing terms like ‘‘communicating                  believes that institutions likely would
                                        reasonable opportunity and a reasonable                 affiliate’’ and ‘‘receiving affiliate.’’              follow their existing practice with
                                        and simple method to opt out of the use                    The Commission also has eliminated                 regard to affiliate marketing opt-outs. To
                                        of that eligibility information to make                 as unnecessary the rules of construction.             combat identity theft and prevent
                                        solicitations to the consumer. Third, the               Joint notices are now addressed directly              ‘‘phishing,’’ however, the Commission,
                                        consumer must not have opted out.                       in § 680.21(a)(3). The Commission also                along with many institutions, has been
                                        Section 680.21(a)(2) of the final rule                  has concluded that the provisions from                educating consumers not to provide
                                        provides an example of the general rule.                the proposal relating to notice provided              their Social Security numbers to
                                           The Commission has concluded that                    by an agent are unnecessary. General                  unknown entities. Furthermore, as co-
                                        the opt-out notice may not be provided                  agency principles, however, continue to               Chair of the President’s Identity Theft
                                        orally, but must be provided in writing                 apply. An affiliate that has or has                   Task Force, the Commission has made
                                        or, if the consumer agrees,                             previously had a pre-existing business                a commitment to examine and
                                        electronically. The statute requires the                relationship with the consumer may                    recommend ways to limit the private
                                        Commission to consider the affiliate                    direct its agent to provide the opt-out               sector’s use of Social Security numbers.
                                        sharing notification practices employed                 notice on its behalf.                                    The approach recommended by
                                        on the date of enactment and to ensure                     The Commission has concluded that                  industry commenters would allow an
                                        that notices and disclosures may be                     the statute’s silence with regard to                  unknown entity not only to provide an
                                        coordinated and consolidated in                         which affiliates may provide the opt-out              affiliate marketing opt-out notice to the
                                        promulgating regulations. The affiliate                 notice makes the statute ambiguous on                 consumer, but also to require the
                                        sharing notice under section                            this point, despite industry comments to              consumer to reveal his or her Social
                                        603(d)(2)(A)(iii) of the FCRA generally                 the contrary. The Commission also                     Security number to that unknown entity
                                        must be included in the GLBA privacy                    continues to believe that consumers are               in order to exercise the opt-out right.
                                        notice, which must be provided in                       more likely to pay attention to a notice              Such an approach would send
                                        writing, or if the consumer agrees,                     provided by a person known to the                     conflicting messages to consumers about
                                        electronically. Requiring the affiliate                 consumer. The Commission remains                      providing Social Security numbers to
                                        marketing opt-out notice to be provided                 concerned that a notice provided by an                unknown entities. This approach also
pwalker on PROD1PC71 with RULES2




                                        in writing, or if the consumer agrees,                  entity unknown to the consumer may                    would be inconsistent with the
                                        electronically, is thus consistent with                 not provide meaningful or effective                   Commission’s current efforts to develop
                                        existing affiliate sharing notification                 notice, and that consumers may ignore                 a comprehensive record on the uses of
                                        practices and promotes coordination                     or discard notices provided by unknown                the Social Security number in the
                                        and consolidation of the three privacy-                 entities. Industry comments on the                    private sector and evaluate their


                                   VerDate Aug<31>2005   20:51 Oct 29, 2007   Jkt 214001   PO 00000   Frm 00012   Fmt 4701   Sfmt 4700   E:\FR\FM\30OCR2.SGM   30OCR2
                                                         Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations                                         61435

                                        necessity, as recommended by the                        ‘‘to make’’ a solicitation. Similarly, the            marketing purposes to a consumer if: (a)
                                        President’s Identity Theft Task Force.11                legislative history does not contain                  the person receives eligibility
                                                                                                guidance as to the meaning of ‘‘making’’              information from an affiliate; (b) the
                                        Making Solicitations
                                                                                                a solicitation. Nevertheless, the                     person uses that eligibility information
                                           The proposal repeatedly referred to                  Commission believes it is important to                to do one of the following—identify the
                                        ‘‘making or sending’’ solicitations.                    provide clear guidance regarding what                 consumer or type of consumer to receive
                                        Several commenters suggested revising                   activities result in making a solicitation.           a solicitation, establish the criteria used
                                        the regulation to eliminate all references                 One commenter suggested that the                   to select the consumer to receive a
                                        to ‘‘sending’’ solicitations. These                     test for making a solicitation should                 solicitation, or decide which of its
                                        commenters believed that the statute                    turn on whether an affiliate having a                 products or services to market to the
                                        only concerns the use of eligibility                    pre-existing business relationship with               consumer or tailor its solicitation to that
                                        information to ‘‘make’’ solicitations and               the consumer retains the discretion to                consumer; and (c) as a result of the
                                        does not address ‘‘sending’’                            determine whether or not to send the                  person’s use of the eligibility
                                        solicitations. Commenters expressed                     solicitation. This commenter provided                 information, the consumer is provided a
                                        concern that by referring to ‘‘sending’’                an example where a financial institution              solicitation about the person’s products
                                        solicitations, the proposal would apply                 obtains a list of an affiliate’s customers            or services.
                                        the notice and opt-out requirements to                  from a common shared database, applies                   The Commission recognizes that
                                        servicers that send solicitations on                    its own criteria to this list, and then               several common industry practices may
                                        behalf of another entity.                               requests the affiliate with an existing               complicate application of the rule
                                           The Commission has revised the final                 business relationship to solicit the                  outlined in § 680.21(b)(1). First,
                                        rule to eliminate all combined                          affiliate’s own customers to purchase                 affiliated groups often use a common
                                        references to ‘‘making or sending’’                     the financial institution’s products or               database as the repository for eligibility
                                        solicitations. The general rule in section              services. (Thus, the financial institution            information obtained by various
                                        624(a)(1), along with the duration                      would be using eligibility information to             affiliates, and information in that
                                        provisions in section 624(a)(3) and the                 select a list of its affiliate’s customers to         database may be accessible to multiple
                                        pre-existing business relationship                      receive the financial institution’s                   affiliates. Second, affiliated companies
                                        exception in section 624(a)(4)(A), refer                marketing materials.) This commenter                  often use service providers to perform
                                        to ‘‘making’’ or ‘‘to make’’ a solicitation.            believed that section 624 should not                  marketing activities, and some of those
                                        Other provisions of the statute, such as                apply so long as the affiliate with the               service providers may provide services
                                        the consumer choice provision in                        existing business relationship has                    for a number of different affiliates.
                                        section 624(a)(2)(A), the service                       discretion to determine whether or not                Third, an affiliate may use its own
                                        provider exception in section                           to send the solicitations. This                       eligibility information to market the
                                        624(a)(4)(C), the non-retroactivity                     commenter also maintained that the                    products or services of another affiliate.
                                        provision in section 624(a)(5), and the                 applicability of section 624’s notice and             Sections 680.21(b)(2)-(5) address these
                                        definition of ‘‘pre-existing business                   opt-out requirement should depend on                  issues.
                                        relationship’’ in section 624(d)(1), refer              who markets the product and not on                       Section 680.21(b)(2) clarifies that a
                                        to ‘‘sending’’ or ‘‘to send’’ a solicitation.           what the product is or whose product it               person may receive eligibility
                                        The verb ‘‘to send,’’ as used in the                    is.                                                   information from an affiliate in various
                                        statute, refers to a ministerial act that a                Nothing in the statute indicates that              ways, including when the affiliate
                                        service provider, such as a mail house,                 the discretion of the affiliate providing             places that information into a common
                                        performs for the person making the                      the eligibility information to determine              database that the person may access. Of
                                        solicitation, (see 15 U.S.C. 1681s-                     whether or not to send a solicitation on              course, receipt of eligibility information
                                        3(a)(4)(C)), or indicates the point in time             behalf of a person who has received                   from an affiliate is only one element of
                                        after which solicitations are no longer                 eligibility information from that affiliate           the rule outlined in § 680.21(b)(1). In the
                                        permitted. See 15 U.S.C. 1681s-                         is the test for what constitutes making               case of a common database, use of the
                                        3(d)(1)(B) and (C).                                     a solicitation. Rather, the statute focuses           eligibility information will be the key
                                           The Commission concludes that                        on whether the person receiving                       element in determining whether a
                                        ‘‘making’’ and ‘‘sending’’ solicitations                eligibility information from an affiliate             person has made a solicitation.
                                        are different activities and that the focus             uses that information to market its                      Section 680.21(b)(3) provides that a
                                        of the statute is primarily on the                      products or services to consumers. A                  person receives or uses an affiliate’s
                                        ‘‘making’’ of solicitations. For example,               ‘‘discretion to send’’ test would also                eligibility information if a service
                                        a service provider may send a                           inappropriately link the terms ‘‘making’’             provider acting on behalf of the person
                                        solicitation on behalf of another entity,               and ‘‘sending’’ in a manner that would                receives or uses that information in the
                                        but it is the entity on whose behalf the                promote confusion and undercut                        manner described in §§ 680.21(b)(1)(i)
                                        solicitation is sent that is making the                 arguments made by commenters urging                   or (b)(1)(ii), except as provided in
                                        solicitation and thus is subject to the                 the Commission to disassociate the two                § 680.21(b)(5), which is discussed
                                        general prohibition on making a                         terms. Finally, a ‘‘discretion to send’’              below. Section 680.21(b)(3) also
                                        solicitation, unless the consumer is                    test could foster circumvention of the                provides that all relevant facts and
                                        given notice and an opportunity to opt                  notice and opt-out requirement, restrict              circumstances will determine whether a
                                        out. Accordingly, the Commission has                    the ability of consumers to prohibit                  service provider is acting on behalf of a
                                        revised the final rule to refer to                      solicitations in a manner not                         person when it receives or uses an
                                        ‘‘making’’ a solicitation, except where                 contemplated by the statute, and make                 affiliate’s eligibility information in
                                        the statute specifically refers to                      it difficult for the Commission to                    connection with marketing that person’s
                                        ‘‘sending’’ solicitations.                              administer and enforce the statute.                   products or services.
pwalker on PROD1PC71 with RULES2




                                           The statute, however, does not                          Section 680.21(b) of the final rule                   Section 680.21(b)(4) addresses
                                        describe what a person must do in order                 clarifies what constitutes ‘‘making’’ a               constructive sharing. In the
                                                                                                solicitation for purposes of this part.               supplementary information to the
                                           11See Combatting Identity Theft: A Strategic Plan,   Section 680.21(b)(1) provides that a                  proposal, the Commission solicited
                                        at 26–27 (April 2007) (available at www.idtheft.gov).   person makes a solicitation for                       comment on whether the notice and


                                   VerDate Aug<31>2005   20:51 Oct 29, 2007   Jkt 214001   PO 00000   Frm 00013   Fmt 4701   Sfmt 4700   E:\FR\FM\30OCR2.SGM   30OCR2
                                        61436            Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations

                                        opt-out requirements of this rule should                business relationship with the consumer               restrict the sharing of transaction or
                                        apply to circumstances that involve a                   and is thus exempt from the notice and                experience information among affiliates
                                        ‘‘constructive sharing’’ of eligibility                 opt-out requirements. Fourth, if the                  unless that information is medical
                                        information to conduct marketing, given                 consumer responds to the marketing                    information. Section 603(d)(2)(A)(iii)
                                        the policy objectives of section 214 of                 materials, for example, by returning a                operates independent of the affiliate
                                        the FACT Act. By way of example, in a                   response card to an affiliate, one or                 marketing rule. Thus, the existence of a
                                        ‘‘constructive sharing’’ scenario, a                    more of the exceptions to the notice and              pre-existing business relationship
                                        consumer has a relationship with a                      opt-out requirement would apply, such                 between a consumer and an affiliate that
                                        financial institution, and the financial                as the consumer-initiated                             seeks to use shared eligibility
                                        institution is affiliated with an                       communication exception, the pre-                     information, such as credit scores or
                                        insurance company. The insurance                        existing business relationship                        income, to market to that consumer (or
                                        company develops specific eligibility                   exception, or both.                                   the applicability of another exception to
                                        criteria, such as consumers having                         Consumer groups believed that                      this affiliate marketing rule) does not
                                        combined deposit balances in excess of                  constructive sharing contravenes the                  relieve the entity sharing the credit
                                        $50,000 or average monthly demand                       intent of Congress and amounts to a                   score or income information of the
                                        account deposits in excess of $10,000,                  loophole that should be fixed. Similarly,             requirement to comply with the affiliate
                                        without the use of eligibility                          NAAG believed that the letter and spirit              sharing notice and opt-out provisions of
                                        information received from the financial                 of section 624 required subjecting                    section 603(d)(2)(A)(iii) of the FCRA
                                        institution. The insurance company                      constructive sharing to the notice and                before it shares that non-transaction or
                                        provides its criteria to the financial                  opt-out requirements and that to find                 experience information with its
                                        institution and asks the institution to                 otherwise would create a significant and              affiliate.13
                                        identify financial institution consumers                unwarranted exception.                                   Section 680.21(b)(4) describes two
                                        that meet the eligibility criteria and                     After considering the constructive                 situations where a person is deemed not
                                        send insurance company marketing                        sharing issue, the Commission                         to have made a solicitation subject to
                                        materials to those consumers. The                       concludes that the statute only covers                this part. Both situations assume that
                                        financial institution sends the marketing               situations where a person uses                        the person has not used eligibility
                                        materials to those consumers who meet                   eligibility information that it received              information received from an affiliate in
                                        the insurance company’s eligibility                     from an affiliate to make a solicitation              the manner described in
                                        criteria. A consumer who meets the                      to the consumer about its products or                 § 680.21(b)(1)(ii). First, a person does
                                        eligibility criteria contacts the insurance             services. In a ‘‘constructive sharing’’               not make a solicitation subject to this
                                        company after receiving the insurance                   scenario like that described above, a                 part if that person’s affiliate uses its own
                                        company marketing materials in the                      pre-existing business relationship is                 eligibility information that it obtained in
                                        manner specified in those materials.                    established between the consumer and                  connection with a pre-existing business
                                        The consumer’s response provides the                    the insurance company when the                        relationship it has or had with the
                                        insurance company with discernible                      consumer contacts the insurance                       consumer to market the person’s
                                        eligibility information, such as through                company to inquire about or apply for                 products or services to the consumer.
                                        a response form that is coded to identify               insurance products as a result of the                 Second, if, in the situation just
                                        the consumer as an individual who                       consumer’s receipt of the insurance                   described, the person’s affiliate directs
                                        meets the specific eligibility criteria.12              marketing materials. This pre-existing                its service provider to use the affiliate’s
                                           Industry commenters urged the                        business relationship is established
                                                                                                                                                      own eligibility information to market
                                        Commission not to apply the notice and                  before the insurance company uses any
                                                                                                                                                      the person’s products or services to the
                                        opt-out requirement to ‘‘constructive                   shared eligibility information to make
                                                                                                                                                      consumer, and the person does not
                                        sharing’’ situations. The principal                     solicitations to the consumer. Because
                                                                                                                                                      communicate directly with the service
                                        arguments made by these commenters                      the insurance company does not use
                                                                                                                                                      provider regarding that use of the
                                        in support of their position were as                    shared eligibility information to make
                                                                                                                                                      eligibility information, then the person
                                        follows. First, in a constructive sharing               solicitations to the consumer before it
                                                                                                                                                      has not made a solicitation subject to
                                        scenario, there is no sharing of                        establishes a pre-existing business
                                                                                                                                                      this part.
                                        eligibility information among affiliates.               relationship with the consumer, the
                                                                                                                                                         The core concept underlying the
                                        Rather, the consumer provides                           statute does not apply.
                                                                                                                                                      second prong of this provision is that
                                        information to an affiliate when                           The Commission acknowledges the
                                                                                                concerns expressed by consumer groups                 the affiliate that obtained the eligibility
                                        responding. Second, section 624 applies                                                                       information in connection with a pre-
                                        when a person uses eligibility                          and NAAG regarding the decision not to
                                                                                                apply the notice and opt-out                          existing business relationship with the
                                        information furnished by its affiliate to                                                                     consumer controls the actions of the
                                        make a solicitation for its own products                requirements to constructive sharing
                                                                                                situations. The statute’s affiliate                   service provider using that information.
                                        or services to the consumer. In                                                                               Therefore, the service provider’s use of
                                        constructive sharing, however, the                      marketing provisions, however, only
                                                                                                limit the use of eligibility information              the eligibility information should not be
                                        person does not use eligibility                                                                               attributed to the person whose products
                                        information and does not make a                         received from an affiliate to make
                                                                                                solicitations to a consumer. A separate               or services will be marketed to
                                        solicitation as defined in the statute.                                                                       consumers. In such circumstances, the
                                                                                                provision of the FCRA, section
                                        Third, the affiliate that sends the                                                                           service provider is acting on behalf of
                                                                                                603(d)(2)(A)(iii), regulates the sharing of
                                        marketing material has a pre-existing                                                                         the affiliate that obtained the eligibility
                                                                                                eligibility information among affiliates
                                                                                                and prohibits the sharing of non-                     information in connection with a pre-
                                           12 The supplementary information to the proposal
                                                                                                transaction or experience information,                existing business relationship with the
                                        noted that the notice and opt-out requirement
pwalker on PROD1PC71 with RULES2




                                        would not apply if, for example, an insurance           such as credit scores from a consumer                 consumer, and not on behalf of the
                                        company asked its affiliated financial institution to   report or income from an application,
                                        include insurance company marketing material in                                                                  13 A sharing of information occurs if a reference

                                        periodic statements sent to consumers by the
                                                                                                among affiliates, unless the consumer is              code included in marketing materials reveals one
                                        financial institution without regard to eligibility     given notice and an opportunity to opt                affiliate’s information about a consumer to another
                                        information.                                            out of such sharing. The FCRA does not                affiliate upon receipt of a consumer’s response.



                                   VerDate Aug<31>2005   20:51 Oct 29, 2007   Jkt 214001   PO 00000   Frm 00014   Fmt 4701   Sfmt 4700   E:\FR\FM\30OCR2.SGM   30OCR2
                                                         Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations                                        61437

                                        person whose products or services will                     First, the person’s affiliate controls             or on the envelope which contains the
                                        be marketed to that affiliate’s                         access to and use of its eligibility                  marketing materials.
                                        consumers.                                              information by the service provider                      Fifth, the person does not directly use
                                           The Commission also recognizes that                  (including the right to establish specific            the affiliate’s eligibility information in
                                        there may be situations where the                       terms and conditions under which the                  the manner described in
                                        person whose products or services are                   service provider may use such                         § 680.21(b)(1)(ii).
                                        being marketed does communicate with                    information to market the person’s                       These five conditions together ensure
                                        the affiliate’s service provider. This may              products or services). This requirement               that the service provider is acting on
                                        be the case, for example, where the                     must be set forth in a written agreement              behalf of the affiliate that obtained the
                                        service provider performs services for                  between the person’s affiliate and the                eligibility information in connection
                                        various affiliates relying on information               service provider. The person’s affiliate              with a pre-existing business relationship
                                        maintained in and accessed from a                       may demonstrate control by, for                       with the consumer because that affiliate
                                        common database. In certain                             example, establishing and implementing                controls the service provider’s receipt
                                        circumstances, the person whose                         reasonable policies and procedures                    and use of that affiliate’s eligibility
                                        products or services are being marketed                 applicable to the service provider’s                  information.
                                        may communicate with the affiliate’s                    access to and use of its eligibility                     Section 680.21(b)(6) provides six
                                        service provider, yet the service                       information.                                          illustrative examples of the rule relating
                                        provider is still acting on behalf of the                  Second, the person’s affiliate                     to making solicitations as set forth in
                                        affiliate when it uses the affiliate’s                  establishes specific terms and                        §§ 680.21(b)(1)-(5).
                                        eligibility information in connection                   conditions under which the service                    Exceptions
                                        with marketing the person’s products or                 provider may access and use that
                                        services. Section 680.21(b)(5) describes                eligibility information to market the                    Proposed § 680.20(c) contained
                                        the conditions under which a service                    person’s products or services (or those               exceptions to the requirements of this
                                        provider would be deemed to be acting                   of affiliates generally) to the consumer,             part and incorporated each of the
                                        on behalf of the affiliate with the pre-                and periodically evaluates the service                statutory exceptions to the affiliate
                                        existing business relationship, rather                  provider’s compliance with those terms                marketing notice and opt-out
                                        than the person whose products or                       and conditions. These terms and                       requirements that are set forth in section
                                        services are being marketed,                            conditions may include the identity of                624(a)(4) of the FCRA. The Commission
                                        notwithstanding direct communications                   the affiliated companies whose products               has revised the preface to the exceptions
                                        between the person and the service                      or services may be marketed to the                    for clarity to provide that the provisions
                                        provider.                                               consumer by the service provider, the                 of this part do not apply to ‘‘you’’ if a
                                           Section 680.21(b)(5) builds upon the                 types of products or services of affiliated           person uses eligibility information that
                                        concept of control of a service provider                companies that may be marketed, and                   it receives from an affiliate in certain
                                        and thus is a natural outgrowth of                      the number of times the consumer may                  circumstances. In addition, each of the
                                        § 680.21(b)(4). Under the conditions set                receive marketing materials. The                      exceptions has been moved to
                                        out in § 680.21(b)(5), the service                      specific terms and conditions                         § 680.21(c) in the final rule and is
                                        provider is acting on behalf of an                      established by the person’s affiliate                 discussed below.
                                        affiliate that obtained the eligibility                 must be set forth in writing, but need                Pre-existing Business Relationship
                                        information in connection with a pre-                   not be set forth in a written agreement               Exception
                                        existing business relationship with the                 between the person’s affiliate and the
                                        consumer because, among other things,                   service provider. If a periodic evaluation               Proposed § 680.20(c)(1) provided that
                                        the affiliate controls the actions of the               by the person’s affiliate reveals that the            the provisions of this part would not
                                        service provider in connection with the                 service provider is not complying with                apply to an affiliate using eligibility
                                        service provider’s receipt and use of the               those terms and conditions, the                       information to make a solicitation to a
                                        eligibility information. This provision is              Commission expects the person’s                       consumer with whom the affiliate has a
                                        designed to minimize uncertainty that                   affiliate to take appropriate corrective              pre-existing business relationship. As
                                        may arise from application of the facts                 action.                                               noted above, a pre-existing business
                                        and circumstances test in § 680.21(b)(3)                   Third, the person’s affiliate requires             relationship exists when: (1) there is a
                                        to cases that involve direct                            the service provider to implement                     financial contract in force between the
                                        communications between a service                        reasonable policies and procedures                    affiliate and the consumer; (2) the
                                        provider and a person whose products                    designed to ensure that the service                   consumer and the affiliate have engaged
                                        and services will be marketed to                        provider uses the affiliate’s eligibility             in a financial transaction (including
                                        consumers.                                              information in accordance with the                    holding an active account or a policy in
                                           Section 680.21(b)(5) provides that a                 terms and conditions established by the               force or having another continuing
                                        person does not make a solicitation                     affiliate relating to the marketing of the            relationship) during the 18 months
                                        subject to this part if a service provider              person’s products or services. This                   immediately preceding the date of the
                                        (including an affiliated or third-party                 requirement must be set forth in a                    solicitation; (3) the consumer has
                                        service provider that maintains or                      written agreement between the person’s                purchased, rented, or leased the
                                        accesses a common database that the                     affiliate and the service provider.                   affiliate’s goods or services during the
                                        person may access) receives eligibility                    Fourth, the person’s affiliate is                  18 months immediately preceding the
                                        information from the person’s affiliate                 identified on or with the marketing                   date of the solicitation; or (4) the
                                        that the person’s affiliate obtained in                 materials provided to the consumer.                   consumer has inquired about or applied
                                        connection with a pre-existing business                 This requirement will be construed                    for a product or service offered by the
                                        relationship it has or had with the                     flexibly. For example, the person’s                   affiliate during the 3-month period
pwalker on PROD1PC71 with RULES2




                                        consumer and uses that eligibility                      affiliate may be identified directly on               immediately preceding the date of the
                                        information to market the person’s                      the marketing materials, on an                        solicitation. Proposed § 680.20(d)(1)
                                        products or services to the consumer, so                introductory cover letter, on other                   provided examples of the pre-existing
                                        long as the following five conditions are               documents included with the marketing                 business relationship exception. As
                                        met.                                                    materials, such as a periodic statement,              explained above, the Commission has


                                   VerDate Aug<31>2005   20:51 Oct 29, 2007   Jkt 214001   PO 00000   Frm 00015   Fmt 4701   Sfmt 4700   E:\FR\FM\30OCR2.SGM   30OCR2
                                        61438            Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations

                                        revised the examples from proposed                      Employee Benefit Plan Exception                       exception, the person using the
                                        § 680.20(d)(1) in the final rule and                       Proposed §680.20(c)(2) provided that               information is also ‘‘the person
                                        included them as examples of the                        the provisions of this part would not                 provid[ing] employee benefit or other
                                        definition of ‘‘pre-existing business                   apply to an affiliate using the                       services pursuant to a contract with an
                                        relationship’’ rather than as examples of               information to facilitate                             employer.’’ Therefore, the Commission
                                        the pre-existing business relationship                  communications to an individual for                   concludes that this exception, like the
                                        exception.                                              whose benefit the affiliate provides                  other provisions of this part, should
                                           Section 680.21(c)(1) of the final rule               employee benefit or other services                    apply only to a person that uses
                                        revises the pre-existing business                       under a contract with an employer                     eligibility information it receives from
                                        relationship exception to delete the                    related to and arising out of a current               an affiliate to make solicitations to
                                        word ‘‘send’’ and to eliminate as                       employment relationship or an                         consumers about its products or
                                        unnecessary the cross-reference to the                  individual’s status as a participant or               services.
                                        location of the definition of ‘‘pre-                    beneficiary of an employee benefit plan.              Service Provider Exception
                                        existing business relationship.’’ As                    One commenter believed that the
                                        discussed above, commenters made a                                                                               Proposed § 680.20(c)(3) provided that
                                                                                                exception should be revised to permit                 the provisions of this part would not
                                        number of suggestions regarding the                     communications ‘‘to an affiliate about
                                        definition of ‘‘pre-existing business                                                                         apply to an affiliate using the
                                                                                                an individual for whose benefit an                    information to perform services for
                                        relationship.’’ The Commission has                      entity provides employee benefit or                   another affiliate, unless the services
                                        addressed those comments elsewhere.                     other services pursuant to a contract                 involve making or sending solicitations
                                        Most commenters supported the                           with an employer related to and arising               on its own behalf or on behalf of an
                                        proposed text of the pre-existing                       out of the current employment                         affiliate and the service provider or such
                                        business relationship exception, which                  relationship or status of the individual              affiliate is not permitted to make or send
                                        generally tracks the statutory language.                as a participant or beneficiary of an                 such solicitations as a result of the
                                           Some commenters, however,                            employee benefit plan.’’ This                         consumer’s election to opt out. Thus,
                                        apparently believed that the pre-existing               commenter also suggested deleting the                 under the proposal, when the notice has
                                        business relationship exception is                      phrase ‘‘you receive from an affiliate’’ in           been provided to a consumer and the
                                        broader than it actually is. For example,               the introduction to proposed                          consumer has opted out, an affiliate
                                        assume that an insurance company has                    § 680.20(c). This commenter believed                  subject to the consumer’s opt-out
                                        a pre-existing business relationship with               that this exception should permit an                  election may not circumvent the opt-out
                                        a consumer and shares eligibility                       employer or plan sponsor to share                     by instructing the person with the
                                        information about the consumer with its                 information with its affiliates in order to           consumer relationship or another
                                        affiliates by putting that information                  offer other financial services, such as               affiliate to send solicitations to the
                                        into a common database that is                          brokerage accounts or IRAs, to its                    consumer on its behalf.
                                        accessible by all affiliates. The                       employees. This commenter further                        Several industry commenters urged
                                        insurance company’s lending affiliate                   requested clarification on whether the                the Commission to revise the proposed
                                        accesses the database, reviews the data                 exception applies only if related to                  exception to conform to the statutory
                                        on the insurance company’s consumers                    products offered as an employee benefit.              language. Specifically, with respect to
                                        and, based on its review, decides to                       Section 680.21(c)(2) of the final rule             the exclusion from the service provider
                                        market to some of the insurance                         adopts the employee benefit exception                 exception, these commenters
                                        company’s consumers. Rather than                        as proposed. The Commission declined                  recommended that the Commission
                                        sending the solicitations itself, the                   to adopt the changes suggested by the                 delete the references to solicitations on
                                        lender asks the insurance company with                  one commenter. First, the suggestion to               behalf of the service provider. Some of
                                        the pre-existing business relationship to               make the exception applicable to                      these commenters maintained that the
                                        send solicitations on its behalf to the                 communications ‘‘to an affiliate about                references to solicitations on behalf of
                                        insurance company’s consumers. As                       an individual for whose benefit an                    the service provider itself would impose
                                        noted above, one commenter believed                     entity provides employee benefit or                   additional burdens and costs on
                                        that in this circumstance the pre-                      other services’’ differs from the language            companies that use a single affiliate to
                                        existing business relationship exception                of the statute. The language of the                   provide various administrative services
                                        would apply so long as the insurance                    proposed and final rule focuses on                    to other affiliates and would make it
                                        company retained the discretion to                      facilitating communications ‘‘to an                   more difficult to provide general
                                        decide whether or not to send the                       individual for whose benefit the person               educational materials to consumers.
                                        solicitations on behalf of the lender.                  provides employee benefit or other                    Some of these commenters also asked
                                        However, the Commission concludes                       services,’’ which tracks the statutory                the Commission to clarify that the
                                        that this situation does not fall within                language better than the alternative                  limitation in the service provider
                                        the pre-existing business relationship                  language proposed by the commenter.                   exception has no applicability to any
                                        exception. Instead, the lender makes the                   Second, the only person to whom                    other exception.
                                        solicitation because it used eligibility                section 624 might apply is a person that                 Section 680.21(c)(3) of the final rule
                                        information received from an affiliate to               receives eligibility information from an              revises the service provider exception to
                                        select the consumer to receive a                        affiliate. Specifically, the statutory                delete as surplusage the references to
                                        solicitation about its products or                      preface to the exceptions provides that               solicitations by a service provider on its
                                        services and, as a result, the consumer                 ‘‘[t]his section shall not apply to a                 own behalf. The Commission notes that
                                        is provided a solicitation. To eliminate                person’’ using information to do certain              the general rule in § 680.21(a)(1)
                                        any confusion and clarify the scope of                  things. The language of the statute thus              prohibits a service provider from using
pwalker on PROD1PC71 with RULES2




                                        the exception, the Commission has                       makes clear that the exceptions in                    eligibility information it received from
                                        added an example in § 680.21(d)(1) of                   section 624(a)(4) of the FCRA were                    an affiliate to make solicitations to the
                                        the final rule to illustrate a situation                meant to apply to persons that                        consumer about its own products or
                                        where the pre-existing business                         otherwise would be subject to section                 services unless the consumer is given
                                        relationship exception would apply.                     624. In the case of the employee benefit              notice and an opportunity to opt out or


                                   VerDate Aug<31>2005   20:51 Oct 29, 2007   Jkt 214001   PO 00000   Frm 00016   Fmt 4701   Sfmt 4700   E:\FR\FM\30OCR2.SGM   30OCR2
                                                         Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations                                       61439

                                        unless one of the other exceptions                      proposed § 680.20(d)(2)(ii), the                      believed this clarification was so
                                        applies. The service provider exception                 Commission also contemplated that a                   important that it should be incorporated
                                        simply allows a service provider to do                  consumer would not initiate a                         into the rule itself. NAAG also suggested
                                        what the affiliate on whose behalf it is                communication if an affiliate made the                imposing a specific time limit to allow
                                        acting may do, such as using shared                     initial call and left a message for the               solicitations to be made for no more
                                        eligibility information to make                         consumer to call back, and the                        than 30 days after the consumer-
                                        solicitations to consumers to whom the                  consumer responded.                                   initiated communication under this
                                        affiliate is permitted to make such                        Commenters generally supported the                 exception.
                                        solicitations. The final rule also deletes              text of the proposed consumer-initiated                 Industry commenters also objected to
                                        the word ‘‘make’’ from the exception to                 communication exception. Several                      some of the examples. In particular,
                                        the service provider exception because,                 commenters, however, urged the                        industry commenters objected to the
                                        as discussed above, ‘‘making’’ and                      Commission to either delete the phrase                example in proposed § 680.20(d)(2)(i) on
                                        ‘‘sending’’ solicitations are distinct                  ‘‘orally, electronically, or in writing’’             two grounds. First, these commenters
                                        activities and this provision of the                    from the regulation or modify the                     believed that the consumer should not
                                        statute uses the verb ‘‘to send.’’ The                  language to read ‘‘whether orally,                    have to supply contact information in
                                        Commission notes that, although the                     electronically, or in writing.’’ These                order to trigger the exception. These
                                        statute contains separate service                       commenters maintained that other                      commenters noted that such a
                                        provider and pre-existing business                      means of communication may be used                    requirement would seem to preclude
                                        relationship exceptions, nothing in                     by consumers in the future and should                 solicitations over the phone during the
                                        those exceptions prevents an affiliate                  not be precluded by the regulations.                  same call by presuming that a
                                        that has a pre-existing business                        Another commenter welcomed the                        solicitation would be made by mail or
                                        relationship with the consumer from                     reference to oral communications and                  e-mail. Some of these commenters also
                                        relying upon the service provider                       requested that the Commission clarify                 believed that consumers would expect
                                        exception, where appropriate. Section                   that electronic communications refers to              an affiliated company, especially a
                                        680.21(d)(2) of the final rule provides                 both e-mail and facsimile transmissions.              company with a common brand, to have
                                        examples of the service provider                           Many industry commenters objected                  their contact information already and
                                        exception.                                              to the statement in the supplementary                 would not want to provide it again.
                                                                                                information that to qualify for this                  Second, as noted above, some
                                        Consumer-Initiated Communication                        exception, the use of eligibility                     commenters maintained that the affiliate
                                        Exception                                               information ‘‘must be responsive’’ to the             should be able to respond by making
                                           Proposed § 680.20(c)(4) provided that                communication initiated by the                        solicitations about any product or
                                        the provisions of this part would not                   consumer. These commenters believed                   service, not just those mentioned by the
                                        apply to an affiliate using the                         that the concept of ‘‘responsiveness’’                consumer.
                                        information to make solicitations in                    creates a vague, subjective, and narrow                 Many industry commenters objected
                                        response to a communication initiated                   standard that could subject institutions              to the example in proposed
                                        by the consumer. The proposed rule                      to compliance risk. These commenters                  § 680.20(d)(2)(ii) about the consumer
                                        further clarified that this exception may               noted that the Commission did not and                 responding to a call back message.
                                        be triggered by an oral, electronic, or                 could not provide a clear definition of               These commenters believed that such a
                                        written communication initiated by the                  what would be ‘‘responsive.’’ Some of                 call back should qualify as a consumer-
                                        consumer.                                               these commenters noted that consumers                 initiated communication, noting that the
                                           The supplementary information noted                  may not be familiar with the various                  consumer has the option of not
                                        that to be covered by the proposed                      types of products or services available to            returning the call. Moreover, these
                                        exception, the use of eligibility                       them and the different affiliates that                commenters noted that the customer
                                        information must be responsive to the                   offer those products or services and may              service representative receiving the call
                                        communication initiated by the                          rely on the institution to inform them                would not know what prompted the
                                        consumer. The supplementary                             about available options. For this reason,             consumer’s call. Several commenters
                                        information also explained that the time                most of these commenters maintained                   acknowledged that there may be
                                        period during which solicitations                       that the exception should not limit an                concerns about calls made under false
                                        remain responsive to the consumer’s                     affiliate from responding with                        pretenses to prompt consumers to return
                                        communication would depend on the                       solicitations about any product or                    the call, but suggested that those
                                        facts and circumstances. As illustrated                 service. Some of these commenters                     concerns should be addressed by other
                                        in the example in proposed                              believed that it would be difficult to                means, such as enforcement of the laws
                                        § 680.20(d)(2)(iii), if a consumer were to              monitor compliance with or to develop                 dealing with unfair or deceptive acts or
                                        call an affiliate to ask about retail                   scripts for a ‘‘responsiveness’’ standard             practices.
                                        locations and hours, the affiliate could                by customer service representatives.                    Finally, some industry commenters
                                        not use eligibility information to make                 One commenter noted that the Senate                   expressed concerns about the example
                                        solicitations to the consumer about                     bill used more restrictive language in                in proposed § 680.20(d)(2)(iii) regarding
                                        specific products because those                         this exception than the final bill passed             the consumer who calls to ask for retail
                                        solicitations would not be responsive to                by Congress. Some commenters also                     locations and hours. These commenters
                                        the consumer’s communication.                           objected to the statement that the time               noted that it is impossible to know what
                                        Conversely, the example in proposed                     period during which solicitations                     will transpire on a particular telephone
                                        § 680.20(d)(2)(i) illustrated that if the               remain responsive would depend on the                 call. One commenter noted, for
                                        consumer calls an affiliate to ask about                facts and circumstances.                              example, that if a consumer called to
                                        its products or services and provides                      NAAG supported the statement in the                ask for directions to an office, the
pwalker on PROD1PC71 with RULES2




                                        contact information, solicitations related              supplementary information that, to                    customer service representative might
                                        to those products or services would be                  qualify for this exception, the use of                ask why the consumer needed to go to
                                        responsive to the communication and                     eligibility information ‘‘must be                     that office. This, in turn, could prompt
                                        thus permitted under the exception.                     responsive’’ to the communication                     the consumer to mention a product or
                                        Finally, as illustrated by the example in               initiated by the consumer. NAAG                       service that the consumer hoped to


                                   VerDate Aug<31>2005   20:51 Oct 29, 2007   Jkt 214001   PO 00000   Frm 00017   Fmt 4701   Sfmt 4700   E:\FR\FM\30OCR2.SGM   30OCR2
                                        61440            Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations

                                        obtain and lead to a discussion of                      for information about a particular                    information about the reason why the
                                        specific products or services that might                product or service, for example, life                 consumer wants to visit a retail location,
                                        be appropriate for the consumer.                        insurance, solicitations regarding life               offers to provide information about
                                           Section 680.21(c)(4) of the final rule               insurance could be made in response to                products of interest to the consumer by
                                        revises the consumer-initiated                          that call, but solicitations regarding                telephone and mail, thus demonstrating
                                        communications exception to delete the                  other products or services would not be               how the conversation may develop to
                                        reference to oral, electronic, or written               responsive. Finally, the Commission                   the point where making solicitations
                                        communications. The Commission                          does not believe it is appropriate to                 would be responsive to the consumer’s
                                        believes that any form of                               adopt a specific time limit for making                call.
                                        communication may come within the                       solicitations following a consumer-
                                        exception as long as the consumer                                                                             Consumer Authorization or Request
                                                                                                initiated communication about products
                                        initiates the communication, whether                                                                          Exception
                                                                                                or services because solicitations will
                                        in-person or by mail, e-mail, telephone,                likely be made quickly and any time                      Proposed § 680.20(c)(5) clarified that
                                        facsimile, or through other means. New                  limit would be arbitrary.                             the provisions of this part would not
                                        forms of communication that may                            In the final rule, the Commission has              apply to an affiliate using the
                                        develop in the future could also come                   renumbered the example in proposed                    information to make solicitations
                                        within the exception.                                   § 680.20(d)(2)(i) as § 680.21(d)(3)(i), and           affirmatively authorized or requested by
                                           Section 680.21(c)(4) of the final rule               revised it to delete the references to a              the consumer. The proposal further
                                        also provides that the communications                   telephone call as the specific form of                provided that this exception may be
                                        covered by the exception are consumer-                  communication and the reference to                    triggered by an oral, electronic, or
                                        initiated communications about a                        providing contact information. As                     written authorization or request by the
                                        person’s products or services. For the                  discussed above and illustrated in the                consumer. However, a pre-selected
                                        exception to apply, the statute requires                examples in §§ 680.20(j)(2)(ii)(E) and                check box or boilerplate language in a
                                        that a person use eligibility information               (F), the need to provide contact                      disclosure or contract would not
                                        ‘‘in response to’’ a communication                      information may vary depending on the                 constitute an affirmative authorization
                                        initiated by a consumer. The                            form of communication used by the                     or request under the proposal.
                                        Commission believes this statutory                      consumer. The new example in                             The proposal noted that the consumer
                                        language contemplates that the                          § 680.21(d)(3)(ii) responds to                        authorization or request exception could
                                        consumer-initiated communications                       commenters’ concerns by illustrating a                be triggered, for example, if a consumer
                                        will relate to a person’s products or                   circumstance involving a consumer-                    obtains a mortgage from a mortgage
                                        services and that the solicitations                     initiated communication in which a                    lender and authorizes or requests to
                                        covered by the exception will be those                  consumer does not know exactly what                   receive solicitations about homeowner’s
                                        made in response to that                                products or services he or she wants,                 insurance from an insurance affiliate of
                                        communication.                                          but initiates a communication to obtain               the mortgage lender. The consumer
                                           The Commission also believes the                     information about investing for a child’s             could provide the authorization or make
                                        exceptions should be construed                          college education.                                    the request either through the person
                                        narrowly to avoid undermining the                          The Commission has renumbered the                  with whom the consumer has a business
                                        general rule requiring notice and opt-                  call-back example in proposed                         relationship or directly to the affiliate
                                        out. Thus, consistent with the purposes                 § 680.20(d)(2)(iii) as § 680.21(d)(3)(iii)            that will make the solicitation. Proposed
                                        of the statute, the Commission does not                 and revised it. The revised example                   § 680.20(d)(3) provided an example of
                                        believe that a consumer-initiated                       provides that where the financial                     the affirmative authorization or request
                                        communication that is unrelated to a                    institution makes an initial marketing                exception.
                                        product or service should trigger the                   call without using eligibility                           Most industry commenters argued
                                        exception. A rule that allowed any                      information received from an affiliate                that the proposed exception did not
                                        consumer-initiated communication, no                    and leaves a message that invites the                 track the language of the statute because
                                        matter how unrelated to a product or                    consumer to apply for the credit by                   the Commission included the word
                                        service, to trigger the exception would                 calling a toll-free number, the                       ‘‘affirmative’’ in the proposed exception.
                                        not to give meaning to the phrase ‘‘in                  consumer’s response qualifies as a                    These commenters believed that
                                        response to’’ and could produce                         consumer-initiated communication                      including the word ‘‘affirmative’’ in the
                                        incongruous results. For example, if a                  about a product or service. The revised               proposed rule narrowed the exception
                                        consumer calls an affiliate solely to                   example balances commenters’ concerns                 in a manner not intended by Congress.
                                        obtain retail hours and directions or                   about tracking which calls are call backs             Several of these commenters noted that
                                        solely to opt out, the exception is not                 and the Commission’s concern that                     the Commission has declined to specify
                                        triggered because the communication                     consumers may be induced into                         what constitutes consumer consent
                                        does not relate to the affiliate’s products             triggering the consumer-initiated                     under the GLBA privacy rule and
                                        or services and making a solicitation                   communication exception as a result of                indicated that they were not aware of
                                        about products or services to the                       inaccurate, incomplete, or deceptive                  any policy considerations or compliance
                                        consumer in those circumstances would                   telephone messages.                                   issues that would warrant a departure
                                        not be a reasonable response to that                       For the reasons discussed above, the               from the Commission’s prior position.
                                        communication.                                          Commission has renumbered the retail                     Some industry commenters believed
                                           The Commission recognizes, however,                  hours example in proposed                             that a pre-selected check box should be
                                        that if the conversation shifts to a                    § 680.20(d)(2)(iii) as § 680.21(d)(3)(iv),            sufficient to evidence a consumer’s
                                        discussion of products or services that                 but otherwise adopted it as proposed. In              authorization or request for
                                        the consumer may need, solicitations                    addition, the new example in                          solicitations. In other words, a
pwalker on PROD1PC71 with RULES2




                                        may be responsive depending upon the                    § 680.21(d)(3)(v) responds to                         consumer’s decision not to deselect a
                                        facts and circumstances. Likewise, if a                 commenters’ concerns by illustrating a                pre-selected check box should
                                        consumer who has opted out of an                        case where a consumer calls to ask                    constitute a knowing act of the
                                        affiliate’s use of eligibility information              about retail locations and hours and the              consumer to authorize or request
                                        to make solicitations calls the affiliate               call center representative, after eliciting           solicitations. Other industry


                                   VerDate Aug<31>2005   20:51 Oct 29, 2007   Jkt 214001   PO 00000   Frm 00018   Fmt 4701   Sfmt 4700   E:\FR\FM\30OCR2.SGM   30OCR2
                                                         Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations                                         61441

                                        commenters believed that preprinted                     consumer.’’ The Commission interprets                 securities, and insurance companies).
                                        language in a disclosure or contract                    the ‘‘authorized or requested’’ language              This commenter was focused on private
                                        should be sufficient to evidence a                      in the FCRA exception to require the                  banking enterprises. As discussed
                                        consumer’s authorization or request for                 consumer to take affirmative steps in                 above, the Commission finds no
                                        solicitations. One commenter cited case                 order to trigger the exception.                       statutory basis for creating such an
                                        law and Commission informal staff                          The Commission has made                            exception to the notice and opt-out
                                        opinion letters relating to a consumer’s                conforming changes to the example in                  requirement.
                                        written instructions to obtain a                        proposed § 680.20(d)(3), which has been
                                        consumer report pursuant to section                     renumbered as § 680.21(d)(4)(i) in the                Relation to Affiliate-Sharing Notice and
                                        604(a)(2) of the FCRA as support for                    final rule. In addition, the Commission               Opt-out
                                        allowing boilerplate language to                        has added three additional examples.                     Proposed § 680.20(f) clarified the
                                        constitute authorization or request.                    The example in § 680.21(d)(4)(ii)                     relationship between the affiliate
                                           A few industry commenters requested                  illustrates how a consumer can                        sharing notice and opt-out under section
                                        that the Commission clarify that a                      authorize or request solicitations by                 603(d)(2)(A)(iii) of the FCRA and the
                                        consumer’s authorization or request                     checking a blank check box. The                       affiliate marketing notice and opt-out in
                                        does not have to refer to a specific                    examples in §§ 680.21(d)(4)(iii) and (iv)             new section 624 of the FCRA.
                                        product or service or to a specific                     illustrate that preprinted boilerplate                Specifically, the proposal provided that
                                        provider of products or services in order               language and a pre-selected check box                 nothing in the affiliate marketing rule
                                        for the exception to apply. As discussed                would not meet the authorization or                   limits the responsibility of a company to
                                        above, industry commenters had                          request exception.                                    comply with the notice and opt-out
                                        differing views regarding the reference                    The Commission does not believe it is              provisions of section 603(d)(2)(A)(iii) of
                                        to oral, written, or electronic means of                appropriate to set a fixed time period for            the FCRA before it shares information
                                        triggering the exception.                               an authorization or request. As noted in              other than transaction or experience
                                           NAAG suggested imposing a specific                   the proposal, the duration of the                     information among affiliates to avoid
                                        time limit to allow solicitations to be                 authorization or request depends on                   becoming a consumer reporting agency.
                                        made for no more than 30 days after the                 what is reasonable under the facts and                   One commenter urged the
                                        consumer’s authorization or request                     circumstances. In addition, an                        Commission to delete this provision as
                                        under this exception.                                   authorization to make solicitations to                unnecessary. In the alternative, this
                                           Section 680.21(c)(5) of the final rule               the consumer terminates if the                        commenter requested that the
                                        revises the consumer authorization or                   consumer revokes the authorization.                   Commission clarify that section
                                        request exception to delete the word                       For the same reasons discussed above,              603(d)(2)(A)(iii) applies to the sharing of
                                        ‘‘affirmative’’ as surplusage. The                      the Commission has deleted the                        information that would otherwise meet
                                        deletion of the word ‘‘affirmative’’ does               reference to oral, electronic, or written             the definition of a ‘‘consumer report,’’
                                        not change the meaning of the exception                 communications from this exception to                 and that the sharing affiliate does not
                                        however. The consumer still must take                   track the language of the statute.                    automatically become a consumer
                                        affirmative steps to ‘‘authorize’’ or                   Further, the Commission does not                      reporting agency, but risks becoming a
                                        ‘‘request’’ solicitations.                              believe it is necessary to clarify the                consumer reporting agency.
                                           The Commission construes this                        elements of an authorization or request.
                                        exception, like the other exceptions,                                                                            This provision has been renumbered
                                                                                                The statute clearly refers to                         as § 680.21(e) in the final rule. Section
                                        narrowly and in a manner that does not                  ‘‘solicitations authorized or requested
                                        undermine the general notice and opt-                                                                         680.21(e) has been revised to delete the
                                                                                                by the consumer.’’ The facts and                      clause that referred to becoming a
                                        out requirement. For that reason, the                   circumstances will determine what
                                        Commission believes that affiliated                                                                           consumer reporting agency and to
                                                                                                solicitations have been authorized or                 substitute in its place the neutral phrase
                                        companies cannot avoid use of the                       requested by the consumer.
                                        statute’s notice and opt-out provisions                                                                       ‘‘where applicable.’’
                                        by including preprinted boilerplate                     Compliance with Applicable Laws                       Section 680.22 Scope and Duration of
                                        language in the disclosures or contracts                Exception                                             Opt-Out
                                        they provide to consumers, such as                         Proposed § 680.20(c)(6) clarified that
                                                                                                                                                      Scope of the Opt-out
                                        language stating that by applying to                    the provisions of this part would not
                                        open an account, the consumer                           apply to an affiliate if compliance with                The Commission addressed issues
                                        authorizes or requests to receive                       the requirements of section 624 by the                relating to the scope of the opt-out in
                                        solicitations from affiliates. Such an                  affiliate would prevent that affiliate                various sections of the proposal. In the
                                        interpretation would permit the                         from complying with any provision of                  supplementary information to the
                                        exception to swallow the rule, a result                 state insurance laws pertaining to unfair             proposal, the Commission stated that
                                        that cannot be squared with the intent                  discrimination in a state where the                   the opt-out would be tied to the
                                        of Congress to give consumers notice                    affiliate is lawfully doing business. See             consumer, rather than to the
                                        and an opportunity to opt out of                        FCRA, section 624(a)(4). The                          information. Some industry commenters
                                        solicitations.                                          Commission received no comments on                    supported the approach of tying the opt-
                                           The comparison made by some                          this provision. Section 680.21(c)(6) of               out to the consumer, rather than to the
                                        commenters to the GLBA privacy rule is                  the final rule adopts the state insurance             information. Other industry
                                        misplaced. The GLBA and the privacy                     law compliance exception as proposed.                 commenters, however, believed it was
                                        rule create an exception to permit the                     One commenter requested the                        inappropriate to tie the opt-out to the
                                        disclosure of nonpublic personal                        creation of an additional exception to                consumer and requested that
                                        information ‘‘with the consent or at the                permit the sharing of eligibility                     institutions have the flexibility to
pwalker on PROD1PC71 with RULES2




                                        direction of the consumer.’’ Section 624                information among affiliates that are                 implement the consumer’s opt-out at the
                                        of the FCRA creates an exception to                     aligned under one line of business                    account level, rather than at the
                                        permit the use of shared eligibility                    within an organization and that share                 consumer level. These commenters
                                        information ‘‘in response to solicitations              common management, branding, and                      believed that an account-by-account
                                        authorized or requested by the                          regulatory oversight (i.e., banking,                  approach would be consistent with the


                                   VerDate Aug<31>2005   20:51 Oct 29, 2007   Jkt 214001   PO 00000   Frm 00019   Fmt 4701   Sfmt 4700   E:\FR\FM\30OCR2.SGM   30OCR2
                                        61442            Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations

                                        menu of opt-out choices provided in                     consequences. For example, if the opt-                consumer that relates to eligibility
                                        this rule and the GLBA privacy rule.                    out were tied to the consumer, an                     information obtained in connection
                                        These commenters also noted that an                     institution would have to track the                   with a transaction with the consumer,
                                        account-based approach would provide                    consumer indefinitely, even if the                    such as an isolated transaction or a
                                        the consumer with a new notice and                      consumer’s relationship with the                      credit application that is denied, the
                                        opportunity to opt out when a former                    institution terminated and a new                      opt-out notice only applies to eligibility
                                        customer decides to re-establish a new                  relationship were subsequently                        information obtained in connection
                                        relationship with the institution.                      established with that institution years               with that transaction. The notice cannot
                                           Proposed § 680.21(c) provided that                   later. The Commission does not believe                apply to eligibility information that may
                                        the notice could be designed to allow a                 that institutions should be required to               be obtained in connection with
                                        consumer to choose from a menu of                       track consumers indefinitely following                subsequent transactions or a continuing
                                        alternatives when opting out, such as by                termination. In addition, an opt-out tied             relationship that may be subsequently
                                        selecting certain types of affiliates,                  to the consumer could apply to the use                established by the consumer with the
                                        certain types of information, or certain                of all eligibility information, not just to           person or its affiliate. Section
                                        modes of delivery from which to opt                     eligibility information about the                     680.22(a)(3)(ii) provides examples of
                                        out, so long as one of the alternatives                 consumer, received from an affiliate and              isolated transactions.
                                        gave the consumer the opportunity to                    used to make solicitations to the                        Section 680.22(a)(4) provides that a
                                        opt out with respect to all affiliates, all             consumer. It is not clear from the statute            consumer may be given the opportunity
                                        eligibility information, and all methods                or the legislative history that Congress              to choose from a menu of alternatives
                                        of delivering solicitations. Several                    intended the opt-out provisions of                    when electing to prohibit solicitations.
                                        industry commenters objected to the                     section 624 to apply to eligibility                   An opt-out notice may give the
                                        requirement that the institution provide                information about consumers other than                consumer the opportunity to elect to
                                        a single universal opt-out option that                  the consumer to whom a solicitation is                prohibit solicitations from certain types
                                        would allow consumers to opt out                        made. Finally, the Commission does not                of affiliates covered by the opt-out
                                        completely of all solicitations. In                     believe it is necessary to make the opt-              notice but not other types of affiliates
                                        addition, one commenter found the                       out effective in perpetuity upon                      covered by the notice, solicitations
                                        reference to all types of eligibility                   termination of the relationship.                      based on certain types of eligibility
                                        information confusing, while another                       Section 680.22(a) of the final rule                information but not other types of
                                        commenter noted that some institutions                  brings together these different scope                 eligibility information, or solicitations
                                        may want to implement the opt-out on                    considerations to address                             by certain methods of delivery but not
                                        an account-by-account basis.                            comprehensively the scope of the opt-                 other methods of delivery, so long as
                                           Section 680.25(d) of the proposal                    out. Under the revised approach, the                  one of the alternatives is the
                                        provided that if a consumer’s                           scope of the opt-out is derived from                  opportunity to prohibit all solicitations
                                        relationship with an institution                        language of section 624(a)(2)(A) of the               from all of the affiliates that are covered
                                        terminated for any reason when a                        FCRA and generally depends upon the                   by the notice. The Commission
                                        consumer’s opt-out election was in                      content of the opt-out notice. Section                continues to believe that the language of
                                        force, the opt-out would continue to                    680.22(a)(1) provides that, except as                 section 624(a)(2)(A) of the FCRA
                                        apply indefinitely, unless revoked by                   otherwise provided in that section, a                 requires the opt-out notice to contain a
                                        the consumer. Most industry                             consumer’s election to opt out prohibits              single opt-out option for all solicitations
                                        commenters objected to having the opt-                  any affiliate covered by the opt-out                  within the scope of the notice.
                                        out period continue to apply                            notice from using the eligibility                        The Commission recognizes that
                                        indefinitely upon termination of the                    information received from another                     consumers could receive a number of
                                        consumer’s relationship with the                        affiliate as described in the notice to               different opt-out notices, even from the
                                        institution. These commenters believed                  make solicitations for marketing                      same affiliate. The Commission will
                                        that this approach was not supported by                 purposes to the consumer.                             monitor industry notice practices and
                                        the statute, would prove costly and                        Section 680.22(a)(2)(i) clarifies that, in         evaluate whether further action is
                                        difficult to administer, and would                      the context of a continuing relationship,             needed.
                                        require the indefinite tracking of opt-                 an opt-out notice may apply to                           Section 680.22(a)(5) contains a special
                                        outs. These commenters also believed                    eligibility information obtained in                   rule for notice following termination of
                                        that the five-year opt-out period would                 connection with a single continuing                   a continuing relationship. This rule
                                        provide sufficient protection to                        relationship, multiple continuing                     provides that a consumer must be given
                                        consumers that terminate their                          relationships, continuing relationships               a new opt-out notice if, after all
                                        relationship. One commenter noted that                  established subsequent to delivery of                 continuing relationships with a person
                                        the proposed rule would impose                          the opt-out notice, or any other                      or its affiliate have been terminated, the
                                        particular hardships on mortgage                        transaction with the consumer. Section                consumer subsequently establishes a
                                        lenders because those lenders often                     680.22(a)(2)(ii) provides examples of                 new continuing relationship with that
                                        have consumer relationships of very                     continuing relationships. These                       person or the same or a different affiliate
                                        short duration on account of selling the                examples are substantially similar to the             and the consumer’s eligibility
                                        loans they originate into the secondary                 examples used in the GLBA privacy rule                information is to be used to make a
                                        market. Consumer groups supported the                   with added references to relationships                solicitation. This special rule affords the
                                        proposed treatment of opt-outs for                      between the consumer and an affiliate.                consumer and the company a fresh start
                                        terminated consumer relationships.                         Section 680.22(a)(3)(i) limits the                 following termination of all continuing
                                           Upon further examination, the                        scope of an opt-out notice that is not                relationships by requiring a new opt-out
                                        Commission believes that the scope of                   connected with a continuing                           notice if a new continuing relationship
pwalker on PROD1PC71 with RULES2




                                        the opt-out should be addressed                         relationship. This section provides that              is subsequently established.
                                        comprehensively in a single section of                  if there is no continuing relationship                   The new opt-out notice must apply, at
                                        the final rule. The Commission also                     between the consumer and a person or                  a minimum, to eligibility information
                                        concludes that tying the opt-out to the                 its affiliate, and if the person or its               obtained in connection with the new
                                        consumer could have had unintended                      affiliate provides an opt-out notice to a             continuing relationship. The new opt-


                                   VerDate Aug<31>2005   20:51 Oct 29, 2007   Jkt 214001   PO 00000   Frm 00020   Fmt 4701   Sfmt 4700   E:\FR\FM\30OCR2.SGM   30OCR2
                                                         Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations                                        61443

                                        out notice may apply more broadly to                    consumer’s opt-out should be honored                  consumer’s opt-out election is received
                                        information obtained in connection                      within a specific length of time not to               and the date the consumer’s opt-out
                                        with a terminated relationship and give                 exceed 30 days after the consumer                     election is implemented.
                                        the consumer the opportunity to opt out                 responds to the opt-out notice.                          The Commission also believes it is
                                        with respect to eligibility information                    A few industry commenters urged the                neither necessary nor desirable to set a
                                        obtained in connection with both the                    Commission to allow consumers to                      mandatory deadline for implementing
                                        terminated and the new continuing                       revoke an opt-out election orally. Other              the consumer’s opt-out election. A
                                        relationships. Further, the consumer’s                  industry commenters requested that the                general standard is preferable because
                                        failure to opt out does not override a                  final rule include a clear statement that             the time it will reasonably take to
                                        prior opt-out election by the consumer                  an opt-out period may be shortened to                 implement a consumer’s opt-out
                                        applicable to eligibility information                   a period of less than five years by the               election may vary.
                                        obtained in connection with a                           consumer’s revocation of an opt-out                      Consistent with the special rule for a
                                        terminated relationship that is still in                election. Consumer groups approved of                 notice following termination of a
                                        effect, regardless of whether the new                   the Commission’s statement that if a                  continuing relationship, the duration of
                                        opt-out notice applies to eligibility                   consumer opts out again during the five-              the opt-out is not affected by the
                                        information obtained in connection                      year opt-out period, then a new five-                 termination of a continuing
                                        with the terminated relationship. The                   year period begins. Consumer groups                   relationship. When a consumer opts out
                                        final rule also contains an example of                  also supported allowing institutions to               in the course of a continuing
                                        this special rule. The Commission notes,                make the opt-out period effective in                  relationship and that relationship is
                                        however, that where a consumer was                      perpetuity so long as this is clearly                 terminated during the opt-out period,
                                        not given an opt-out notice in                          disclosed to the consumer in the                      the opt-out remains in effect for the rest
                                        connection with the initial continuing                  original notice.                                      of the opt-out period. If the consumer
                                        relationship because eligibility                           The general provision regarding the                subsequently establishes a new
                                        information obtained in connection                      duration of the opt-out has been                      continuing relationship while the opt-
                                        with that continuing relationship was                   renumbered as § 680.22(b) in the final                out period remains in effect, the opt-out
                                        not shared with affiliates for use in                   rule, consistent with the Commission’s                period may not be shortened with
                                        making solicitations, an opt-out notice                 decision to address all scope issues in               respect to information obtained in
                                        provided in connection with a new                       the same section. The Commission has                  connection with the terminated
                                        continuing relationship would have to                   revised the duration provision to clarify             relationship by sending a new opt-out
                                        apply to any eligibility information                    that the opt-out period expires if the                notice to the consumer when the new
                                        obtained in connection with the                         consumer revokes the opt-out in writing               continuing relationship is established,
                                        terminated relationship that is to be                   or, if the consumer agrees,                           even if the consumer does not opt out
                                        shared with affiliates for use in making                electronically. The requirement for a                 upon receipt of the new opt-out notice.
                                        future solicitations.                                   written or electronic revocation is                   A person may track the eligibility
                                                                                                retained and is consistent with the                   information obtained in connection
                                        Duration and Timing of Opt-Out                          approach taken in the GLBA privacy                    with the terminated relationship and
                                           Proposed § 680.25 addressed the                      rule. The Commission does not believe                 provide a renewal notice to the
                                        duration and effect of the consumer’s                   it is necessary or appropriate to permit              consumer, or may choose not to use
                                        opt-out election. Proposed § 680.25(a)                  oral revocation. The Commission notes                 eligibility information obtained in
                                        provided that the consumer’s election to                that many of the exceptions to the                    connection with the terminated
                                        opt out would be effective for the opt-                 notice and opt-out requirements may be                relationship to make solicitations to the
                                        out period, which is a period of at least               triggered by oral communications, as                  consumer.
                                        five years beginning as soon as                         discussed above, which would enable                      Proposed § 680.25(c) clarified that a
                                        reasonably practicable after the                        the use of shared eligibility information             consumer may opt out at any time. As
                                        consumer’s opt-out election is received.                to make solicitations pending receipt of              explained in the supplementary
                                        The supplementary information noted                     a written or electronic revocation. Also,             information to the proposal, even if the
                                        that if a consumer elected to opt out                   as noted in the proposal, nothing                     consumer did not opt out in response to
                                        every year, a new opt-out period of at                  prohibits setting an opt-out period                   the initial opt-out notice or if the
                                        least five years would begin upon                       longer than five years, including an opt-             consumer’s election to opt out was not
                                        receipt of each successive opt-out                      out period that does not expire unless                prompted by an opt-out notice, a
                                        election.                                               revoked by the consumer.                              consumer may still opt out. Regardless
                                           Some industry commenters believed                       The Commission does not agree that                 of when the consumer opts out, the opt-
                                        that the proposal was inconsistent with                 the opt-out period should begin on the                out must be effective for a period of at
                                        the statute because it provided that the                date the consumer’s election to opt out               least five years.
                                        opt-out period would begin as soon as                   is received. Commenters generally                        The Commission received few
                                        reasonably practicable after the                        recognized that institutions cannot                   comments on this provision. Consumer
                                        consumer’s opt-out election is received.                instantaneously implement a                           groups urged the Commission to
                                        These commenters believed that the opt-                 consumer’s opt-out election but need                  reinforce the continuing nature of the
                                        out period should begin on the date the                 time to do so. The Commission                         right to opt out by requiring institutions
                                        consumer’s opt-out is received and that                 interprets the statutory language to                  to give the opt-out notice annually along
                                        the final rule also should allow                        mean that the consumer’s opt-out                      with the annual GLBA privacy notice.
                                        institutions a reasonable period of time                election must be honored for a period of              These commenters acknowledged that
                                        to implement a consumer’s initial or                    at least five years from the date such                the FCRA does not specifically state that
                                        renewal opt-out election before it                      election is implemented. The                          the notice is required annually, but
pwalker on PROD1PC71 with RULES2




                                        becomes effective. Consumer groups                      Commission believes that Congress did                 noted that the statute also does not say
                                        believed that the requirement to honor                  not intend for the opt-out period to be               that the consumer has only one
                                        an opt-out ‘‘beginning as soon as                       shortened to a period of less than the                opportunity to opt out.
                                        reasonably practicable’’ was too vague.                 five years specified in the statute to                   The Commission has renumbered the
                                        These commenters believed that a                        reflect the time between the date the                 provision giving the consumer the right


                                   VerDate Aug<31>2005   20:51 Oct 29, 2007   Jkt 214001   PO 00000   Frm 00021   Fmt 4701   Sfmt 4700   E:\FR\FM\30OCR2.SGM   30OCR2
                                        61444            Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations

                                        to opt out at any time as § 680.22(c) in                notice. A representation that the notice              duration of the opt-out period that it
                                        the final rule, but otherwise adopted the               is provided by ‘‘the ABC banking, credit              previously disclosed or honor the opt-
                                        provision as proposed. The Commission                   card, insurance, and securities                       out in perpetuity has no obligation to
                                        finds no statutory basis for requiring the              companies’’ applies to all companies in               provide a revised notice to the
                                        provision of an annual opt-out notice to                those categories, not just some of those              consumer. In that case, the result is the
                                        consumers along with the GLBA privacy                   companies. But if the affiliates                      same as if the institution established a
                                        notice.                                                 providing the notice do not all share a               five-year opt-out period and then did
                                                                                                common name, then the notice must                     not send a renewal notice at the end of
                                        Section 680.23 Contents of Opt-out                      either separately identify each affiliate             that period. A person receiving
                                        Notice; Consolidated and Equivalent                     by name or identify each of the common                eligibility information from an affiliate
                                        Notices                                                 names used by those affiliates. For                   would be prohibited from using that
                                        Contents in General                                     example, if the affiliates providing the              information to make solicitations to a
                                           Section 680.21 of the proposal                       notice do business under both the ABC                 consumer unless a renewal notice is
                                        addressed the contents of the opt-out                   name and the XYZ name, then the                       first provided to the consumer and the
                                        notice. Proposed § 680.21(a) would have                 notice could list each affiliate by name              consumer does not renew the opt-out.
                                        required that the opt-out notice be clear,              or indicate that the notice is being                  So long as no solicitations are made
                                        conspicuous, and concise, and                           provided by ‘‘all of the ABC and XYZ                  using eligibility information received
                                        accurately disclose: (1) that the                       companies’’ or by ‘‘the ABC banking                   from an affiliate, there would be no
                                        consumer may elect to limit a person’s                  and credit card companies and the XYZ                 violation of the statute or regulation for
                                                                                                insurance companies.’’                                failing to send a renewal notice in this
                                        affiliate from using eligibility
                                                                                                   Section 680.23(a)(1)(ii) provides that             situation.
                                        information about the consumer that it
                                                                                                an opt-out notice must contain a list of
                                        obtains from that person to make or                     the affiliates or types of affiliates                 Joint Notice
                                        send solicitations to the consumer; (2) if              covered by the notice. The notice may                    Proposed § 680.24(c) permitted a
                                        applicable, that the consumer’s election                apply to multiple affiliates and to                   person subject to this rule to provide a
                                        will apply for a specified period of time               companies that become affiliates after                joint opt-out notice with one or more of
                                        and that the consumer will be allowed                   the notice is provided to the consumer.               its affiliates that are identified in the
                                        to extend the election once that period                 The rule for identifying the affiliates               notice, so long as the notice was
                                        expires; and (3) a reasonable and simple                covered by the notice is substantially                accurate with respect to each affiliate
                                        method for the consumer to opt out.                     similar to the rule for identifying the               jointly issuing the notice. Under the
                                           Some commenters expressed concern                    affiliates providing the notice in                    proposal, a joint notice would not have
                                        about requiring the notice to specify the               § 680.23(a)(1)(i), as described in the                to list each affiliate participating in the
                                        applicable time period and the                          previous paragraph.                                   joint notice by its name, but could state
                                        consumer’s right to extend the election                    Sections 680.23(a)(1)(iii)-(vii)                   that it applies to ‘‘all institutions with
                                        once the opt-out expires. One                           respectively require the opt-out notice               the ABC name’’ or ‘‘all affiliates in the
                                        commenter believed this would require                   to include the following: a general                   ABC family of companies.’’
                                        institutions to determine in advance the                description of the types of eligibility                  One commenter believed that
                                        length of the opt-out period. Another                   information that may be used to make                  individually listing each company could
                                        commenter urged the Commission to                       solicitations to the consumer; a                      result in long and confusing notices.
                                        clarify that institutions could                         statement that the consumer may elect                 This commenter suggested revising the
                                        subsequently increase the duration of                   to limit the use of eligibility information           rule to permit the generic identification
                                        the opt-out or make it permanent                        to make solicitations to the consumer; a              of the types of affiliates by whom
                                        without providing another notice to the                 statement that the consumer’s election                eligibility information may be used to
                                        consumer.                                               will apply for the specified period of                make solicitations and to allow the
                                           The Commission has renumbered the                    time stated in the notice and, if                     notice to apply to entities that become
                                        provisions addressing the contents of                   applicable, that the consumer will be                 affiliates after the notice is sent.
                                        the opt-out notice as § 680.23(a) in the                allowed to renew the election once that                  In the final rule, the separate joint
                                        final rule and revised them. Section                    period expires; if the notice is provided             notice provision has been eliminated.
                                        680.23(a)(1) of the final rule requires                 to consumers who may have previously                  Instead, the final rule incorporates the
                                        additional information in opt-out                       opted out, such as if a notice is provided            joint notice option into the provisions
                                        notices. Section 680.23(a)(1)(i) provides               to consumers annually, a statement that               that address which affiliates may
                                        that all opt-out notices must identify, by              the consumer who has chosen to limit                  provide the opt-out notice and the
                                        name, the affiliate(s) that is providing                marketing offers does not need to act                 contents of the notice.
                                        the notice. A group of affiliates may                   again until the consumer receives a
                                        jointly provide the notice. If the notice               renewal notice; and a reasonable and                  Joint relationships
                                        is provided jointly by multiple affiliates              simple method for the consumer to opt                   The proposal addressed joint
                                        and each affiliate shares a common                      out. The statement described in                       relationships in the section dealing with
                                        name, such as ‘‘ABC,’’ then the notice                  § 680.23(a)(1)(vi) regarding consumers                delivery of opt-out notices. Proposed
                                        may indicate that it is being provided by               who may have previously opted out                     § 680.24(d) set out a rule that would
                                        multiple companies with the ABC name                    does not apply to the model privacy                   apply when two or more consumers
                                        or multiple companies in the ABC group                  form that the Commission is developing                jointly obtain a product or service from
                                        or family of companies. Acceptable                      in a separate rulemaking. Appropriate                 a person subject to the rule (referred to
                                        ways of identifying the multiple                        use of the model forms in Appendix C                  in the proposed regulation as ‘‘joint
                                        affiliates providing the notice include                 will satisfy these content requirements.              consumers’’), such as a joint credit card
pwalker on PROD1PC71 with RULES2




                                        stating that the notice is provided by                     The Commission continues to believe                account. It also provided several
                                        ‘‘all of the ABC companies,’’ ‘‘the ABC                 that the opt-out notice must specify the              examples. Under the proposal, a person
                                        banking, credit card, insurance, and                    length of the opt-out period, if one is               subject to this rule could provide a
                                        securities companies,’’ or by listing the               provided. However, an institution that                single opt-out notice to joint
                                        name of each affiliate providing the                    subsequently chooses to increase the                  accountholders. The notice would have


                                   VerDate Aug<31>2005   20:51 Oct 29, 2007   Jkt 214001   PO 00000   Frm 00022   Fmt 4701   Sfmt 4700   E:\FR\FM\30OCR2.SGM   30OCR2
                                                         Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations                                       61445

                                        had to indicate whether the person                      may opt out with respect to affiliate                 under section 603(d)(2)(A)(iii) of the
                                        would consider an opt-out by a joint                    marketing in connection with an                       FCRA.
                                        accountholder as an opt-out by all of the               individually-held account, but not opt                   Commenters generally supported the
                                        associated accountholders, or whether                   out with respect to affiliate marketing in            proposed provision. Several
                                        each accountholder would have to opt                    connection with a joint relationship. In              commenters believed it was probable
                                        out separately. The person could not                    that case, it could be challenging to                 that most institutions would want to
                                        require all accountholders to opt out                   identify which consumer information                   provide the affiliate marketing opt-out
                                        before honoring an opt-out direction by                 may and may not be used by affiliates                 notice with their existing GLBA privacy
                                        one of the joint accountholders. Because                to make solicitations to the consumer.                notice to reduce compliance costs and
                                        section 624 of the FCRA deals with the                  Nevertheless, the final rule permits                  minimize consumer confusion. One
                                        use of information for marketing by                     persons providing opt-out notices to                  commenter believed that institutions
                                        affiliates, rather than the sharing of                  consumers to provide a single opt-out                 would be less likely to include the opt-
                                        information among affiliates, comment                   notice to joint consumers.                            out notice as part of their annual GLBA
                                        was requested on whether information                                                                          privacy notice because section 214 does
                                        about a joint account should be allowed                 Alternative Contents
                                                                                                                                                      not have an annual notice requirement.
                                        to be used for making solicitations to a                   Proposed § 680.21(d) provided that,                   The Commission has moved the
                                        joint consumer who has not opted out.                   where an institution elects to give                   provisions addressing consolidated and
                                           Some commenters supported the                        consumers a broader right to opt out of               equivalent notices to the section
                                        flexible approach proposed by the                       marketing than is required by this part,              addressing the contents of the notice
                                        Commission for dealing with joint                       the institution would have the ability to             and renumbered those provisions as
                                        accounts and notice to joint                            modify the contents of the opt-out                    §§ 680.23(b) and (c) respectively in the
                                        accountholders. One commenter                           notice to reflect accurately the scope of             final rule. Otherwise, those provisions
                                        suggested providing additional                          the opt-out right it provides to                      have been adopted as proposed with
                                        flexibility to enable consumers to opt                  consumers. This section also noted that               one exception. The provision on
                                        out in certain circumstances, such as                   proposed Appendix A provided a model                  equivalent notices clarifies that an
                                        when eligibility information from a joint               form that may be helpful for institutions             equivalent notice satisfies the
                                        account is involved, but not in others,                 that wish to allow consumers to opt out               requirements of § 680.23—not the entire
                                        such as when eligibility information                    of all marketing from the institution and             part—because the part addresses many
                                        from an individual account is involved.                 its affiliates, but use of the model form             issues besides the content of the notice,
                                        Another commenter, however, believed                    is not required. Commenters generally                 such as delivery and renewal of opt-
                                        that the provisions regarding joint                     favored the flexibility afforded by this              outs. The Commission believes that
                                        relationships may not be appropriate for                provision. The Commission has                         these provisions are related to the
                                        the affiliate marketing rule because
                                                                                                renumbered the provision addressing                   contents of the notice and should
                                        section 624 relates to the use of
                                                                                                alternative contents as § 680.23(a)(3) in             therefore be included in this section.
                                        information for marketing to a particular
                                                                                                the final rule, but otherwise adopted it                 The Commission encourages
                                        consumer, not to the sharing of
                                                                                                as proposed.                                          consolidation of the affiliate marketing
                                        information among affiliates. Consumer
                                        groups urged the Commission to                          Model Notices                                         opt-out notice with the GLBA privacy
                                        prohibit the use of eligibility                                                                               notice, including the affiliate sharing
                                        information about a joint account for                      Section 680.23(a)(4) in the final rule             opt-out notice under section
                                        making solicitations to a consumer who                  states that model notices are provided in             603(d)(2)(A)(iii) of the FCRA, so that
                                        has not opted out if the other joint                    Appendix C of Part 698, renumbered                    consumers receive a single notice they
                                        consumer on the account has opted out.                  from Appendix A of Part 680. The                      can use to review and exercise all
                                           The Commission has renumbered the                    Commission has provided these model                   privacy opt-outs. Consolidation of these
                                        provision addressing joint relationships                notices to facilitate compliance with the             notices, however, presents special
                                        as § 680.23(a)(2) in the final rule. The                rule. However, the final rule does not                issues. For example, the affiliate
                                        Commission has deleted the example of                   require use of the model notices.                     marketing opt-out may be limited to a
                                        joint relationships from the final rule                 Consolidated and Equivalent Notices                   period of at least five years, subject to
                                        because it addressed, in part, the                                                                            renewal, whereas the GLBA privacy and
                                        sharing of information, rather than the                   Proposed § 680.27 provided that an                  FCRA section 603(d)(2)(A)(iii) opt-out
                                        use of information. The Commission has                  opt-out notice required by this part                  notices are not time-limited. This
                                        made other revisions to enhance the                     could be coordinated and consolidated                 difference, if applicable, must be made
                                        readability of this provision. The                      with any other notice or disclosure                   clear to the consumer. Thus, if a
                                        revised provision is substantively                      required to be issued under any other                 consolidated notice is used and the
                                        similar to the joint relationships                      provision of law, including but not                   affiliate marketing opt-out is limited in
                                        provision of the GLBA privacy rule,                     limited to the notice described in                    duration, the notice must inform
                                        except to the extent that rule refers to                section 603(d)(2)(A)(iii) of the FCRA                 consumers that if they previously opted
                                        the sharing of information among                        and the notice required by title V of the             out, they do not need to opt out again
                                        affiliates.                                             GLBA. In addition, a notice or other                  until they receive a renewal notice
                                           The Commission believes that                         disclosure that was equivalent to the                 when the opt-out expires or is about to
                                        different issues may arise with regard to               notice required by this part, and that                expire. In addition, as discussed more
                                        providing a single opt-out notice to joint              was provided to a consumer together                   fully below, the Commission has
                                        consumers in the context of this rule,                  with disclosures required by any other                developed a model privacy form that
                                        which focuses on the use of                             provision of law, would satisfy the                   includes the affiliate marketing opt-out.
pwalker on PROD1PC71 with RULES2




                                        information, compared to issues that                    requirements of this part. The proposal               The Commission expects that once
                                        may arise with regard to providing such                 specifically requested comment on the                 published in final form, use of the
                                        a notice in the context of other privacy                consolidation of the affiliate marketing              model privacy form will satisfy the
                                        rules that focus on the sharing of                      notice with the GLBA privacy notice                   requirement to provide an affiliate
                                        information. For example, a consumer                    and the affiliate sharing opt-out notice              marketing opt-out notice.


                                   VerDate Aug<31>2005   20:51 Oct 29, 2007   Jkt 214001   PO 00000   Frm 00023   Fmt 4701   Sfmt 4700   E:\FR\FM\30OCR2.SGM   30OCR2
                                        61446            Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations

                                        Section 680.24 Reasonable Opportunity                   out must be provided, the Commission                  consumer could be required to check a
                                        to Opt Out                                              believes that the appropriate time to                 box right at the Internet Web site in
                                           Section 680.22(a) of the proposal                    permit solicitations may vary depending               order to opt out or decline to opt out
                                        provided that before a receiving affiliate              upon the circumstances. A general                     before continuing with the transaction.
                                        could use eligibility information to                    standard provides flexibility to allow a              However, this example would not cover
                                        make or send solicitations to the                       person to use eligibility information it              a situation where the consumer was
                                        consumer, the communicating affiliate                   receives from an affiliate to make                    required to send a separate e-mail or
                                        would have to provide the consumer                      solicitations at an appropriate point in              visit a different Internet Web site in
                                        with a reasonable opportunity to opt out                time that may vary depending upon the                 order to opt out.
                                                                                                circumstances, while assuring that the                   Proposed § 680.22(b)(4) illustrated
                                        following delivery of the opt-out notice.
                                                                                                consumer is given a realistic                         that including the affiliate marketing
                                        Given the variety of circumstances in
                                                                                                opportunity to prevent such use of this               opt-out notice in a notice under the
                                        which institutions must provide a                                                                             GLBA would satisfy the reasonable
                                                                                                information. In the final rule, the
                                        reasonable opportunity to opt out, the                                                                        opportunity standard. In such cases, the
                                                                                                Commission has retained the approach
                                        proposal construed the requirement for                                                                        consumer would be allowed to exercise
                                                                                                of not requiring affiliate marketing opt-
                                        a reasonable opportunity to opt out as                                                                        the opt-out in the same manner and
                                                                                                out notices to disclose how long a
                                        a general test that would avoid setting                                                                       would be given the same amount of time
                                                                                                consumer has to respond before
                                        a mandatory waiting period in all cases.                                                                      to exercise the opt-out as is provided for
                                                                                                eligibility information may be used to
                                           The proposed rule would not have                                                                           any other opt-out provided in the GLBA
                                                                                                make solicitations to the consumer or
                                        required institutions subject to the rule                                                                     privacy notice.
                                                                                                that consumers may exercise their right
                                        to disclose how long a consumer would                                                                            Proposed § 680.22(b)(5) illustrated
                                                                                                to opt out at any time. However, an
                                        have to respond to the opt-out notice                                                                         how an ‘‘opt-in’’ could meet the
                                                                                                institution may, at its option, add this
                                        before eligibility information                                                                                requirement to provide a reasonable
                                                                                                information to its opt-out notice.
                                        communicated to affiliates could be                        Section 680.22(b) of the proposal                  opportunity to opt out. Specifically, if
                                        used to make or send solicitations to the               provided examples to illustrate what                  an institution has a policy of not
                                        consumer, although institutions would                   would constitute a reasonable                         allowing its affiliates to use eligibility
                                        have the flexibility to include such                    opportunity to opt out. The proposed                  information to market to consumers
                                        disclosures in their notices. In this                   examples would have provided a                        without the consumer’s affirmative
                                        respect, the proposed rule was                          generally applicable safe harbor for opt-             consent, providing the consumer with
                                        consistent with the GLBA privacy rule.                  out periods of 30 days. As explained in               an opportunity to ‘‘opt in’’ or
                                           Industry commenters generally                        the supplementary information to the                  affirmatively consent to such use would
                                        supported the Commission’s approach                     proposal, although 30 days would be a                 constitute a reasonable opportunity to
                                        of treating the requirement for a                       safe harbor, a person subject to this                 opt out. The supplementary information
                                        reasonable opportunity to opt out as a                  requirement could decide, at its option,              clarified that the consumer’s affirmative
                                        general test that would avoid setting a                 to give consumers more than 30 days in                consent must be documented and that a
                                        mandatory waiting period. NAAG, on                      which to decide whether or not to opt                 pre-selected check box would not
                                        the other hand, believed that the                       out. A shorter waiting period could be                evidence the consumer’s affirmative
                                        Commission should set a mandatory                       adequate in certain situations                        consent.
                                        waiting period of at least 45 days from                 depending on the circumstances.                          Some industry commenters supported
                                        the date of mailing or other transmission                  Proposed §680.22(b)(1) contained an                the proposed 30-day safe harbor and the
                                        of the notice because consumers may be                  example of a reasonable opportunity to                examples illustrating the safe harbor.
                                        ill, away from home, or otherwise                       opt out when the notice was provided                  Other industry commenters, however,
                                        unable to respond to correspondence                     by mail. Proposed § 680.22(b)(2)                      expressed concern that the 30-day safe
                                        promptly.                                               contained an example of a reasonable                  harbor would become the mandatory
                                           Industry commenters generally                        opportunity to opt out when the notice                minimum waiting period in virtually all
                                        supported the Commission’s decision                     was provided by electronic means. The                 cases, particularly because of the risk of
                                        not to require the disclosure of how long               proposed examples were consistent                     civil liability. For this reason, some
                                        a consumer would have to respond to                     with examples used in the GLBA                        industry commenters objected to the use
                                        the opt-out notice before eligibility                   privacy rule.                                         of examples altogether and urged that
                                        information could be used to make or                       Proposed § 680.22(b)(3) contained an               the Commission delete the proposed
                                        send solicitations to the consumer.                     example of a reasonable opportunity to                examples. Other industry commenters
                                        Consumer groups believed that                           opt out where, in a transaction                       asked the Commission to include only
                                        consumers should be told how long they                  conducted electronically, the consumer                the examples from the GLBA.
                                        have to respond to the notice before                    was required to decide, as a necessary                   Consumer groups believed that the
                                        eligibility information could be used by                part of proceeding with the transaction,              safe harbor should be 45 days, rather
                                        affiliates to make or send solicitations                whether or not to opt out before                      than 30 days. These commenters
                                        and that they may exercise their right to               completing the transaction, so long as                believed that 45 days was necessary in
                                        opt out at any time.                                    the institution provided a simple                     part to account for the time consumed
                                           The Commission has renumbered the                    process at the Internet Web site that the             in mail deliveries and in part to avoid
                                        section addressing a reasonable                         consumer could use at that time to opt                penalizing consumers who are away
                                        opportunity to opt out as § 680.24 in the               out. In this example, the opt-out notice              from home for vacation or illness.
                                        final rule and revised it. Section                      would automatically be provided to the                   Regarding the specific examples, a
                                        680.24(a) of the final rule retains the                 consumer, such as through a non-                      few commenters objected to the
                                        approach of construing the requirement                  bypassable link to an intermediate Web                example in proposed § 680.22(b)(2),
pwalker on PROD1PC71 with RULES2




                                        for a reasonable opportunity to opt out                 page, or ‘‘speedbump.’’ The consumer                  stating that the acknowledgment of
                                        as a general test that avoids setting a                 would be given a choice of either opting              receipt requirement would be
                                        mandatory waiting period in all cases.                  out or not opting out at that time                    inconsistent with the Electronic
                                        Given the variety of circumstances in                   through a simple process conducted at                 Signatures in Global and National
                                        which a reasonable opportunity to opt                   the Web site. For example, the                        Commerce Act (E-Sign Act). One of


                                   VerDate Aug<31>2005   20:51 Oct 29, 2007   Jkt 214001   PO 00000   Frm 00024   Fmt 4701   Sfmt 4700   E:\FR\FM\30OCR2.SGM   30OCR2
                                                         Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations                                       61447

                                        these commenters believed this                          opt out by electronic means and divided               boxes: one that allows consumers to
                                        requirement amounted to an opt-in for                   it into two subparts in the final rule to             indicate that they want to opt out and
                                        electronic notices. Several commenters                  illustrate the different means of                     one that allows consumers to indicate
                                        believed that the example in proposed                   delivering an electronic notice. The                  that they do not want to opt out.
                                        § 680.22(b)(3) for requesting the                       example illustrates that for notices                    In the final rule, the Commission has
                                        consumer to opt out as a necessary step                 provided electronically, such as by                   retained the example of including the
                                        in proceeding with an electronic                        posting the notice at an Internet Web                 opt-out notice in a privacy notice in
                                        transaction should not be limited to                    site at which the consumer has obtained               § 680.24(b)(5) as consistent with the
                                        electronic transactions, but should be                  a product or service, a reasonable                    statutory requirement that the
                                        expanded to apply to all transaction                    opportunity to opt out would include                  Commission consider methods for
                                        methods. A number of commenters                         giving the consumer 30 days after the                 coordinating and combining notices.
                                        believed that the example in proposed                   consumer acknowledges receipt of the                  The Commission has deleted the
                                        § 680.22(b)(5) should either be deleted                 electronic notice to opt out by any                   example of providing an opt-in as a
                                        or, alternatively, should not refer to                  reasonable means. The acknowledgment                  form of opting out as unnecessary and
                                        ‘‘affirmative’’ consent. These                          of receipt aspect of this example is                  confusing.
                                        commenters noted that the example in                    consistent with an example in the GLBA                Section 680.25 Reasonable and Simple
                                        proposed § 680.22(b)(4) allowed a                       privacy regulation. The example also                  Methods of Opting Out
                                        person to satisfy the reasonable                        illustrates that for notices provided by e-
                                        opportunity standard by permitting the                  mail to a consumer who had agreed to                     Section 680.23 of the proposal set
                                        consumer to exercise the opt-out in the                 receive disclosures by e-mail from the                forth reasonable and simple methods of
                                        same manner and giving the consumer                     person sending the notice, a reasonable               opting out. This section generally
                                        the same amount of time to exercise the                 opportunity to opt out would include                  tracked the examples of reasonable opt-
                                        opt-out as provided in the GLBA                         giving the consumer 30 days after the e-              out means from § 313.7(a)(2)(ii) of the
                                        privacy notice and that the GLBA rule                   mail is sent to elect to opt out by any               GLBA privacy regulation with certain
                                        did not require ‘‘affirmative’’ consent.                reasonable means. The Commission                      revisions to give effect to Congress’
                                           The Commission has renumbered the                    does not believe that consumer                        mandate that methods of opting out be
                                        examples of a reasonable opportunity to                 acknowledgment is necessary where the                 simple. For instance, proposed
                                        opt out as § 680.24(b) in the final rule,               consumer has agreed to receive                        § 680.23(a)(2) referred to including a
                                        and revised them as discussed below.                    disclosures by e-mail.                                self-addressed envelope with the reply
                                        The Commission believes the examples                       The Commission has determined that                 form and opt-out notice. The
                                        are helpful in illustrating what                        the electronic delivery of affiliate                  Commission also contemplated that a
                                        constitutes a reasonable opportunity to                 marketing opt-out notices does not                    toll-free telephone number would be
                                        opt out.                                                require consumer consent in accordance                adequately designed and staffed to
                                           The generally applicable 30-day safe                 with the E-Sign Act because neither                   enable consumers to opt out in a single
                                        harbor is retained in the final rule. The               section 624 of the FCRA nor this final                phone call.
                                        Commission believes that providing a                    rule requires that the notice be provided                Proposed § 680.23(b) set forth
                                        generally applicable safe harbor of 30                  in writing. Thus, the Commission does                 methods of opting out that are not
                                        days is helpful because it affords                      not believe that the acknowledgment of                reasonable and simple, such as
                                        certainty to entities that choose to                    receipt trigger is beyond the scope of                requiring the consumer to write a letter
                                        follow the 30-day waiting period.                       their interpretive authority. Persons that            to the institution or to call or write to
                                        Although 30 days is a safe harbor in all                provide affiliate marketing opt-out                   obtain an opt-out form rather than
                                        cases, a person providing an opt-out                    notices under this part electronically                including it with the notice. This
                                        notice may decide, at its option, to give               may do so pursuant to the agreement of                section generally tracked the examples
                                        consumers more than 30 days in which                    the consumer, as specified in this rule,              of unreasonable opt-out means from
                                        to decide whether or not to opt out. A                  or in accordance with the requirements                § 313.7(a)(2)(iii) of the GLBA privacy
                                        shorter waiting period could be                         of the E-Sign Act.                                    rule. In addition, the proposal contained
                                        adequate in certain situations,                            The Commission believes that the                   an example of a consumer who agrees
                                        depending on the circumstances, in                      example of a consumer who is required                 to receive the opt-out notice in
                                        accordance with the general test for a                  to opt out as a necessary part of                     electronic form only, such as by
                                        reasonable opportunity to opt out. The                  proceeding with the transaction should                electronic mail or by using a process at
                                        use of examples and a 30-day safe                       not be limited to electronic transactions.            a Web site. Such a consumer should not
                                        harbor is consistent with the approach                  However, rather than revising the                     be required to opt out solely by
                                        followed in the GLBA privacy rule.                      electronic transactions example, the                  telephone or paper mail.
                                        However, the Commission believes that                   Commission has retained the electronic                   Many industry commenters asked the
                                        the examples in this rule should differ                 transactions example in § 680.24(b)(3)                Commission to clarify that the examples
                                        to some extent from the examples in the                 and added a new example for in-person                 are not the only ways to comply with
                                        GLBA privacy rule because the affiliate                 transactions in § 680.24(b)(4). Together,             the rule. These commenters believed
                                        marketing opt-out requires a one-time,                  these examples illustrate that an                     that, as drafted, the proposal could be
                                        not an annual, notice. Further, the                     abbreviated opt-out period is                         interpreted as an exclusive rule, rather
                                        affiliate marketing notice may, but need                appropriate when the consumer is given                than as examples. These commenters
                                        not, be included in the GLBA privacy                    a ‘‘yes’’ or ‘‘no’’ choice and is not                 asked the Commission to make clear in
                                        notice.                                                 permitted to proceed with the                         the final rule that the methods set out
                                           In the final rule, the Commission has                transaction unless the consumer makes                 in the rule are examples and do not
                                        retained the example of a reasonable                    a choice. For in-person transactions,                 exclude other reasonable and simple
pwalker on PROD1PC71 with RULES2




                                        opportunity to opt out by mail with                     consumers could be provided a form                    methods of opting out. A few industry
                                        revisions for clarity. Commenters had                   with a question that requires the                     commenters believed that the final rule
                                        no specific objections to this example.                 consumer to write a ‘‘yes’’ or ‘‘no’’ to              should not include any examples of
                                           The Commission has revised the                       indicate their opt-out preference or a                methods of opting out because of the
                                        example of a reasonable opportunity to                  form that contains two blank check                    potential for civil liability.


                                   VerDate Aug<31>2005   20:51 Oct 29, 2007   Jkt 214001   PO 00000   Frm 00025   Fmt 4701   Sfmt 4700   E:\FR\FM\30OCR2.SGM   30OCR2
                                        61448            Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations

                                           Many industry commenters also urged                  a general rule and examples in separate               through posting at an Internet Web site,
                                        the Commission to use the same                          paragraphs (a) and (b) respectively. This             to opt out solely by paper mail or by
                                        examples used in the GLBA privacy                       revision clarifies that the specific                  visiting a different Web site without
                                        rule. These commenters did not believe                  methods identified in the rule are                    providing a link to that site.
                                        that Congress would allow coordinated                   examples, not an exhaustive list of                     Section 680.25(c) has been added to
                                        and consolidated notices, but require                   permissible methods.                                  clarify that each consumer may be
                                        different methods of opting out. For                       The Commission believes that                       required to opt out through a specific
                                        instance, these commenters                              including examples in § 680.25(b) is                  means, as long as that means is
                                        recommended deleting the reference to                   helpful. However, the Commission                      reasonable and simple for that
                                        a self-addressed envelope because there                 declines to adopt the GLBA examples                   consumer. This new section
                                        is no such reference in the GLBA                        without change. Section 624 of the                    corresponds to a provision in the GLBA
                                        privacy rule. One commenter noted that                  FCRA requires the Commission to                       privacy rule, 16 CFR § 313.7(a)(2)(iv).
                                        its experience with self-addressed                      ensure that the consumer is given
                                        envelopes was negative because                          reasonable and simple methods of                      Section 680.26 Delivery of Opt-out
                                        consumers often used the envelopes for                  opting out. The GLBA did not require                  Notices
                                        other purposes resulting in misdirected                 simple methods of opting out. The                     General rule and examples
                                        communications. Industry commenters                     Commission believes that the methods
                                                                                                                                                         Section 680.24 of the proposal
                                        also objected to requiring institutions to              of opting out can, in some instances, be
                                                                                                                                                      addressed the delivery of opt-out
                                        provide an electronic opt-out                           simpler than some of the reasonable
                                                                                                                                                      notices. Proposed § 680.24(a) provided
                                        mechanism to a consumer who agrees to                   methods illustrated in the GLBA privacy
                                                                                                                                                      that an institution would have to deliver
                                        receive an opt-out notice in electronic                 rule. To effectuate the statutory mandate
                                                                                                                                                      an opt-out notice so that each consumer
                                        form. These commenters believed this                    that consumers have simple methods of
                                                                                                                                                      could reasonably be expected to receive
                                        example was unjustified and                             opting out, the Commission has
                                                                                                                                                      actual notice. This standard would not
                                        inconsistent with the GLBA privacy                      modified, for purposes of this
                                                                                                                                                      have required actual notice. The
                                        rule. Commenters also indicated that                    rulemaking, some of the examples of
                                                                                                                                                      supplementary information to the
                                        some institutions may not have the                      reasonable methods of opting out that
                                                                                                were used in the GLBA privacy                         proposal also clarified that, for opt-out
                                        technical capabilities to accept
                                                                                                regulation.                                           notices delivered electronically, the
                                        electronic opt-outs. Several commenters
                                                                                                   Most of the examples in the final rule             notices could be delivered either in
                                        recommended that the Commission
                                                                                                are substantially similar to those in                 accordance with the electronic
                                        clarify that an institution is not
                                                                                                § 680.23(a) and (b) of the proposal with              disclosure provisions in this part or in
                                        obligated to honor opt-outs submitted
                                                                                                revisions for clarity. The example in                 accordance with the E-Sign Act. For
                                        through means other than those
                                                                                                § 680.25(b)(1)(ii) has been revised to                example, the institution could e-mail its
                                        designated by the institution.
                                           Consumer groups generally believed                   reflect the Commission’s understanding                notice to a consumer who agreed to the
                                        that the proposal appropriately tracked                 that the reply form and self-addressed                electronic delivery of information or
                                        the examples in the GLBA privacy                        envelope would be included together                   provide the notice on its Internet Web
                                        regulation with revisions to give effect                with the opt-out notice. As in the                    site for a consumer who obtained a
                                        to Congress’ mandate that methods of                    proposal, the Commission contemplates                 product or service electronically from
                                        opting out be simple. These commenters                  that a toll-free telephone number that                that Web site. Commenters generally
                                        believed, however, that the proposal                    consumers may call to opt out, as                     supported the reasonable expectation of
                                        was inadequate because it provided                      illustrated by the example in                         actual notice standard.
                                        examples instead of requiring the use of                § 680.25(b)(1)(iv), would be adequately                  Proposed § 680.24(b) provided
                                        certain methods. These commenters                       designed and staffed to enable                        examples to illustrate what would
                                        believed that the final rule should                     consumers to opt out in a single phone                constitute delivery of an opt-out notice.
                                        require self-addressed envelopes and                    call. In setting up a toll-free telephone             Commenters expressed concern about
                                        require that toll-free numbers be                       number that consumers may use to                      the electronic notice example in
                                        adequately designed and staffed to                      exercise their opt-out rights, institutions           proposed paragraph (b)(1)(iii).
                                        enable consumers to opt out in a single                 should minimize extraneous messages                   Consumer groups objected to this
                                        phone call. According to these                          directed to consumers who are in the                  example by pointing to a growing trend
                                        commenters, inadequate and poorly                       process of opting out.                                in which companies require consumers
                                        trained staff has been a shortcoming of                    One new example in § 680.25(b)(1)(v)               to agree to electronic notices if they
                                        the GLBA opt-out procedures. These                      illustrates that reasonable and simple                conduct business on an Internet Web
                                        commenters also recommended that                        methods include allowing consumers to                 site. These commenters believed that
                                        consumers be given the opportunity to                   exercise all of their opt-out rights                  there was nothing to ensure that the
                                        opt out by a simple check box on                        described in a consolidated opt-out                   notice would be clearly accessible to
                                        payment coupons. Finally, these                         notice that includes the GLBA privacy,                consumers on the Web site. These
                                        commenters asked the Commission to                      FCRA affiliate sharing, and FCRA                      commenters believed that, at a
                                        clarify that the federal standard is a                  affiliate marketing opt-outs, by a single             minimum, the Commission should
                                        floor and that if the notice is combined                method, such as by calling a single toll-             require the notice to be sent to the
                                        with other choices made available under                 free telephone number. This example                   consumer’s e-mail address, rather than
                                        other federal and state laws, the most                  furthers the statutory directive to the               posted to an Internet Web site, where
                                        consumer-friendly means for opting out                  Commission to ensure that notices and                 the consumer has expressly opted in to
                                        should apply.                                           disclosures may be coordinated and                    the electronic delivery of notices. Some
                                           The Commission has renumbered the                    consolidated. The final rule also                     industry commenters objected to the
pwalker on PROD1PC71 with RULES2




                                        section addressing reasonable and                       clarifies the example renumbered as                   acknowledgment of receipt requirement
                                        simple methods of opting out as                         § 680.25(b)(2)(iii) to illustrate that it is          in this example as inconsistent with the
                                        § 680.25 in the final rule, and revised it              not reasonable or simple to require a                 E-Sign Act. One of these commenters
                                        as discussed below. The Commission                      consumer who receives the opt-out                     urged the Commission to explicitly
                                        has restructured this section to include                notice in electronic form, such as                    incorporate the E-Sign Act into the


                                   VerDate Aug<31>2005   20:51 Oct 29, 2007   Jkt 214001   PO 00000   Frm 00026   Fmt 4701   Sfmt 4700   E:\FR\FM\30OCR2.SGM   30OCR2
                                                         Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations                                        61449

                                        requirements for delivering opt-out                     privacy rule and seems appropriate                    be given to the consumer either a
                                        notices.                                                where the notice is posted at an Internet             reasonable period of time before the
                                           The Commission has renumbered the                    Web site.                                             expiration of the opt-out period, or any
                                        general rule regarding delivery of opt-                   The Commission declines to require                  time after the expiration of the opt-out
                                        out notices as § 680.26(a) in the final                 the delivery of electronic notices by e-              period but before solicitations that
                                        rule and divided the examples into                      mail. Concerns about the security of e-               would have been prohibited by the
                                        positive and negative examples in                       mail, especially phishing, make it                    expired opt-out are made to the
                                        §§ 680.26(b) and (c) respectively. In the               inappropriate to require e-mail as the                consumer. The Commission did not
                                        final rule, the Commission has retained                 only permissible form of electronic                   propose to set a fixed time for what
                                        the reasonable expectation of actual                    delivery for opt-out notices.                         would constitute a reasonable period of
                                        notice standard, which does not require                                                                       time before the expiration of the opt-out
                                                                                                Section 680 .27 Renewal of Opt-out
                                        the institution to determine if the                                                                           period to send an extension notice
                                        consumer actually received the opt-out                     Proposed § 680.26 described the                    because a reasonable period of time may
                                        notice. For example, mailing a printed                  procedures for extension of an opt-out.               depend upon the amount of time
                                        copy of the opt-out notice to the last                  Proposed § 680.26(a) provided that a                  afforded to the consumer for a
                                        known mailing address of a consumer                     receiving affiliate could not make or                 reasonable opportunity to opt out, the
                                        satisfies the requirement to deliver the                send solicitations to the consumer after              amount of time necessary to process
                                        opt-out notice so that there is a                       the expiration of the opt-out period                  opt-outs, and other factors. Proposed
                                        reasonable expectation that the                         based on eligibility information it                   § 680.26(e) made clear that sending an
                                        consumer has received actual notice.                    receives or has received from an                      extension notice to the consumer before
                                           The Commission has revised some of                   affiliate, unless the person responsible              the expiration of the opt-out period does
                                        the examples of a reasonable                            for providing the initial opt-out notice,             not shorten the five-year opt-out period.
                                        expectation of actual notice for                        or its successor, has given the consumer                 A few industry commenters objected
                                        electronic notices. The new example in                  an extension notice and a reasonable                  to the fact that the contents of the
                                        § 680.26(b)(3) illustrates that the                     opportunity to extend the opt-out, and                extension notice would differ from the
                                        reasonable expectation of actual notice                 the consumer does not extend the opt-                 contents of the initial notice by
                                        standard would be satisfied by                          out. Thus, if an extension notice was not             requiring that the extension notice
                                        providing notice by e-mail to a                         provided to the consumer, the opt-out                 inform the consumer that the
                                        consumer who has agreed to receive                      period would continue indefinitely.                   consumer’s prior opt-out has expired or
                                        disclosures by e-mail from the person                   Proposed § 680.26(b) provided that each               is about to expire, as applicable, and
                                        providing the notice. The Commission                    opt-out extension would have to be                    that the consumer must opt out again to
                                        reiterates that an acknowledgment of                    effective for a period of at least five               keep the opt-out election in force. These
                                        receipt is not necessary for a notice                   years.                                                commenters argued that the added
                                        provided by e-mail to such a consumer.                     Proposed § 680.26(c) addressed the                 disclosure requirement would be costly
                                        Conversely, the example in                              contents of a clear, conspicuous, and                 and provide little benefit to consumers.
                                        § 680.26(c)(2) illustrates that the                     concise extension notice and provided                 One commenter maintained that the
                                        reasonable expectation of actual notice                 flexibility to comply in either of two                added disclosure requirement would
                                        standard would not be satisfied by                      ways. Under one approach, the notice                  make it difficult, if not impossible, to
                                        providing notice by e-mail to a                         would disclose the same items required                combine the extension notice with the
                                        consumer who has not agreed to receive                  to be disclosed in the initial opt-out                GLBA privacy notice. Commenters also
                                        disclosures by e-mail from the person                   notice, along with a statement                        maintained that the language of the
                                        providing the notice.                                   explaining that the consumer’s prior                  statute, particularly section 624(a)(1),
                                           The revised example in § 680.26(b)(4)                opt-out has expired or is about to expire,            contemplates that the same notice
                                        illustrates that for a consumer who                     as applicable, and that if the consumer               would satisfy the requirements for the
                                        obtains a product or service                            wishes to keep the consumer’s opt-out                 initial and extension notices. Consumer
                                        electronically, the reasonable                          election in force, the consumer must opt              groups and NAAG recommended that
                                        expectation standard would be satisfied                 out again. Under a second approach, the               the Commission define a ‘‘reasonable
                                        by posting the notice on the Internet                   extension notice would provide: (1) that              opportunity’’ to extend the opt-out as a
                                        Web site at which the consumer obtains                  the consumer previously elected to limit              period of at least 45 days before shared
                                        such product or services and requiring                  an affiliate from using eligibility                   eligibility information is used to make
                                        the consumer to acknowledge receipt of                  information about the consumer that it                solicitations to the consumer.
                                        the notice. Conversely, the new example                 obtains from the communicating                           The Commission has renumbered the
                                        in § 680.26(c)(3) illustrates that the                  affiliate to make or send solicitations to            provisions addressing the extension or
                                        reasonable expectation standard would                   the consumer; (2) that the consumer’s                 renewal of opt-outs as § 680.27 in the
                                        not be satisfied by posting the notice on               election has expired or is about to                   final rule and revised them. For
                                        the Internet Web site without requiring                 expire, as applicable; (3) that the                   purposes of clarity, the final rule refers
                                        the consumer to acknowledge receipt of                  consumer may elect to extend the                      to a ‘‘renewal’’ notice, rather than an
                                        the notice. As discussed above, the                     consumer’s previous election; and (4) a               ‘‘extension’’ notice.
                                        Commission has determined that the                      reasonable and simple method for the                     Section 680.27(a) contains the general
                                        electronic delivery of opt-out notices                  consumer to opt out. The                              rule, which provides that after the opt-
                                        does not require consumer consent in                    supplementary information to the                      out period expires, a person may not
                                        accordance with the E-Sign Act because                  proposal clarified that institutions                  make solicitations based on eligibility
                                        neither section 624 of the FCRA nor the                 would not need to provide extension                   information received from an affiliate to
                                        final rule require that the notice be                   notices if they treated the consumer’s                a consumer who previously opted out
pwalker on PROD1PC71 with RULES2




                                        provided in writing. Thus, requiring an                 opt-out election as valid in perpetuity,              unless the consumer has been given a
                                        acknowledgment of receipt is within the                 unless revoked by the consumer.                       compliant renewal notice and a
                                        scope of the Commission’s interpretive                     Proposed § 680.26(d) addressed the                 reasonable opportunity to opt out, and
                                        authority. This example is also                         timing of the extension notice and                    the consumer does not renew the opt-
                                        consistent with an example in the GLBA                  provided that an extension notice could               out. This section also clarifies that a


                                   VerDate Aug<31>2005   20:51 Oct 29, 2007   Jkt 214001   PO 00000   Frm 00027   Fmt 4701   Sfmt 4700   E:\FR\FM\30OCR2.SGM   30OCR2
                                        61450            Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations

                                        person can make solicitations to a                         The Commission is not persuaded                    expiration of the opt-out period may
                                        consumer after expiration of the opt-out                that the additional content of the                    confuse consumers. The Commission
                                        period if one of the exceptions in                      renewal notice will have any impact on                will deem a renewal notice provided on
                                        § 680.21(c) applies.                                    the ability to combine the opt-out notice             or with the last annual privacy notice
                                           The Commission declines to set a                     with the GLBA privacy notice. Even if                 required by the GLBA privacy
                                        fixed minimum time period for a                         the language of the renewal notice were               provisions sent to the consumer before
                                        reasonable opportunity to renew the                     identical to the initial notice, it still             the expiration of the opt-out period to
                                        opt-out as unnecessary and inconsistent                 could be difficult to avoid honoring a                be reasonable in all cases.
                                        with the approach taken elsewhere in                    consumer’s opt-out in perpetuity if the                  Proposed § 680.26(e) regarding the
                                        this rule and in the GLBA privacy rule.                 affiliate marketing opt-out notice is                 effect of an extension or renewal notice
                                        The provision regarding the duration of                 incorporated into the GLBA privacy                    on the existing opt-out period elicited
                                        the renewed opt-out elicited no                         notice. Privacy notices typically state               no comment. The Commission has
                                        comment, and it has been retained in                    that if a consumer has previously opted               renumbered this provision as
                                        § 680.27(a)(2) of the final rule.                       out, it is not necessary for the consumer             § 680.27(d) in the final rule, and
                                           Section 680.27(a)(3) identifies the                  to opt out again. This statement would                adopted it with technical changes.
                                        affiliates who may provide the renewal                  be accurate with respect to the affiliate
                                        notice. A renewal notice must be                                                                              Section 680.28 Effective Date,
                                                                                                marketing opt-out only if the
                                        provided either by the affiliate that                                                                         Compliance Date, and Prospective
                                                                                                consumer’s opt-out is honored in
                                        provided the previous opt-out notice or                                                                       Application
                                                                                                perpetuity. It would not be accurate,
                                        its successor, or as part of a joint                    however, if the affiliate marketing opt-              Effective Date and Compliance Date
                                        renewal notice from two or more                         out is effective only for a limited period
                                        members of an affiliated group of                                                                                Consistent with the requirements of
                                                                                                of time, subject to renewal by the                    section 624 of the FCRA, the proposal
                                        companies, or their successors, that                    consumer at intervals of five years or
                                        jointly provided the previous opt-out                                                                         indicated that the final rule would
                                                                                                longer. Thus, if the affiliate marketing              become effective six months after the
                                        notice. This rule balances the                          opt-out notice was consolidated with
                                        Commission’s goal of ensuring that the                                                                        date on which it would be issued in
                                                                                                GLBA privacy notices and was effective                final form. The Commission requested
                                        notice is provided by an entity known                   for a limited period of time, the privacy
                                        to the consumer with a recognition that                                                                       comment on whether there was any
                                                                                                notices would have to be modified to                  need to delay the mandatory
                                        flexibility is required to account for                  make clear that statements that the
                                        changes in the corporate structure that                                                                       compliance date beyond the effective
                                                                                                consumer does not have to opt out again               date specifically to permit institutions
                                        may result from mergers and                             do not apply to the affiliate marketing
                                        acquisitions, corporate name changes,                                                                         to incorporate the affiliate marketing
                                                                                                renewal notice. Therefore, the                        opt-out notice into their next annual
                                        and other events.
                                                                                                Commission does not believe that                      GLBA privacy notice.
                                           The Commission recognizes that the
                                                                                                requiring a renewal notice to contain                    Most industry commenters believed
                                        content of the extension or renewal
                                        notice differs from the content of the                  information not included in an initial                that the Commission should delay the
                                        initial notice. Nothing in the statute,                 notice will significantly affect the ability          mandatory compliance date until some
                                        however, requires identical content in                  to incorporate the affiliate marketing                time after the effective date of the final
                                        the initial and renewal notices.                        opt-out notice into GLBA privacy                      rule. These commenters suggested
                                        Moreover, the statute requires the                      notices because consolidation of the                  various periods for delaying the
                                        Commission to provide specific                          notices is most likely to occur when the              mandatory compliance date ranging
                                        guidance to ensure that opt-out notices                 affiliate marketing opt-out will be                   from three months to more than 24
                                        are clear, conspicuous, and concise. It is              honored in perpetuity. Entities that                  months. Common recommendations
                                        unreasonable to expect consumers,                       prefer not to provide renewal notices                 were for a delayed mandatory
                                        upon receipt of a renewal notice, to                    may do so by honoring the consumer’s                  compliance date of six, 12, or 18
                                        remember that they previously opted                     opt-out in perpetuity. The contents of                months.
                                        out five years ago (or longer) or, even if              the renewal notice are adopted in                        Some of these commenters suggested
                                        they do remember, to know that they                     § 680.27(b) with revisions that                       a two-part mandatory compliance date
                                        must opt out again in order to renew                    incorporate the changes to § 680.23, as               consisting of a delayed mandatory
                                        their opt-out decision. Therefore, to                   discussed above. Section 680.27(b) of                 compliance date of either three or six
                                        ensure that the renewal notice is                       the final rule also omits the alternative             months for new accounts or for general
                                        meaningful, the Commission concludes                    contents set forth in the proposal, which             application and a special mandatory
                                        that the renewal notice must remind the                 the Commission now believes would be                  compliance date for institutions that
                                        consumer that he or she previously                      unnecessarily duplicative.                            intend to consolidate their affiliate
                                        opted out, inform the consumer that the                    Proposed § 680.26(d) addressed the                 marketing opt-out notice with their
                                        opt-out has expired or is about to expire,              timing of the extension or renewal                    GLBA privacy notice. Under this special
                                        and advise the consumer that he or she                  notice and elicited no comment. The                   mandatory compliance date, institutions
                                        must opt out again to renew the opt-out                 Commission has renumbered this                        would have to comply at the time they
                                        and continue to limit solicitations from                provision as § 680.27(c) in the final rule            provide their next GLBA privacy notice
                                        affiliates. Under the final rule, the                   and adopted it with technical revisions.              following the effective date of the final
                                        renewal notice can state that ‘‘the                     As explained in the supplementary                     rule or a date certain, whichever is
                                        consumer’s election has expired or is                   information to the proposal, providing                earlier.
                                        about to expire.’’ The Commission has                   the renewal notice a reasonable period                   Industry commenters believed that a
                                        deleted the words ‘‘as applicable’’ so                  of time before the expiration of the opt-             delayed mandatory compliance date
pwalker on PROD1PC71 with RULES2




                                        that the notice does not have to be                     out period would enable institutions to               was necessary in order to make
                                        tailored to differentiate consumers for                 begin marketing to consumers who do                   significant changes to business practices
                                        whom the election ‘‘has expired’’ from                  not renew their opt-out upon expiration               and procedures, to implement necessary
                                        those for whom the election ‘‘is about to               of the opt-out period. But giving a                   operational and systems changes, and to
                                        expire.’’                                               renewal notice too far in advance of the              design and provide opt-out notices.


                                   VerDate Aug<31>2005   20:51 Oct 29, 2007   Jkt 214001   PO 00000   Frm 00028   Fmt 4701   Sfmt 4700   E:\FR\FM\30OCR2.SGM   30OCR2
                                                         Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations                                                 61451

                                        Industry commenters also noted that                     language or reflect the intent of                     apply to the new or updated eligibility
                                        many institutions would like to send the                Congress. These commenters believed                   information.
                                        affiliate marketing opt-out notice with                 that the final rule should grandfather all
                                                                                                                                                      Appendix C
                                        their initial or annual GLBA privacy                    information received by any financial
                                        notices, both to minimize costs and to                  institution or affiliate in a holding                    Appendix A of the proposal contained
                                        avoid consumer confusion. These                         company prior to the mandatory                        model forms to illustrate by way of
                                        commenters noted that many large                        compliance date, and not grandfather                  example how institutions could comply
                                        institutions provide GLBA privacy                       only that information received prior to               with the notice and opt-out
                                        notices on a rolling basis and that a                   the mandatory compliance date by a                    requirements of section 624 and the
                                        delayed mandatory compliance date                       person that intends to use the                        proposed regulations. Appendix A
                                        was necessary to enable institutions to                 information to make solicitations to the              included three proposed model forms.
                                        introduce the affiliate marketing opt-out               consumer. Some of these commenters                    Model Form A-1 was a proposed form
                                        notice into this cycle. One large                       recommended, in the alternative, that                 of an initial opt-out notice. Model Form
                                        institution estimated that its first-year               the Commission clarify that any                       A-2 was a proposed form of an
                                        compliance costs would increase by a                    information placed into a common                      extension notice. Model Form A-3 was
                                        minimum of $660,000 if it was not able                  database by an affiliate should be                    a proposed form that institutions may
                                        to consolidate the affiliate marketing                  deemed to have been provided to an                    use if they offer consumers a broader
                                        opt-out notice with its GLBA privacy                    affiliated person if the Commission opts              right to opt out of marketing than is
                                        notice. A few industry commenters                       to retain the prospective application                 required by law.
                                        believed that Congress knew that an                     provision as proposed. These                             The proposed model forms were
                                        effective date is not necessarily the same              commenters argued that without such a                 designed to convey the necessary
                                        as a mandatory compliance date because                                                                        information to consumers as simply as
                                                                                                clarification, affiliated companies would
                                        banking regulations commonly have                                                                             possible. The Commission tested the
                                                                                                have to undertake the costly
                                        effective dates and mandatory                                                                                 proposed model forms using two widely
                                                                                                deconstruction of existing databases to
                                        compliance dates that differ.                                                                                 available readability tests, the Flesch
                                                                                                ensure compliance.
                                           Consumer groups and NAAG believed                                                                          reading ease test and the Flesch-Kincaid
                                                                                                   In the final rule, the provision                   grade level test, each of which generates
                                        that the effective date of the final rule
                                                                                                addressing prospective application has                a readability score.14 Proposed Model
                                        should be the mandatory compliance
                                                                                                been renumbered as § 680.28(c), and                   Form A-1 had a Flesch reading ease
                                        date. These commenters believed that
                                        institutions have had time to prepare for               revised. The Commission continues to                  score of 53.7 and a Flesch-Kincaid grade
                                        compliance since the FACT Act became                    believe that the better interpretation of             level score of 9.9. Proposed Model Form
                                        law in December 2003. Consumer                          the non-retroactivity provision is that it            A-2 had a Flesch reading ease score of
                                        groups believed that if institutions need               is tied to receipt of eligibility                     57.5 and a Flesch-Kincaid grade level
                                        more time to comply, affiliates should                  information by a person that intends to               score of 9.6. Proposed Model Form A-
                                        cease using eligibility information to                  use the information to make                           3 had a Flesch reading ease score of 69.9
                                        make solicitations until the notice and                 solicitations to the consumer. The final              and a Flesch-Kincaid grade level score
                                        opportunity to opt out is provided.                     rule clarifies, however, that a person is             of 6.7.
                                           The final rule will become effective                 deemed to receive eligibility                            Commenters generally supported the
                                        January 1, 2008. Consistent with the                    information from its affiliate when the               proposed model forms. As noted above,
                                        statute’s directive that the Commission                 affiliate places that information in a                some commenters had concerns about
                                        ensure that notices may be consolidated                 common database where it is accessible                the content of the initial and renewal
                                        and coordinated, the mandatory                          by the person, even if the person has not             notices. Some industry commenters
                                        compliance date is delayed to give                      accessed or used that information as of               expressed concern about requiring the
                                        institutions a reasonable amount of time                the compliance date. For example,                     notice to specify the applicable time
                                        to include the affiliate marketing opt-out              assume that an affiliate obtains                      period and the consumer’s right to
                                        notice with their initial and annual                    eligibility information about a consumer              renew the election once the opt-out
                                        privacy notices. Accordingly,                           as a result of having a pre-existing                  expires. Industry commenters also
                                        compliance with this part is required                   business relationship with that                       suggested revising the language of the
                                        not later than October 1, 2008. The                     consumer. The affiliate places that                   notice to refer either to ‘‘financial’’
                                        Commission believes that delaying the                   information into a common database                    information or ‘‘credit eligibility’’
                                        mandatory compliance date for                           that is accessible to other affiliates                information for clarity. One commenter
                                        approximately one year will give all                    before the mandatory compliance date.                 suggested deleting the examples of the
                                        institutions adequate time to develop                   The final rule does not apply to that                 types of information shared with
                                        and distribute opt-out notices and give                 information, and other affiliates may use             affiliates. Another commenter suggested
                                        most institutions sufficient time to                    that information for marketing to the                 rephrasing the model forms in the
                                        develop and distribute consolidated                     consumer. On the other hand, if the                   passive voice. One commenter
                                        notices if they choose to do so.                        affiliate obtains eligibility information             encouraged the Commission to clarify
                                                                                                about the consumer before the                         that use of the model forms provides a
                                        Prospective Application                                 mandatory compliance date, but does                   safe harbor. Another commenter
                                          Proposed § 680.20(e) provided that                    not either place that information into a              believed that the optional third
                                        the provisions of this part would not                   common database that is accessible to                 paragraph of Model Form A-1 should be
                                        apply to eligibility information that was               other affiliates or otherwise provide that            revised, or an alternate paragraph
                                        received by a receiving affiliate prior to              information to another affiliate before               added, to provide guidance on how to
                                        the date on which compliance with                       the mandatory compliance date, the
pwalker on PROD1PC71 with RULES2




                                        these regulations would be required.                    final rule will apply to that eligibility               14 The Flesch reading ease test generates a score

                                        Some industry commenters supported                      information. Further, if the database is              between zero and 100, where the higher score
                                                                                                                                                      correlates with improved readability. The Flesch-
                                        this provision. Other industry                          updated with new eligibility                          Kincaid grade level test generates a numerical
                                        commenters, however, believed that the                  information after the mandatory                       assessment of the grade-level at which the text is
                                        proposed rule did not track the statutory               compliance date, the final rule will                  written.



                                   VerDate Aug<31>2005   20:51 Oct 29, 2007   Jkt 214001   PO 00000   Frm 00029   Fmt 4701   Sfmt 4700   E:\FR\FM\30OCR2.SGM   30OCR2
                                        61452            Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations

                                        clearly disclose to consumers that the                  form, use of the model privacy form will                   as the requirements of the regulation are
                                        opt-out may not limit the sharing of                    satisfy the requirement to provide an                      met. For example, although several of
                                        contact information and other                           initial affiliate marketing opt-out notice.                the model forms use five years as the
                                        information that does not meet the                         The final rule includes five model                      duration of the opt-out period, an opt-
                                        definition of ‘‘consumer report.’’                      forms. Model Form C-1 is the model for                     out period of longer than five years may
                                           Consumer groups and NAAG                             an initial notice provided by a single                     be used and the longer time period
                                        commended the Commission for                            affiliate. Model Form C-2 is the model                     substituted in the opt-out notices.
                                        reporting the Flesch reading ease score                 for an initial notice provided as a joint                  Alternatively, the consumer’s opt-out
                                        and Flesch-Kincaid grade-level score for                notice from two or more affiliates.                        may be treated as effective in perpetuity
                                        each of the model forms. These                          Model Form C-3 is the model for a                          and, if so, the opt-out notice should
                                        commenters urged the Commission to                      renewal notice provided by a single                        omit any reference to the limited
                                        modify the proposed rule to require that                affiliate. Model Form C-4 is the model                     duration of the opt-out period or the
                                        any person that does not use the model                  for a renewal notice provided as a joint                   right to renew the opt-out.
                                        forms must provide a notice that                        notice from two or more affiliates.                           The Commission has revised the
                                        achieves readability scores at least as                 Model Form C-5 is a model for a                            model forms so that the disclosure
                                        good as the scores for the model forms.                 voluntary ‘‘no marketing’’ opt-out.                        regarding the duration of the opt-out
                                        Consumer groups also suggested adding                      The Commission tested each of the                       may state that the opt-out applies either
                                        a sentence about providing the form                     model forms using two widely-available                     for a fixed number of years or ‘‘at least
                                        annually to mitigate consumer                           readability tests, the Flesch reading ease                 5 years.’’ This revision permits
                                        confusion. These commenters also                        test and the Flesch-Kincaid grade level                    institutions that use a longer opt-out
                                        urged the Commission to adopt a short-                  test. In conducting these tests, the                       period or that subsequently extend their
                                        form notice.                                            Commission eliminated parenthetical                        opt-out period to rely on the model
                                           The Commission has revised and                       text wherever possible, included the                       language. The model form also contains
                                        expanded the number of model forms to                   optional clauses, and substituted the                      a reference to the consumer’s right to
                                        reflect changes made to the final rule. In              names of fictional entities, for example,                  revoke an opt-out. In addition, language
                                        addition, the model forms have been                     ABC Lender or the ABC group of                             has been added to the model forms to
                                        renumbered as Appendix C to Part 698.                   companies, as the names of the relevant                    clarify that, with an opt-out of limited
                                        The Commission believes that model                      entities to ensure that the test results                   duration, a consumer does not have to
                                        forms are helpful for entities that give                were not skewed by the inclusion of                        opt out again until a renewal notice is
                                        notices and beneficial for consumers.                   descriptive text that would not be                         sent.
                                        The model forms are provided as stand-                  included in actual opt-out notices. The
                                        alone documents. However, some                                                                                     V. Paperwork Reduction Act
                                                                                                results of these tests are summarized for
                                        persons may choose to combine the opt-                  each of the model forms in Table 1                            In accordance with the Paperwork
                                        out notice with other consumer                          below.                                                     Reduction Act (PRA), as amended, 44
                                        disclosures, such as the GLBA privacy                      Although the Commission encourages                      U.S.C. 3501-3521, the Commission staff
                                        notice. Creating a consolidated model                   the use of these tests as well as other                    has submitted the final rule and a PRA
                                        form is beyond the scope of this                        types of consumer testing in designing                     Supporting Statement to the Office of
                                        rulemaking, but, as discussed above,                    opt-out notices, the Commission                            Management and Budget (OMB) for
                                        institutions can combine the affiliate                  declines to adopt a prescriptive                           review. As required by the PRA, the
                                        marketing opt-out notice with other                     approach that requires notices to                          staff’s annual burden estimates take into
                                        disclosures, including the GLBA privacy                 achieve certain scores under the Flesch                    account the burden associated with the
                                        notice.                                                 reading ease or Flesch-Kincaid grade                       rule’s reporting, recordkeeping, and
                                           On March 31, 2006, the FTC, Board,                                                                              third-party disclosure requirements.15
                                                                                                level tests. Some variation in readability
                                        FDIC, NCUA, OCC, and SEC released a                                                                                   As set forth in the notice of proposed
                                                                                                scores is inevitable and may be caused
                                        report entitled Evolution of a Prototype                                                                           rulemaking (NPRM), the final rule
                                                                                                by minor differences in the language of
                                        Financial Privacy Notice, prepared by                                                                              likewise imposes disclosure
                                                                                                the notice, such as the name of the
                                        Kleimann Communication Group, Inc.,                                                                                requirements on certain affiliated
                                                                                                entity providing the notice or the types
                                        summarizing research that led to the                                                                               companies subject to the Commission’s
                                                                                                of information that may be used for
                                        development of a prototype short-form                                                                              jurisdiction. The final rule provides that
                                                                                                marketing.
                                        GLBA privacy notice. That prototype                                                                                if a company communicates certain
                                        included an affiliate marketing opt-out                                                                            information about a consumer
                                        notice. The prototype assumed that the                                          TABLE 1                            (‘‘eligibility information’’) to an affiliate,
                                        notice would be provided by the                                                                          Flesch-   the affiliate may not use that
                                        affiliate that is sharing eligibility                                                           Flesch             information to send solicitations to the
                                                                                                                                                 Kincaid
                                        information. The Commission believes                                                           reading
                                                                                                                                         ease     grade    consumer unless the consumer is given
                                        that providing model forms in this rule                                                                   level    notice and an opportunity and a simple
                                                                                                                                        score
                                        for stand-alone opt-out notices that may                                                                  score
                                                                                                                                                           method to opt out of such use of the
                                        be used in a more diverse set of                         Model   Form     C-1   ............     50.2      11.5    information and the consumer does not
                                        circumstances than a model privacy                       Model   Form     C-2   ............     51.7      11.5    opt out. The final rule also contains
                                        form is appropriate and consistent with                  Model   Form     C-3   ............     54.6       9.7    model disclosures that companies may
                                        efforts to develop a model privacy form.                 Model   Form     C-4   ............     54.2       9.8    use to comply with the final rule’s
                                        On March 29, 2007, the FTC, Board,                       Model   Form     C-5   ............     81.3       3.8    requirements.
                                        FDIC, NCUA, OCC, OTS, SEC, and the                                                                                    The staff’s estimates reflect the
                                        Commodity Futures Trading                                  As noted in the proposal, use of the                    average amount of burden incurred by
pwalker on PROD1PC71 with RULES2




                                        Commission published for public                         model forms is not mandatory.                              entities subject to the final rule, taking
                                        comment in the Federal Register (72 FR                  However, appropriate use of the model                      into account that some entities may not
                                        14940) a model privacy form that                        forms provides a safe harbor. There is                     share eligibility information with
                                        includes the affiliate marketing opt-out.               flexibility to use or not use the model
                                        Once such a notice is published in final                forms, or to modify the forms, so long                      15   44 U.S.C. 3502(2); 5 CFR 1320.3(b)



                                   VerDate Aug<31>2005   20:51 Oct 29, 2007   Jkt 214001   PO 00000   Frm 00030   Fmt 4701       Sfmt 4700   E:\FR\FM\30OCR2.SGM    30OCR2
                                                          Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations                                                 61453

                                        affiliates for the purpose of making                    cumulatively.17 In preparation for this                 entities will give notice only once
                                        solicitations and other entities may                    publication, staff has revisited those                  during a three-year clearance period.
                                        choose to rely on the exceptions to the                 estimates, refining its analysis. There                 Thus, averaged annually over that span,
                                        final rule’s notice and opt-out                         are no program changes from the NPRM                    estimated burden for non-GLBA entities
                                        requirements. In either of these cases,                 that impact staff’s prior PRA analysis.                 is 1,089,000 hours and $30,749,000 in
                                        the notice would not be required, and                   Rather, staff has adjusted its previously               labor costs, rounded.21
                                        the resulting burden would be zero.                     stated estimate of burden hours and the                    As stated in the NPRM, the number of
                                        Moreover, the burden estimates take                     number of non-GLBA entities that may                    GLBA entities under the Commission’s
                                        into account that a number of non-                      send the proposed affiliate marketing                   jurisdiction is 3,350.22 As before, staff
                                        GLBA companies currently provide                        notice based on: (1) a refined numerical                estimates that GLBA entities would
                                        notices and opt-out choices voluntarily                 estimate of non-GLBA entities with                      incur 6 hours of paperwork burden
                                        as a service to their customers. Since                  affiliates under the Commission’s                       during the first year of the clearance
                                        these entities already have systems and                 jurisdiction and thus subject to the final              period,23 given that the final rule
                                        processes in place for providing the                    rule; and (2) recognition that an entity                provides model notices. This would
                                        notice and implementing the opt-out,                    need only give a notice once during the                 thus approximate 20,000 hours,
                                        the resulting PRA burden under the                      three-year clearance period. Thus, staff                cumulatively, during the first year of a
                                        final rule for such entities would be de                now estimates the total average annual                  three-year OMB clearance period. Labor
                                        minimis.                                                burden hours and labor costs over the                   costs, as adjusted, would approximate
                                           The staff’s estimates assume a higher                three-year clearance period to be                       $716,000.24 Allowing for increased
                                        burden will be incurred during the first                1,105,000 and $31,302,000, respectively,                familiarity with procedure, the
                                        year of the OMB clearance period with                   as further explained below.                             paperwork burden in ensuing years
                                        a lesser burden incurred during the                        The staff estimates that approximately               would decline, with GLBA entities each
                                        subsequent two years, since the notice                  1.17 million (rounded) non-GLBA                         incurring 4 hours of annual burden25
                                        is only required to be given once for a                 entities under the jurisdiction of the                  during the remaining two years of the
                                        minimum period of at least five (5)                     Commission have affiliates and would                    clearance period. At an estimated 3,350
                                        years. The staff did not estimate the                   be affected by the final rule.18 As in the              GLBA entities under the Commission’s
                                        burden for preparing and distributing                   NPRM, staff further estimates that there                jurisdiction, this amounts to 13,400
                                        extension notices by persons that limit                 are an average of 5 businesses per family               hours and $472,000 in labor costs26 in
                                        the duration of the opt-out time period                 or affiliated relationship, and that the                each of the ensuing two years. Thus,
                                        because the minimum effective time                      affiliated entities will choose to send a               averaged over the three-year clearance
                                        period for the opt-out is five years while              joint notice, as permitted by the final                 period, the estimated annual burden for
                                        the relevant PRA clearance period is no                 rule. Thus an estimated 233,400                         GLBA entities is 15,600 hours and
                                        more than three years. Moreover,                        (rounded) non-GLBA entities may send                    $533,000 in labor costs.
                                        entities providing the notice and opt-out               the new affiliate marketing notice. The                    Combining estimates for GLBA and
                                        may elect to have a longer opt-out                      staff estimates that the cumulative                     non-GLBA entities, total average annual
                                        period, for example, ten years, or to                   burden per non-GLBA entity will total                   burden over a prospective three-year
                                        make the opt-out election effective in                  14 hours19 over a three-year PRA                        clearance period, is approximately
                                        perpetuity.                                             clearance cycle, not per year, as                       1,105,000 hours and $31,302,000 in
                                           The staff’s labor cost estimates take                previously set forth in the NPRM. Based                 labor costs, rounded. As noted in the
                                        into account: managerial and                            on updated population data, the                         NPRM, GLBA entities are already
                                        professional time for reviewing internal                Commission staff estimates that the total               providing notices to their customers so
                                        policies and determining compliance                     burden for non-GLBA entities during                     there are no new capital or other non-
                                        obligations; technical time for creating                the prospective three-year clearance                    labor costs, as this notice may be
                                        the notice and opt-out, in either paper                 period would be approximately                           consolidated into their current notices.
                                        or electronic form; incremental training;               3,268,000 hours and associated labor                    For non-GLBA entities, the final rule
                                        and clerical time for disseminating the                 costs would be approximately                            provides for simple and concise model
                                        notice and opt-out.16 In addition, the                  $92,247,000.20 However, non-GLBA                        forms that institutions may use to
                                        staff’s cost estimates presume that the
                                        availability of model disclosures and                     17  69 FR at 33335.                                   based on the BLS Employment Cost Index. The
                                                                                                                                                        dollar total above is derived from the estimated 7
                                        opt-out notices will simplify the                         18  This estimate is derived from an analysis of a
                                                                                                                                                        hours of managerial labor at $34.21 per hour; 2
                                        compliance review and implementation                    database of U.S. businesses based on SIC codes for
                                                                                                                                                        hours of technical labor at $29.80 per hour; and 5
                                                                                                businesses that market goods or services to
                                        processes, thereby significantly                        consumers, which included the following
                                                                                                                                                        hours of clerical labor at $14.44 per hour—a
                                        reducing the cost of compliance.                                                                                combined $371.27—multiplied by 1.06426 (a
                                                                                                industries: transportation services; communication;
                                                                                                                                                        combined $395.13)—for the estimated 233,400+
                                        Further, the final rule gives entities                  electric, gas, and sanitary services; retail trade;
                                                                                                                                                        non-GLBA business families subject to the Rule.
                                        flexibility to provide a single joint                   finance, insurance, and real estate; and services         21 3,268,000 hours ÷ 3 = 1,089,000; $92,247,000
                                                                                                (excluding business services and engineering,
                                        notice on behalf of some or all of its                  management services). This estimate excludes            ÷ 3 = $30,749,000.
                                        affiliates, which should further reduce                 businesses not subject to the Commission’s
                                                                                                                                                          22See 69 FR at 33334.
                                                                                                                                                          23 This estimate is based on 5 hours of managerial
                                        the cost of compliance.                                 jurisdiction as well as businesses that do not use
                                                                                                data or information subject to the rule.                time and 1 hour of technical time to execute the
                                           The Commission staff previously                                                                              notice. As in the NPRM, staff excludes clerical time
                                                                                                   19 This estimate, as in the NPRM, is based on a
                                        estimated in the NPRM that the total                    projected apportionment of 7 hours managerial           from the estimate because the notice likely would
                                        paperwork burden for the proposed rule                  time, 2 hours technical time, and 5 hours of clerical   be combined with existing GLBA notices.
                                        over a standard three-year OMB grant of                 assistance.                                               24 3,350 GLBA entities x ($34.21 x 5 hours) +

                                        clearance would be 2,715,000 hours and                     20 The hourly rates are based on average annual      ($29.80 x 1 hour)] x 1.06426 wage inflation
                                                                                                Bureau of Labor Statistics National Compensation        multiplier. See note 20.
                                        $63,144,000 in labor costs for both
pwalker on PROD1PC71 with RULES2




                                                                                                                                                          25 This estimate, carried over from the NPRM, is
                                                                                                Survey data, June 2005 (with 2005 as the most
                                        GLBA and non-GLBA entities,                             recent whole year information available at the BLS      based on 3 hours of managerial time and 1 hour of
                                                                                                Web site). http://www.bls.gov/ncs/ocs/sp/               technical time.
                                           16 No clerical time was included in staff’s burden   ncbl0832.pdf (Table 1.1), and further adjusted by a       26 3,350 GLBA entities x [($34.21 x 3 hours) +

                                        analysis for GLBA entities as the notice would          multiplier of 1.06426, a compounding for                ($29.80 x 1 hour)] x 1.06426 wage inflation
                                        likely be combined with existing GLBA notices.          approximate wage inflation for 2005 and 2006,           multiplier. See note 20.



                                   VerDate Aug<31>2005   20:51 Oct 29, 2007   Jkt 214001   PO 00000    Frm 00031   Fmt 4701   Sfmt 4700   E:\FR\FM\30OCR2.SGM   30OCR2
                                        61454            Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations

                                        comply. Thus, any capital or non-labor                  business entities, legal and managerial               GLBA and FCRA notice and opt-out
                                        costs associated with compliance for                    review, employee training, and business               requirements, to meet the requirements
                                        these entities are negligible.                          process changes. As an example, the                   of this final rule. The Commission also
                                           The Commission staff recognized that                 MBA stated that one of its members, a                 believes that use of an average amount
                                        the amount of time needed for any                       medium-sized mortgage banker,                         of time is appropriate because some
                                        particular entity subject to the proposed               estimated that it would cost at least $5              persons may not share eligibility
                                        requirements may be higher or lower,                    million in direct costs to modify its data            information with affiliates for the
                                        but believes that the above stated                      warehouse computer system to                          purpose of making solicitations or may
                                        averages are reasonable estimates. In                   accommodate the opt-outs and to send                  choose to rely on the exceptions to the
                                        arriving at these estimates, staff                      disclosures to all of its customers, plus             notice and opt-out requirement. In
                                        determined that many entities do not                    hundreds of thousands of dollars for                  either of these cases, the notice would
                                        have affiliates and are not covered by                  indirect costs. The MBA stated that the               not be required, and the resulting
                                        section 214 of the FACT Act or the rule.                NPRM did not consider the significant                 burden would be zero.
                                        Entities that have affiliates may choose                clerical effort needed to comply with                    The Commission also believes that the
                                        not to engage in the sharing of certain                 the then-proposed rule. The MBA also                  availability of model disclosures and
                                        information or marketing to consumers                   stated that companies that currently                  opt-out notices may significantly reduce
                                        covered by section 214 of the FACT Act                  provide GLBA privacy and FCRA                         the cost of compliance. In addition, as
                                        or the rule. Moreover, to minimize the                  affiliate sharing opt-out notices would               stated earlier the final rule gives persons
                                        compliance costs and burdens for                        still incur significant costs because: (1)            considerable flexibility to provide a
                                        entities, particularly small businesses,                in contrast to the GLBA, the new opt-out              joint opt-out notice on behalf of
                                        the final rule contains model                           right applies to the sharing of                       multiple affiliates and to define the
                                        disclosures and opt-out notices that may                information with affiliates; and (2) in               scope and the duration of the opt-out.
                                        be used to satisfy the statutory                        contrast to the FCRA, the new opt-out                 This flexibility may reduce the cost of
                                        requirements. Finally, the final rule                   right applies to transaction and                      compliance by allowing covered
                                        gives covered entities flexibility to                   experience information. Finally, the                  persons to make choices that are most
                                        satisfy the notice and opt-out                          MBA stated that compliance with the                   appropriate for their business.
                                        requirement by sending the consumer a                   then-proposed rule would be                           Moreover, because the notice is only
                                        free-standing opt-out notice or by                      particularly difficult because software               required to be given once for a
                                        adding the opt-out notice to the privacy                modifications and employee training                   minimum period of at least five years,
                                        notices already provided to consumers,                  will be required to ensure that both                  the Commission’s estimates assume a
                                        such as those provided in accordance                    bank and mortgage company employees                   higher burden will be incurred during
                                        with the provisions of Title V of the                   have access to consumers’ transaction                 the first year of the OMB clearance
                                        GLBA. For covered persons that choose                   and experience information in order to                period with a lesser burden incurred
                                        to prepare a free-standing opt-out                      service their accounts, but they are                  during the subsequent two years.
                                        notice, the time necessary to prepare it                prevented from using such information                 VI. Final Regulatory Flexibility
                                        would be minimal because those                          to solicit business from consumers who                Analysis
                                        persons could simply copy the model                     have exercised their opt-out rights.                     The Regulatory Flexibility Act
                                        disclosure, making minor adjustments                       The Commission staff continues to                  (‘‘RFA’’), 5 U.S.C. 601-612, requires that
                                        as indicated by it. Similarly, for covered              believe that its estimate of the average              the Commission provide an Initial
                                        persons that choose to incorporate the                  amount of time to prepare and distribute              Regulatory Flexibility Analysis
                                        opt-out notice into their GLBA privacy                  an initial notice to consumers is                     (‘‘IRFA’’) with a proposed rule and a
                                        notices, the time necessary to integrate                reasonable. As a preliminary matter, the              Final Regulatory Flexibility Analysis
                                        them would be minimal.                                  Commission staff notes that the PRA                   (‘‘FRFA’’), with the final rule, unless the
                                           In response to the PRA section of the                does not require an estimate all of the               Commission certifies that the rule will
                                        NPRM, the Commission received one                       costs that may be associated with                     not have a significant economic impact
                                        comment, from the Mortgage Bankers                      implementing the opt-out, but only the                on a substantial number of small
                                        Association (‘‘MBA’’). The MBA                          information collection costs. The annual              business entities. See 5 U.S.C. 603-605.
                                        expressed concern that the NPRM’s                       burden estimates take into account the                For the majority of entities subject to the
                                        burden estimates convey a misleading                    requisite burden associated with the                  final rule, a small business entity is
                                        impression of the cost of compliance                    reporting, recordkeeping, and third-                  defined by the Small Business
                                        with the final rule.27 The MBA’s                        party disclosure requirements,                        Administration as one whose average
                                        principal objection was that the cost                   including any incremental training costs              annual receipts do not exceed $6
                                        estimates assume that the major cost is                 that may be associated with                           million or that has fewer than 500
                                        sending the disclosures, rather than                    implementing the final rule’s                         employees. See http://www.sba.gov/
                                        processing any opt-out requests and                     requirements. Further, the                            size/indextableofsize.html.
                                        ensuring that solicitations are not sent                Commission’s staff estimates are over-
                                        to consumers who have opted out or                      inclusive with respect to the number of               1. Statement of the need for, and
                                        have not yet had a reasonable                           entities that must comply with the rule.              objectives of, the final rule.
                                        opportunity to do so. The MBA added                     As stated earlier, many entities                         The FACT Act amends the FCRA and
                                        that the NPRM’s cost estimates did not                  voluntarily provide consumers with the                was enacted, in part, for the purpose of
                                        reflect the costs associated with                       right to opt out of advertising by                    allowing consumers to limit the use of
                                        building compliance systems, such as                    affiliates, and thus will not be subject to           eligibility information received from an
                                        costs attributed to significant database                the final rule’s requirements and                     affiliate to make solicitations to the
pwalker on PROD1PC71 with RULES2




                                        programming, coordination across                        attendant costs. The Commission                       consumer. Section 214 of the FACT Act
                                          27 The MBA’s comment is available at http://
                                                                                                continues to believe that institutions                generally prohibits a person from using
                                        www.ftc.gov/os/comments/affiliate_marketing/04-
                                                                                                should be able to modify existing                     certain information received from an
                                        13481-0033.pdf. No other comments relating to           database systems and employee training                affiliate to make a solicitation for
                                        paperwork burden were received.                         programs, used to comply with the                     marketing purposes to a consumer,


                                   VerDate Aug<31>2005   20:51 Oct 29, 2007   Jkt 214001   PO 00000   Frm 00032   Fmt 4701   Sfmt 4700   E:\FR\FM\30OCR2.SGM   30OCR2
                                                         Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations                                           61455

                                        unless the consumer is given notice and                 See http://www.sba.gov/size/                          with to provide the notice. The
                                        an opportunity and simple method to                     indextableofsize.html.                                Commission chose the alternative that
                                        opt out of the making of such                              Although all small entities covered by             requires the affiliate with the
                                        solicitations. Section 214 requires the                 the Commission’s rule potentially could               relationship with the consumer to
                                        Commission, together with the other                     be subject to the final rule, small entities          provide the notice. See section IV,
                                        agencies, to issue regulations                          that do not have affiliates would not be              supra. This alternative is not expected
                                        implementing the section in                             subject to the final rule. In addition,               to have a significant impact on small
                                        consultation and coordination with each                 small entities that have affiliates may               businesses since, as stated earlier, many
                                        other. The Commission received no                       choose not to engage in activities that               small businesses are not likely to be
                                        comments on the reasons for the                         would require compliance with the final               subject to the rule or they may opt not
                                        proposed rule. The Commission is                        rule. For example, small entities may                 to engage in practices that would subject
                                        adopting the final rule to implement                    choose not to share eligibility                       them to the rule’s requirements.
                                        § 214 of the FACT Act. The                              information with their affiliates for the
                                                                                                purpose of making solicitations.                      List of Subjects
                                        SUPPLEMENTARY INFORMATION above
                                        contains information on the objectives                  Alternatively, small entities and their               16 CFR Part 680
                                        of the final rule.                                      affiliates may structure their marketing
                                                                                                                                                        Consumer reports, Consumer
                                                                                                activities in a way that does not trigger
                                        2. Summary of issues raised by                                                                                reporting agencies, Credit, Fair Credit
                                                                                                the requirement to comply with the
                                        comments in response to the initial                                                                           Reporting Act, Trade practices.
                                                                                                final rule, such as by relying upon the
                                        regulatory flexibility analysis.                        exceptions to the notice requirement                  16 CFR Part 698
                                          In accordance with Section 3(a) of the                contained in the final rule.                            Consumer reports, Consumer
                                        RFA, the Commission conducted an                        4. Recordkeeping, reporting, and other                reporting agencies, Credit, Fair Credit
                                        initial regulatory flexibility analysis in              compliance requirements.                              Reporting Act, Trade practices.
                                        connection with the proposed rule. One                                                                        I The Federal Trade Commission
                                                                                                   The final rule requires small entities
                                        commenter, the Mortgage Bankers                                                                               amends chapter I, title 16, Code of
                                                                                                to provide opt-out notices and renewal
                                        Association (MBA), believed that the                                                                          Federal Regulations, as follows:
                                                                                                notices to consumers in certain
                                        Commission and the other agencies had                                                                         I 1. Add new part 680 as follows:
                                                                                                circumstances, as discussed in the
                                        underestimated the costs of compliance.
                                                                                                SUPPLEMENTARY INFORMATION above. The                  PART 680—AFFILIATE MARKETING
                                        The issues raised by the MBA are
                                                                                                final rule also requires small entities to
                                        described in the Paperwork Reduction                                                                          Sec.
                                                                                                implement consumers’ opt-out
                                        Act section above. The MBA’s concerns                                                                         680.1 Purpose and scope.
                                                                                                elections. The final rule contains no
                                        applied equally to small entities and                                                                         680.2 Examples.
                                                                                                requirement to report information to the
                                        larger entities. The MBA did not raise                                                                        680.3 Definitions.
                                                                                                Commission.                                           680.4–680.20 [Reserved]
                                        any issues unique to small entities.                       Small entities that have affiliates and            680.21 Affiliate marketing opt-out and
                                        3. Description and estimate of small                    that share eligibility information with                    exceptions.
                                        entities affected by the final rule.                    those affiliates for purposes of making               680.22 Scope and duration of opt-out.
                                                                                                solicitations may be subject to the rule.             680.23 Contents of opt-out notice;
                                           The affiliate marketing rule, which                  Small entities that do not have affiliates,                consolidated and equivalent notices.
                                        closely tracks the language of section                  do not share eligibility information with             680.24 Reasonable opportunity to opt out.
                                        214 of the FACT ACT, would apply to                     their affiliates for marketing purposes,              680.25 Reasonable and simple methods of
                                        ‘‘[a]ny person that receives from another               use shared eligibility information for                     opting out.
                                        person related to it by common                                                                                680.26 Delivery of opt-out notices
                                                                                                purposes of making solicitations only in              680.27 Renewal of opt-out.
                                        ownership or affiliated by corporate                    accordance with one of the exceptions                 680.28 Effective date, compliance date, and
                                        control a communication of information                  set forth in the final rule, or structure                  prospective application.
                                        that would be a consumer report, but for                their marketing activities to eliminate
                                        clauses (i), (ii), and (iii) of section                                                                         Authority: Sec. 214(b), Pub. L. 108-159; 15
                                                                                                the need to provide an opt-out notice                 U.S.C. 1681s-3
                                        603(d)(2)(A).’’ In short, section 214                   would not be subject to the final rule.
                                        applies to any entity that (1) is under                 The professional skills necessary for                 § 680.1    Purpose and scope.
                                        the Commission’s jurisdiction pursuant                  preparation of the opt-out notice                        (a) Purpose. The purpose of this part
                                        to the FCRA and (2) receives consumer                   include compliance and/or privacy                     is to implement section 214 of the Fair
                                        report information from an affiliate and                specialists and computer programmers.                 and Accu-rate Credit Transactions Act
                                        uses that information to make a                                                                               of 2003, which (by adding section 624
                                        marketing solicitation to the consumer.                 5. Steps taken to minimize the economic
                                                                                                impact on small entities.                             to Fair Credit Reporting Act) regulates
                                        The entities covered by the                                                                                   the use, for marketing solicitation
                                        Commission’s rule would include non-                       The Commission has attempted to                    purposes, of consumer information
                                        bank lenders, insurers, retailers,                      minimize the economic impact on small                 provided by persons affiliated with the
                                        landlords, mortgage brokers, automobile                 entities by adopting a rule that is                   person making the solicitation.
                                        dealers, telecommunication firms, and                   consistent with the other federal                        (b) Scope. This part applies to any
                                        any other business that shares eligibility              agencies and choosing alternatives that               person over which the Federal Trade
                                        information with its affiliates. It is not              provide for joint notices and model                   Commission has jurisdiction that uses
                                        readily feasible to determine a precise                 forms small institutions may, but are not             information from its affiliates for the
                                        number of small entities that will be                   required to, use to minimize the cost of              purpose of marketing solicitations, or
                                        subject to the rule, but it is not likely               compliance.                                           provides information to its affiliates for
pwalker on PROD1PC71 with RULES2




                                        that many of the entities covered by this                  Some commenters suggested an                       that purpose.
                                        new rule are small as defined by the                    alternative that would allow any
                                        Small Business Administration since                     affiliate to provide the opt-out notice to            § 680.2    Examples.
                                        most of the entities with affiliates are                consumers instead of requiring the                      The examples in this part are not
                                        likely to be above the $6 million level.                affiliate the consumer has a relationship             exclusive. Compliance with an example,


                                   VerDate Aug<31>2005   20:51 Oct 29, 2007   Jkt 214001   PO 00000   Frm 00033   Fmt 4701   Sfmt 4700   E:\FR\FM\30OCR2.SGM    30OCR2
                                        61456            Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations

                                        to the extent applicable, constitutes                   which would be a consumer report if                   existing business relationship with the
                                        compliance with this part. Examples in                  the exclusions from the definition of                 consumer and can use eligibility
                                        a paragraph illustrate only the issue                   ‘‘consumer report’’ in section                        information it receives from its affiliates
                                        described in the paragraph and do not                   603(d)(2)(A) of the Act did not apply.                to make solicitations to the consumer
                                        illustrate any other issue that may arise               Eligibility information does not include              about its products or services for 18
                                        in this part.                                           aggregate or blind data that does not                 months after the date it sells the loan,
                                                                                                contain personal identifiers such as                  and the investor has a pre-existing
                                        § 680.3   Definitions.                                  account numbers, names, or addresses.                 business relationship with the consumer
                                           As used in this part:                                   (i) Person. The term ‘‘person’’ means              upon purchasing the loan. If, however,
                                           (a) Act. The term ‘‘Act’’ means the                  any individual, partnership,                          the mortgage lender sells a fractional
                                        Fair Credit Reporting Act (15 U.S.C.                    corporation, trust, estate, cooperative,              interest in the consumer’s loan to an
                                        1681 et seq.).                                          association, government or                            investor but also retains an ownership
                                           (b) Affiliate. The term ‘‘affiliate’’                governmental subdivision or agency, or                interest in the loan, the mortgage lender
                                        means any company that is related by                    other entity.                                         continues to have a pre-existing
                                        common ownership or common                                 (j) Pre-existing business relationship—            business relationship with the
                                        corporate control with another                          (1) In general. The term ‘‘pre-existing               consumer, but the investor does not
                                        company.                                                business relationship’’ means a                       have a pre-existing business
                                           (c) Clear and conspicuous. The term                  relationship between a person, or a                   relationship with the consumer. If the
                                        ‘‘clear and conspicuous’’ means                         person’s licensed agent, and a consumer               mortgage lender retains ownership of
                                        reasonably under-standable and                          based on—                                             the loan, but sells ownership of the
                                        designed to call attention to the nature                   (i) A financial contract between the               servicing rights to the consumer’s loan,
                                        and significance of the information                     person and the consumer which is in                   the mortgage lender continues to have a
                                        presented.                                              force on the date on which the                        pre-existing business relationship with
                                           (d) Common ownership or common                       consumer is sent a solicitation covered               the consumer. The purchaser of the
                                        corporate control. The term ‘‘common                    by this part;                                         servicing rights also has a pre-existing
                                        ownership or common corporate                              (ii) The purchase, rental, or lease by
                                                                                                                                                      business relationship with the consumer
                                        control’’ means a relationship between                  the consumer of the persons’ goods or
                                                                                                                                                      as of the date it purchases ownership of
                                        two companies under which:                              services, or a financial transaction
                                                                                                                                                      the servicing rights, but only if it
                                           (1) One company has, with respect to                 (including holding an active account or
                                                                                                                                                      collects payments from or otherwise
                                        the other company:                                      a policy in force or having another
                                                                                                                                                      deals directly with the consumer on a
                                           (i) Ownership, control, or the power                 continuing relationship) between the
                                                                                                                                                      continuing basis.
                                        to vote 25 percent or more of the                       consumer and the person, during the 18-
                                                                                                                                                         (iv) If a consumer applies to a creditor
                                        outstanding shares of any class of voting               month period immediately preceding
                                                                                                                                                      for a product or service that it offers, but
                                        security of a company, directly or                      the date on which the consumer is sent
                                                                                                                                                      does not obtain a product or service
                                        indirectly, or acting through one or                    a solicitation covered by this part; or
                                                                                                   (iii) An inquiry or application by the             from or enter into a financial contract or
                                        more other persons;
                                           (ii) Control in any manner over the                  consumer regarding a product or service               transaction with the creditor, the
                                        election of a majority of the directors,                offered by that person during the three-              creditor has a pre-existing business
                                        trustees, or general partners (or                       month period immediately preceding                    relationship with the consumer and can
                                        individuals exercising similar functions)               the date on which the consumer is sent                therefore use eligibility information it
                                        of a company; or                                        a solicitation covered by this part.                  receives from an affiliate to make
                                           (iii) The power to exercise, directly or                (2) Examples of pre-existing business              solicitations to the consumer about its
                                        indirectly, a controlling influence over                relationships. (i) If a consumer has an               products or services for three months
                                        the management or policies of a                         existing loan account with a creditor,                after the date of the application.
                                        company, as the Commission                              the creditor has a pre-existing business                 (v) If a consumer makes a telephone
                                        determines; or                                          relationship with the consumer and can                inquiry to a creditor about its products
                                           (2) Any person has, with respect to                  use eligibility information it receives               or services and provides contact
                                        both companies, a relationship                          from its affiliates to make solicitations             information to the creditor, but does not
                                        described in paragraphs (d)(1)(i) through               to the consumer about its products or                 obtain a product or service from or enter
                                        (d)(1)(iii) of this section.                            services.                                             into a financial contract or transaction
                                           (e) Company. The term ‘‘company’’                       (ii) If a consumer obtained a mortgage             with the creditor, the creditor has a pre-
                                        means any corporation, limited liability                from a mortgage lender, but refinanced                existing business relationship with the
                                        company, business trust, general or                     the mortgage loan with a different                    consumer and can therefore use
                                        limited partnership, association, or                    lender when the mortgage loan came                    eligibility information it receives from
                                        similar organization.                                   due, the first mortgage lender has a pre-             an affiliate to make solicitations to the
                                           (f) Concise—(1) In general. The term                 existing business relationship with the               consumer about its products or services
                                        ‘‘concise’’ means a reasonably brief                    consumer and can use eligibility                      for three months after the date of the
                                        expression or statement.                                information it receives from its affiliates           inquiry.
                                           (2) Combination with other required                  to make solicitations to the consumer                    (vi) If a consumer makes an inquiry to
                                        disclosures. A notice required by this                  about its products or services for 18                 a creditor by e-mail about its products
                                        part may be concise even if it is                       months after the date the outstanding                 or services, but does not obtain a
                                        combined with other disclosures                         balance of the loan is paid and the loan              product or service from or enter into a
                                        required or authorized by federal or                    is closed.                                            financial contract or transaction with
                                        state law.                                                 (iii) If a consumer obtains a mortgage,            the creditor, the creditor has a pre-
pwalker on PROD1PC71 with RULES2




                                           (g) Consumer. The term ‘‘consumer’’                  the mortgage lender has a pre-existing                existing business relationship with the
                                        means an individual.                                    business relationship with the                        consumer and can therefore use
                                           (h) Eligibility information. The term                consumer. If the mortgage lender sells                eligibility information it receives from
                                        ‘‘eligibility information’’ means any                   the consumer’s entire loan to an                      an affiliate to make solicitations to the
                                        information the communication of                        investor, the mortgage lender has a pre-              consumer about its products or services


                                   VerDate Aug<31>2005   20:51 Oct 29, 2007   Jkt 214001   PO 00000   Frm 00034   Fmt 4701   Sfmt 4700   E:\FR\FM\30OCR2.SGM   30OCR2
                                                         Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations                                          61457

                                        for three months after the date of the                     (i) Based on eligibility information               information received from its insurance
                                        inquiry.                                                communicated to that person by its                    affiliate to make solicitations to the
                                           (vii) If a consumer has an existing                  affiliate as described in this part; and              consumer about its home equity loan
                                        relationship with a creditor that is part                  (ii) Intended to encourage the                     products unless the consumer is given
                                        of a group of affiliated companies,                     consumer to purchase or obtain such                   a notice and opportunity to opt out and
                                        makes a telephone call to the                           product or service.                                   the consumer does not opt out.
                                        centralized call center for the group of                   (2) Exclusion of marketing directed at                (3) Affiliates who may provide the
                                        affiliated companies to inquire about                   the general public. A solicitation does               notice. The notice required by this
                                        products or services offered by the                     not include marketing communications                  paragraph (a) must be provided:
                                        insurance affiliate, and provides contact               that are directed at the general public.                 (i) By an affiliate that has or has
                                        information to the call center, the call                For example, television, general                      previously had a pre-existing business
                                        constitutes an inquiry to the insurance                 circulation magazine, and billboard                   relationship with the consumer; or
                                        affiliate that offers those products or                 advertisements do not constitute                         (ii) As part of a joint notice from two
                                        services. The insurance affiliate has a                 solicitations, even if those                          or more members of an affiliated group
                                        pre-existing business relationship with                 communications are intended to                        of companies, provided that at least one
                                        the consumer and can therefore use                      encourage consumers to purchase                       of the affiliates on the joint notice has
                                        eligibility information it receives from                products and services from the person                 or has previously had a pre-existing
                                        its affiliated creditor to make                         initiating the communications.                        business relationship with the
                                        solicitations to the consumer about its                    (3) Examples of solicitations. A                   consumer.
                                        products or services for three months                   solicitation would include, for example,                 (b) Making solicitations—(1) In
                                        after the date of the inquiry.                          a telemarketing call, direct mail, e-mail,            general. For purposes of this part, you
                                           (3) Examples where no pre-existing                   or other form of marketing                            make a solicitation for marketing
                                        business relationship is created. (i) If a              communication directed to a particular                purposes if—
                                        consumer makes a telephone call to a                    consumer that is based on eligibility                    (i) You receive eligibility information
                                        centralized call center for a group of                  information received from an affiliate.               from an affiliate;
                                        affiliated companies to inquire about the                  (l) You means a person described in                   (ii) You use that eligibility
                                        consumer’s existing account with a                      § 680.1(b).                                           information to do one or more of the
                                        creditor, the call does not constitute an
                                                                                                                                                      following:
                                        inquiry to any affiliate other than the                 §§ 680.4–680.20      [Reserved]
                                        creditor that holds the consumer’s                                                                               (A) Identify the consumer or type of
                                        account and does not establish a pre-                   § 680.21 Affiliate marketing opt-out and              consumer to receive a solicitation;
                                                                                                exceptions.                                              (B) Establish criteria used to select the
                                        existing business relationship between
                                        the consumer and any affiliate of the                      (a) Initial notice and opt-out                     consumer to receive a solicitation; or
                                        account-holding creditor.                               requirement—(1) In general. You may                      (C) Decide which of your products or
                                           (ii) If a consumer who has a loan                    not use eligibility information about a               services to market to the consumer or
                                        account with a creditor makes a                         consumer that you receive from an                     tailor your solicitation to that consumer;
                                        telephone call to an af-filiate of the                  affiliate to make a solicitation for                  and
                                        creditor to ask about the affiliate’s retail            marketing purposes to the consumer,                      (iii) As a result of your use of the
                                        locations and hours, but does not make                  unless—                                               eligibility information, the consumer is
                                        an inquiry about the affiliate’s products                  (i) It is clearly and conspicuously                provided a solicitation.
                                        or services, the call does not constitute               disclosed to the consumer in writing or,                 (2) Receiving eligibility information
                                        an inquiry and does not establish a pre-                if the consumer agrees, electronically, in            from an affiliate, including through a
                                        existing business relationship between                  a concise notice that you may use                     common database. You may receive
                                        the consumer and the affiliate. Also, the               eligibility information about that                    eligibility information from an affiliate
                                        affiliate’s capture of the consumer’s                   consumer received from an affiliate to                in various ways, including when the
                                        telephone number does not constitute                    make solicitations for marketing                      affiliate places that information into a
                                        an inquiry and does not establish a pre-                purposes to the consumer;                             common database that you may access.
                                        existing business relationship between                     (ii) The consumer is provided a                       (3) Receipt or use of eligibility
                                        the consumer and the affiliate.                         reasonable opportunity and a reasonable               information by your service provider.
                                           (iii) If a consumer makes a telephone                and simple method to ‘‘opt out,’’ or                  Except as provided in paragraph (b)(5)
                                        call to a creditor in response to an                    prohibit you from using eligibility                   of this section, you receive or use an
                                        advertisement that offers a free                        information to make solicitations for                 affiliate’s eligibility information if a
                                        promotional item to consumers who call                  marketing purposes to the consumer;                   service provider acting on your behalf
                                        a toll-free number, but the                             and                                                   (whether an affiliate or a nonaffiliated
                                        advertisement does not indicate that                       (iii) The consumer has not opted out.              third party) receives or uses that
                                        creditor’s products or services will be                    (2) Example. A consumer has a                      information in the manner described in
                                        marketed to consumers who call in                       homeowner’s insurance policy with an                  paragraphs (b)(1)(i) or (b)(1)(ii) of this
                                        response, the call does not create a pre-               insurance company. The insurance                      section. All relevant facts and
                                        existing business relationship between                  company furnishes eligibility                         circumstances will determine whether a
                                        the consumer and the creditor because                   information about the consumer to its                 person is acting as your service provider
                                        the consumer has not made an inquiry                    affiliated creditor. Based on that                    when it receives or uses an affiliate’s
                                        about a product or service offered by the               eligibility information, the creditor                 eligibility information in connection
                                        creditor, but has merely responded to an                wants to make a solicitation to the                   with marketing your products and
                                        offer for a free promotional item.                      consumer about its home equity loan                   services.
pwalker on PROD1PC71 with RULES2




                                           (k) Solicitation—(1) In general. The                 products. The creditor does not have a                   (4) Use by an affiliate of its own
                                        term ‘‘solicitation’’ means the marketing               pre-existing business relationship with               eligibility information. Unless you have
                                        of a product or service initiated by a                  the consumer and none of the other                    used eligibility information that you
                                        person to a particular consumer that                    exceptions apply. The creditor is                     receive from an affiliate in the manner
                                        is—                                                     prohibited from using eligibility                     described in paragraph (b)(1)(ii) of this


                                   VerDate Aug<31>2005   20:51 Oct 29, 2007   Jkt 214001   PO 00000   Frm 00035   Fmt 4701   Sfmt 4700   E:\FR\FM\30OCR2.SGM   30OCR2
                                        61458            Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations

                                        section, you do not make a solicitation                 manner described in paragraph (b)(1)(ii)              information through the common
                                        subject to this part if your affiliate:                 of this section.                                      database as provided in paragraph (b)(2)
                                           (i) Uses its own eligibility information                (ii) Writing requirements. (A) The                 of this section, it did not use that
                                        that it obtained in connection with a                   requirements of paragraphs (b)(5)(i)(A)               information to identify consumers or
                                        pre-existing business relationship it has               and (C) of this section must be set forth             establish selection criteria; instead, the
                                        or had with the consumer to market                      in a written agreement between your                   creditor used its own eligibility
                                        your products or services to the                        affiliate and the service provider; and               information. Therefore, pursuant to
                                        consumer; or                                               (B) The specific terms and conditions              paragraph (b)(4)(i) of this section, the
                                           (ii) Directs its service provider to use             established by your affiliate as provided             insurance company has not made a
                                        the affiliate’s own eligibility information             in paragraph (b)(5)(i)(B) of this section             solicitation to the consumer.
                                        that it obtained in connection with a                   must be set forth in writing.                            (iv) The same facts as in the example
                                        pre-existing business relationship it has                  (6) Examples of making solicitations.              in paragraph (b)(6)(iii) of this section,
                                        or had with the consumer to market                      (i) A consumer has a loan account with                except that the creditor provides the
                                        your products or services to the                        a creditor, which is affiliated with an               insurance company’s criteria to the
                                        consumer, and you do not communicate                    insurance company. The insurance                      creditor’s service provider and directs
                                        directly with the service provider                      company receives eligibility information              the service provider to use the creditor’s
                                        regarding that use.                                     about the consumer from the creditor.                 eligibility information to identify
                                           (5) Use of eligibility information by a              The insurance company uses that                       creditor consumers who meet the
                                        service provider. (i) In general. You do                eligibility information to identify the               criteria and to send the insurance
                                        not make a solicitation subject to this                 consumer to receive a solicitation about              company’s marketing materials to those
                                        part if a service provider (including an                insurance products, and, as a result, the             consumers. The insurance company
                                        affiliated or third-party service provider              insurance company provides a                          does not communicate directly with the
                                        that maintains or accesses a common                     solicitation to the consumer about its                service provider regarding the use of the
                                        database that you may access) receives                  insurance products. Pursuant to                       creditor’s information to market its
                                        eligibility information from your                       paragraph (b)(1) of this section, the                 products to the creditor’s consumers.
                                        affiliate that your affiliate obtained in               insurance company has made a                          Pursuant to paragraph (b)(4)(ii) of this
                                        connection with a pre-existing business                 solicitation to the consumer.                         section, the insurance company has not
                                        relationship it has or had with the                        (ii) The same facts as in the example              made a solicitation to the consumer.
                                        consumer and uses that eligibility                      in paragraph (b)(6)(i) of this section,                  (v) An affiliated group of companies
                                        information to market your products or                  except that after using the eligibility               includes a creditor, an insurance
                                        services to the consumer, so long as—                   information to identify the consumer to               company, and a service provider. Each
                                           (A) Your affiliate controls access to                receive a solicitation about insurance                affiliate in the group places information
                                        and use of its eligibility information by               products, the insurance company asks                  about its consumers into a common
                                        the service provider (including the right               the creditor to send the solicitation to              database. The service provider has
                                        to establish the specific terms and                     the consumer and the creditor does so.                access to all information in the common
                                        conditions under which the service                      Pursuant to paragraph (b)(1) of this                  database. The creditor controls access to
                                        provider may use such information to                    section, the insurance company has                    and use of its eligibility information by
                                        market your products or services);                      made a solicitation to the consumer                   the service provider. This control is set
                                           (B) Your affiliate establishes specific              because it used eligibility information               forth in a written agreement between the
                                        terms and conditions under which the                    about the consumer that it received from              creditor and the service provider. The
                                        service provider may access and use the                 an affiliate to identify the consumer to              written agreement also requires the
                                        affiliate’s eligibility information to                  receive a solicitation about its products             service provider to establish reasonable
                                        market your products and services (or                   or services, and, as a result, a                      policies and procedures designed to
                                        those of affiliates generally) to the                   solicitation was provided to the                      ensure that the service provider uses the
                                        consumer, such as the identity of the                   consumer about the insurance                          creditor’s eligibility information in
                                        affiliated companies whose products or                  company’s products.                                   accordance with specific terms and
                                        services may be marketed to the                            (iii) The same facts as in the example             conditions established by the creditor
                                        consumer by the service provider, the                   in paragraph (b)(6)(i) of this section,               relating to the marketing of the products
                                        types of products or services of affiliated             except that eligibility information about             and services of all affiliates, including
                                        companies that may be marketed, and                     consumers that have loan accounts with                the insurance company. In a separate
                                        the number of times the consumer may                    the creditor is placed into a common                  written communication, the creditor
                                        receive marketing materials, and                        database that all members of the                      specifies the terms and conditions
                                        periodically evaluates the service                      affiliated group of companies may                     under which the service provider may
                                        provider’s compliance with those terms                  independently access and use. Without                 use the creditor’s eligibility information
                                        and conditions;                                         using the creditor’s eligibility                      to market the insurance company’s
                                           (C) Your affiliate requires the service              information, the insurance company                    products and services to the creditor’s
                                        provider to implement reasonable                        develops selection criteria and provides              consumers. The specific terms and
                                        policies and procedures designed to                     those criteria, marketing materials, and              conditions are: a list of affiliated
                                        ensure that the service provider uses the               related instructions to the creditor. The             companies (including the insurance
                                        affiliate’s eligibility information in                  creditor reviews eligibility information              company) whose products or services
                                        accordance with the terms and                           about its own consumers using the                     may be marketed to the creditor’s
                                        conditions established by the affiliate                 selection criteria provided by the                    consumers by the service provider; the
                                        relating to the marketing of your                       insurance company to determine which                  specific products or types of products
                                        products or services;                                   consumers should receive the insurance                that may be marketed to the creditor’s
pwalker on PROD1PC71 with RULES2




                                           (D) Your affiliate is identified on or               company’s marketing materials and                     consumers by the service provider; the
                                        with the marketing materials provided                   sends marketing materials about the                   categories of eligibility information that
                                        to the consumer; and                                    insurance company’s products to those                 may be used by the service provider in
                                           (E) You do not directly use your                     consumers. Even though the insurance                  marketing products or services to the
                                        affiliate’s eligibility information in the              company has received eligibility                      creditor’s consumers; the types or


                                   VerDate Aug<31>2005   20:51 Oct 29, 2007   Jkt 214001   PO 00000   Frm 00036   Fmt 4701   Sfmt 4700   E:\FR\FM\30OCR2.SGM   30OCR2
                                                         Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations                                         61459

                                        categories of the creditor’s consumers to               the current employment relationship or                consumer has been given an opt-out
                                        whom the service provider may market                    status of the individual as a participant             notice, but has not elected to opt out.
                                        products or services of creditor                        or beneficiary of an employee benefit                 The creditor asks a service provider to
                                        affiliates; the number and/or types of                  plan;                                                 send the solicitation to the consumer on
                                        marketing communications that the                          (3) To perform services on behalf of               its behalf. The service provider may
                                        service provider may send to the                        an affiliate, except that this paragraph              send the solicitation on behalf of the
                                        creditor’s consumers; and the length of                 shall not be construed as permitting you              creditor because, as a result of the
                                        time during which the service provider                  to send solicitations on behalf of an                 consumer’s not opting out, the creditor
                                        may market the prod-ucts or services of                 affiliate if the affiliate would not be               is permitted to make the solicitation.
                                        the creditor’s affiliates to its consumers.             permitted to send the solicitation as a                  (3) Examples of consumer-initiated
                                        The creditor periodically evaluates the                 result of the election of the consumer to             communications. (i) A consumer who
                                        service provider’s compliance with                      opt out under this part;                              has a consumer loan account with a
                                        these terms and conditions. The                            (4) In response to a communication                 finance company initiates a
                                        insurance company asks the service                      about your products or services initiated             communication with the creditor’s
                                        provider to market insurance products                   by the consumer;                                      mortgage lending affiliate to request
                                        to certain consumers who have loan                         (5) In response to an authorization or             information about a mortgage. The
                                        accounts with the creditor. Without                     request by the consumer to receive                    mortgage lender affiliate may use
                                        using the creditor’s eligibility                        solicitations; or                                     eligibility information about the
                                        information, the insurance company                         (6) If your compliance with this part              consumer it obtains from the finance
                                        develops selection criteria and provides                would prevent you from complying                      company or any other affiliate to make
                                        those criteria, marketing materials, and                with any provision of State insurance                 solicitations regarding mortgage
                                        related instructions to the service                     laws pertaining to unfair discrimination              products in response to the consumer-
                                        provider. The service provider uses the                 in any State in which you are lawfully                initiated communication.
                                        creditor’s eligibility information from                 doing business.                                          (ii) A consumer who has a loan
                                        the common database to identify the                        (d) Examples of exceptions—(1)                     account with a creditor contacts the
                                        creditor’s consumers to whom insurance                  Example of the pre-existing business                  creditor to request information about
                                        products will be marketed. When the                     relationship exception. A consumer has                how to save and invest for a child’s
                                        insurance company’s marketing                           a loan account with a creditor. The                   college education without specifying the
                                        materials are provided to the identified                consumer also has a relationship with                 type of product in which the consumer
                                        consumers, the name of the creditor is                  the creditor’s securities affiliate for               may be interested. Information about a
                                        displayed on the insurance marketing                    management of the consumer’s                          range of different products or services
                                        materials, an introductory letter that                  securities portfolio. The creditor                    offered by the creditor and one or more
                                        accompanies the marketing materials,                    receives eligibility information about                affiliates of the creditor may be
                                        an account statement that accompanies                   the consumer from its securities affiliate            responsive to that communication. Such
                                        the marketing materials, or the envelope                and uses that information to make a                   products or services may include the
                                        containing the marketing materials. The                 solicitation to the consumer about the                following: mutual funds offered by the
                                        re-quirements of paragraph (b)(5) of this               creditor’s wealth management services.                creditor’s mutual fund affil-iate; section
                                        section have been satisfied, and the                    The creditor may make this solicitation               529 plans offered by the creditor, its
                                        insurance company has not made a                        even if the consumer has not been given               mutual fund affiliate, or another
                                        solicitation to the consumer.                           a notice and opportunity to opt out                   securities affiliate; or trust services
                                           (vi) The same facts as in the example                because the creditor has a pre-existing               offered by a different creditor in the
                                        in paragraph (b)(6)(v) of this section,                 business relationship with the                        affiliated group. Any affiliate offering
                                        except that the terms and conditions                    consumer.                                             investment products or services that
                                        permit the service provider to use the                     (2) Examples of service provider                   would be responsive to the consumer’s
                                        creditor’s eligibility information to                   exception. (i) A consumer has an                      request for information about saving and
                                        market the products and services of                     insurance policy issued by an insurance               investing for a child’s college education
                                        other affiliates to the creditor’s                      company. The insurance company                        may use eligibility information to make
                                        consumers whenever the service                          furnishes eligibility information about               solicitations to the consumer in
                                        provider deems it appropriate to do so.                 the consumer to an affiliated creditor.               response to this communication.
                                        The service provider uses the creditor’s                Based on that eligibility information, the               (iii) A credit card issuer makes a
                                        eligibility information in accordance                   creditor wants to make a solicitation to              marketing call to the consumer without
                                        with the discretion af-forded to it by the              the consumer about its credit products.               using eligibility information received
                                        terms and conditions. Because the terms                 The creditor does not have a pre-                     from an affiliate. The issuer leaves a
                                        and conditions are not specific, the                    existing business relationship with the               voice-mail message that invites the
                                        requirements of paragraph (b)(5) of this                consumer and none of the other                        consumer to call a toll-free number to
                                        section have not been satisfied.                        exceptions in para-graph (c) of this                  apply for the issuer’s credit card. If the
                                           (c) Exceptions. The provisions of this               section apply. The consumer has been                  consumer calls the toll-free number to
                                        part do not apply to you if you use                     given an opt-out notice and has elected               inquire about the credit card, the call is
                                        eligibility information that you receive                to opt out of receiving such                          a consumer-initiated communication
                                        from an affiliate:                                      solicitations. The creditor asks a service            about a product or service and the credit
                                           (1) To make a solicitation for                       provider to send the solicitation to the              card issuer may now use eligibility
                                        marketing purposes to a consumer with                   consumer on its behalf. The service                   information it receives from its affiliates
                                        whom you have a pre-existing business                   provider may not send the solicitation                to make solicitations to the consumer.
                                        relationship;                                           on behalf of the creditor because, as a                  (iv) A consumer calls a creditor to ask
pwalker on PROD1PC71 with RULES2




                                           (2) To facilitate communications to an               result of the consumer’s opt-out                      about retail locations and hours, but
                                        individual for whose benefit you                        election, the creditor is not permitted to            does not request information about
                                        provide employee benefit or other                       make the solicitation.                                products or services. The creditor may
                                        services pursuant to a contract with an                    (ii) The same facts as in paragraph                not use eligibility information it
                                        employer related to and arising out of                  (d)(2)(i) of this section, except the                 receives from an affiliate to make


                                   VerDate Aug<31>2005   20:51 Oct 29, 2007   Jkt 214001   PO 00000   Frm 00037   Fmt 4701   Sfmt 4700   E:\FR\FM\30OCR2.SGM   30OCR2
                                        61460            Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations

                                        solicitations to the consumer about its                 authorized or requested solicitations                    (3) No continuing relationship—(i) In
                                        products or services because the                        from the store’s affiliates.                          general. If there is no continuing
                                        consumer-initiated communication does                      (iv) The terms and conditions of a                 relationship between a consumer and
                                        not relate to the creditor’s products or                credit account agreement contain                      you or your affiliate, and you or your
                                        services. Thus, the use of eligibility                  preprinted boilerplate language stating               affiliate obtain eligibility information
                                        information received from an affiliate                  that by applying to open an account the               about a consumer in connection with a
                                        would not be responsive to the                          consumer authorizes or requests to                    transaction with the consumer, such as
                                        communication and the exception does                    receive solicitations from the creditor’s             an isolated transaction or a credit
                                        not apply.                                              affiliates. The consumer has not                      application that is denied, an opt-out
                                           (v) A consumer calls a creditor to ask               authorized or requested solicitations                 notice provided to the consumer only
                                        about office locations and hours. The                   from the creditor’s affiliates.                       applies to eligibility information
                                        customer service representative asks the                   (e) Relation to affiliate-sharing notice           obtained in connection with that
                                        consumer if there is a particular product               and opt-out. Nothing in this part limits              transaction.
                                        or service about which the consumer is                  the responsibility of a person to comply                 (ii) Examples of isolated transactions.
                                        seeking information. The consumer                       with the notice and opt-out provisions                An isolated transaction occurs if—
                                        responds that the consumer wants to                     of section 603(d)(2)(A)(iii) of the Act                  (A) The consumer uses your or your
                                        stop in and find out about second                       where applicable.                                     affiliate’s ATM to withdraw cash from
                                        mortgage loans. The customer service                                                                          an account at a financial institution; or
                                                                                                § 680.22    Scope and duration of opt-out.               (B) You or your affiliate sells the
                                        representative offers to provide that                      (a) Scope of opt-out—(1) In general.               consumer a money order, airline tickets,
                                        information by telephone and mail                       Except as otherwise provided in this                  travel insurance, or traveler’s checks in
                                        additional information and application                  section, the consumer’s election to opt               isolated transactions.
                                        materials to the consumer. The                          out prohibits any affiliate covered by the               (4) Menu of alternatives. A consumer
                                        consumer agrees and provides or                         opt-out notice from using eligibility                 may be given the opportunity to choose
                                        confirms contact information for receipt                information received from another                     from a menu of alternatives when
                                        of the materials to be mailed. The                      affiliate as described in the notice to               electing to prohibit solicitations, such as
                                        creditor may use eligibility information                make solicitations to the consumer.                   by electing to prohibit solicitations from
                                        it receives from an affiliate to make                      (2) Continuing relationship—(i) In                 certain types of affiliates covered by the
                                        solicitations to the consumer about                     general. If the consumer establishes a                opt-out notice but not other types of
                                        mortgage loan products because such                     continuing relationship with you or                   affiliates covered by the notice, electing
                                        solicitations respond to the consumer-                  your affiliate, an opt-out notice may                 to prohibit solicitations based on certain
                                        initiated communication about products                  apply to eligibility information obtained             types of eligibility information but not
                                        or services.                                            in connection with—                                   other types of eligibility information, or
                                           (4) Examples of consumer                                (A) A single continuing relationship               electing to prohibit solicitations by
                                        authorization or request for                            or multiple continuing relationships                  certain methods of delivery but not
                                        solicitations. (i) A consumer who                       that the consumer establishes with you                other methods of delivery. However,
                                        obtains a mortgage from a mortgage                      or your affiliates, including continuing              one of the alternatives must allow the
                                        lender authorizes or requests                           relationships established subsequent to               consumer to prohibit all solicitations
                                        information about homeowner’s                           delivery of the opt-out notice, so long as            from all of the affiliates that are covered
                                        insurance offered by the mortgage                       the notice adequately describes the                   by the notice.
                                        lender’s insurance affiliate. Such                      continuing relationships covered by the                  (5) Special rule for a notice following
                                        authorization or request, whether given                 opt-out; or                                           termination of all continuing
                                        to the mortgage lender or to the                           (B) Any other transaction between the              relationships—(i) In general. A
                                        insurance affiliate, would permit the                   consumer and you or your affiliates as                consumer must be given a new opt-out
                                        insurance affiliate to use eligibility                  described in the notice.                              notice if, after all continuing
                                        information about the consumer it                          (ii) Examples of continuing                        relationships with you or your
                                        obtains from the mortgage lender or any                 relationships. A consumer has a                       affiliate(s) are terminated, the consumer
                                        other affiliate to make solicitations to                continuing relationship with you or                   subsequently establishes another
                                        the consumer about homeowner’s                          your affiliate if the consumer—                       continuing relationship with you or
                                        insurance.                                                 (A) Opens a credit account with you
                                                                                                                                                      your affiliate(s) and the consumer’s
                                           (ii) A consumer completes an online                  or your affiliate;
                                                                                                   (B) Obtains a loan for which you or                eligibility information is to be used to
                                        application to apply for a credit card                                                                        make a solicitation. The new opt-out
                                                                                                your affiliate owns the servicing rights;
                                        from a department store. The store’s                       (C) Purchases an insurance product                 notice must apply, at a minimum, to
                                        online application contains a blank                     from you or your affiliate;                           eligibility information obtained in
                                        check box that the consumer may check                      (D) Holds an investment product                    connection with the new continuing
                                        to authorize or request information from                through you or your affiliate, such as                relationship. Consistent with paragraph
                                        the store’s affiliates. The consumer                    when you act or your affiliate acts as a              (b) of this section, the consumer’s
                                        checks the box. The consumer has                        custodian for securities or for assets in             decision not to opt out after receiving
                                        authorized or requested solicitations                   an individual retirement arrangement;                 the new opt-out notice would not
                                        from store’s affiliates.                                   (E) Enters into an agreement or                    override a prior opt-out election by the
                                           (iii) A consumer completes an online                 understanding with you or your affiliate              consumer that applies to eligibility
                                        application to apply for a credit card                  whereby you or your affiliate undertakes              information obtained in connection
                                        from a department store. The store’s                    to arrange or broker a home mortgage                  with a terminated relationship,
                                        online application contains a pre-                      loan for the consumer;                                regardless of whether the new opt-out
pwalker on PROD1PC71 with RULES2




                                        selected check box indicating that the                     (F) Enters into a lease of personal                notice applies to eligibility information
                                        consumer authorizes or requests                         property with you or your affiliate; or               obtained in connection with the
                                        information from the store’s affiliates.                   (G) Obtains financial, investment, or              terminated relationship.
                                        The consumer does not deselect the                      economic advisory services from you or                   (ii) Example. A consumer has an
                                        check box. The consumer has not                         your affiliate for a fee.                             automobile loan account with a creditor


                                   VerDate Aug<31>2005   20:51 Oct 29, 2007   Jkt 214001   PO 00000   Frm 00038   Fmt 4701   Sfmt 4700   E:\FR\FM\30OCR2.SGM   30OCR2
                                                         Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations                                         61461

                                        that is part of an affiliated group. The                notice may indicate that it applies to                opt out of receiving marketing than is
                                        consumer pays off the loan. After paying                multiple companies with the ABC name                  required by this part, the requirements
                                        off the loan, the consumer subsequently                 or multiple companies in the ABC group                of this section may be satisfied by
                                        obtains a second mortgage loan from the                 or family of companies, for example, by               providing the consumer with a clear,
                                        creditor. The consumer must be given a                  stating that the notice is provided by                conspicuous, and concise notice that
                                        new notice and opportunity to opt out                   ‘‘all of the ABC companies,’’ ‘‘the ABC               accurately discloses the consumer’s opt-
                                        before the creditor’s affiliates may make               banking, credit card, insurance, and                  out rights.
                                        solicitations to the consumer using                     securities companies,’’ or by listing the               (4) Model notices. Model notices are
                                        eligibility information obtained by the                 name of each affiliate providing the                  provided in Appendix C of Part 698 of
                                        creditor in connection with the new                     notice. But if the affiliates covered by              this chapter.
                                        mortgage relationship, regardless of                    the notice do not all share a common                    (b) Coordinated and consolidated
                                        whether the consumer opted out in                       name, then the notice must either                     notices. A notice required by this part
                                        connection with the automobile loan                     separately identify each covered affiliate            may be coordinated and consolidated
                                        account.                                                by name or identify each of the common                with any other notice or disclosure
                                           (b) Duration of opt-out. The election                names used by those affiliates, for                   required to be issued under any other
                                        of a consumer to opt out must be                        example, by stating that the notice                   provision of law by the entity providing
                                        effective for a period of at least five                 applies to ‘‘all of the ABC and XYZ                   the notice, including but not limited to
                                        years (the ‘‘opt-out period’’) beginning                companies’’ or to ‘‘the ABC banking and               the notice de-scribed in section
                                        when the consumer’s opt-out election is                 credit card companies and the XYZ                     603(d)(2)(A)(iii) of the Act and the
                                        received and implemented, unless the                    insurance companies;’’                                Gramm-Leach-Bliley Act privacy notice.
                                        consumer subsequently revokes the opt-                     (iii) A general description of the types             (c) Equivalent notices. A notice or
                                        out in writing or, if the consumer agrees,              of eligibility information that may be                other disclosure that is equivalent to the
                                        electronically. An opt-out period of                    used to make solicitations to the                     notice required by this part, and that is
                                        more than five years may be established,                consumer;                                             provided to a consumer together with
                                        including an opt-out period that does                      (iv) That the consumer may elect to                disclosures required by any other
                                        not expire unless revoked by the                        limit the use of eligibility information to           provision of law, satisfies the
                                        consumer.                                               make solicitations to the consumer;                   requirements of this section.
                                           (c) Time of opt-out. A consumer may                     (v) That the consumer’s election will
                                        opt out at any time.                                    apply for the specified period of time                § 680.24   Reasonable opportunity to opt
                                                                                                stated in the notice and, if applicable,              out.
                                        § 680.23 Contents of opt-out notice;                    that the consumer will be allowed to                     (a) In general. You must not use
                                        consolidated and equivalent notices.                                                                          eligibility information about a consumer
                                                                                                renew the election once that period
                                           (a) Contents of opt-out notice—(1) In                expires;                                              that you receive from an affiliate to
                                        general. A notice must be clear,                           (vi) If the notice is provided to                  make a solicitation to the consumer
                                        conspicuous, and concise, and must                      consumers who may have previously                     about your products or services, unless
                                        accurately disclose:                                    opted out, such as if a notice is provided            the consumer is provided a reasonable
                                           (i) The name of the affiliate(s)                     to consumers annually, that the                       opportunity to opt out, as required by
                                        providing the notice. If the notice is                  consumer who has chosen to limit                         § 680.21(a)(1)(ii) of this part.
                                        provided jointly by multiple affiliates                 solicitations does not need to act again                 (b) Examples of a reasonable
                                        and each affiliate shares a common                      until the consumer receives a renewal                 opportunity to opt out. The consumer is
                                        name, such as ‘‘ABC,’’ then the notice                  notice; and                                           given a reasonable opportunity to opt
                                        may indicate that it is being provided by                  (vii) A reasonable and simple method               out if:
                                        multiple companies with the ABC name                    for the consumer to opt out.                             (1) By mail. The opt-out notice is
                                        or multiple companies in the ABC group                     (2) Joint relationships. (i) If two or             mailed to the consumer. The consumer
                                        or family of companies, for example, by                 more consumers jointly obtain a product               is given 30 days from the date the notice
                                        stating that the notice is provided by                  or service, a single opt-out notice may               is mailed to elect to opt out by any
                                        ‘‘all of the ABC companies,’’ ‘‘the ABC                 be provided to the joint consumers. Any               reasonable means.
                                        banking, credit card, insurance, and                    of the joint consumers may exercise the                  (2) By electronic means. (i) The opt-
                                        securities companies,’’ or by listing the               right to opt out.                                     out notice is provided electronically to
                                        name of each affiliate providing the                       (ii) The opt-out notice must explain               the consumer, such as by posting the
                                        notice. But if the affiliates providing the             how an opt-out direction by a joint                   notice at an Internet Web site at which
                                        joint notice do not all share a common                  consumer will be treated. An opt-out                  the consumer has obtained a product or
                                        name, then the notice must either                       direction by a joint consumer may be                  service. The consumer acknowledges
                                        separately identify each affiliate by                   treated as applying to all of the                     receipt of the electronic notice. The
                                        name or identify each of the common                     associated joint consumers, or each joint             consumer is given 30 days after the date
                                        names used by those affiliates, for                     consumer may be permitted to opt out                  the consumer acknowledges receipt to
                                        example, by stating that the notice is                  separately. If each joint consumer is                 elect to opt out by any reasonable
                                        provided by ‘‘all of the ABC and XYZ                    permitted to opt out separately, one of               means.
                                        companies’’ or by ‘‘the ABC banking                     the joint consumers must be permitted                    (ii) The opt-out notice is provided to
                                        and credit card companies and the XYZ                   to opt out on behalf of all of the joint              the consumer by e-mail where the
                                        insurance companies;’’                                  consumers and the joint consumers                     consumer has agreed to receive
                                           (ii) A list of the affiliates or types of            must be permitted to exercise their                   disclosures by e-mail from the person
                                        affiliates whose use of eligibility                     separate rights to opt out in a single                sending the notice. The consumer is
                                        information is covered by the notice,                   response.                                             given 30 days after the e-mail is sent to
pwalker on PROD1PC71 with RULES2




                                        which may include companies that                           (iii) It is impermissible to require all           elect to opt out by any reasonable
                                        become affiliates after the notice is                   joint consumers to opt out before                     means.
                                        provided to the consumer. If each                       implementing any opt-out direction.                      (3) At the time of an electronic
                                        affiliate covered by the notice shares a                   (3) Alternative contents. If the                   transaction. The opt-out notice is
                                        common name, such as ‘‘ABC,’’ then the                  consumer is afforded a broader right to               provided to the consumer at the time of


                                   VerDate Aug<31>2005   20:51 Oct 29, 2007   Jkt 214001   PO 00000   Frm 00039   Fmt 4701   Sfmt 4700   E:\FR\FM\30OCR2.SGM   30OCR2
                                        61462            Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations

                                        an electronic transaction, such as a                       (v) Allowing consumers to exercise all               (1) Only posts the notice on a sign in
                                        transaction conducted on an Internet                    of their opt-out rights described in a                a branch or office or generally publishes
                                        Web site. The consumer is required to                   consolidated opt-out notice that                      the notice in a newspaper;
                                        decide, as a necessary part of                          includes the privacy opt-out under the                  (2) Sends the notice via e-mail to a
                                        proceeding with the transaction,                        Gramm-Leach-Bliley Act, 15 U.S.C.                     consumer who has not agreed to receive
                                        whether to opt out before completing                    6801 et seq., the affiliate sharing opt-out           electronic disclosures by e-mail from
                                        the transaction. There is a simple                      under the Act, and the affiliate                      the affiliate providing the notice; or
                                        process that the consumer may use to                    marketing opt-out under the Act, by a                   (3) Posts the notice on an Internet
                                        opt out at that time using the same                     single method, such as by calling a                   Web site without requiring the
                                        mechanism through which the                             single toll-free telephone number.                    consumer to acknowledge receipt of the
                                        transaction is conducted.                                  (2) Opt-out methods that are not                   notice.
                                           (4) At the time of an in-person                      reasonable and simple. Reasonable and
                                                                                                                                                      § 680.27   Renewal of opt-out.
                                        transaction. The opt-out notice is                      simple methods for exercising an opt-
                                        provided to the consumer in writing at                  out right do not include—                                (a) Renewal notice and opt-out
                                        the time of an in-person transaction.                      (i) Requiring the consumer to write                requirement—(1) In general. After the
                                        The consumer is required to decide, as                  his or her own letter;                                opt-out period expires, you may not
                                        a necessary part of proceeding with the                    (ii) Requiring the consumer to call or             make solicitations based on eligibility
                                        transaction, whether to opt out before                  write to obtain a form for opting out,                information you receive from an affiliate
                                        completing the transaction, and is not                  rather than including the form with the               to a consumer who previously opted
                                        permitted to complete the transaction                   opt-out notice;                                       out, unless:
                                                                                                   (iii) Requiring the consumer who                      (i) The consumer has been given a
                                        without making a choice. There is a
                                                                                                receives the opt-out notice in electronic             renewal notice that complies with the
                                        simple process that the consumer may
                                                                                                form only, such as through posting at an              requirements of this section and
                                        use during the course of the in-person
                                                                                                Internet Web site, to opt out solely by               §§ 680.24 through 680.26 of this part,
                                        transaction to opt out, such as
                                                                                                paper mail or by visiting a different Web             and a reasonable opportunity and a
                                        completing a form that requires
                                                                                                site without providing a link to that site.           reasonable and simple method to renew
                                        consumers to write a ‘‘yes’’ or ‘‘no’’ to
                                                                                                   (c) Specific opt-out means. Each                   the opt-out, and the consumer does not
                                        indicate their opt-out preference or that
                                                                                                consumer may be required to opt out                   renew the opt-out; or
                                        requires the consumer to check one of                                                                            (ii) An exception in § 680.21(c) of this
                                        two blank check boxes—one that allows                   through a specific means, as long as that
                                                                                                means is reasonable and simple for that               part applies.
                                        consumers to indicate that they want to                                                                          (2) Renewal period. Each opt-out
                                        opt out and one that allows consumers                   consumer.
                                                                                                                                                      renewal must be effective for a period of
                                        to indicate that they do not want to opt                § 680.26    Delivery of opt-out notices.              at least five years as provided in
                                        out.                                                       (a) In general. The opt-out notice must            § 680.22(b) of this part.
                                           (5) By including in a privacy notice.                be provided so that each consumer can                    (3) Affiliates who may provide the
                                        The opt-out notice is included in a                     reasonably be expected to receive actual              notice. The notice required by this
                                        Gramm-Leach-Bliley Act privacy notice.                  notice. For opt-out notices provided                  paragraph must be provided:
                                        The consumer is allowed to exercise the                 electronically, the notice may be                        (i) By the affiliate that provided the
                                        opt-out within a reasonable period of                   provided in compliance with either the                previous opt-out notice, or its successor;
                                        time and in the same manner as the opt-                 electronic disclosure provisions in this              or
                                        out under that privacy notice.                          part or the provisions in section 101 of                 (ii) As part of a joint renewal notice
                                        § 680.25 Reasonable and simple methods                  the Electronic Signatures in Global and               from two or more members of an
                                        of opting out.                                          National Commerce Act, 15 U.S.C. 7001                 affiliated group of companies, or their
                                                                                                et seq.                                               successors, that jointly provided the
                                           (a) In general. You must not use                                                                           previous opt-out notice.
                                                                                                   (b) Examples of reasonable
                                        eligibility information about a consumer                                                                         (b) Contents of renewal notice. The
                                                                                                expectation of actual notice. A
                                        that you receive from an affiliate to                                                                         renewal notice must be clear,
                                                                                                consumer may reasonably be expected
                                        make a solicitation to the consumer                                                                           conspicuous, and concise, and must
                                                                                                to receive actual notice if the affiliate
                                        about your products or services, unless                                                                       accurately disclose:
                                                                                                providing the notice:
                                        the consumer is provided a reasonable                                                                            (1) The name of the affiliate(s)
                                                                                                   (1) Hand-delivers a printed copy of
                                        and simple method to opt out, as                                                                              providing the notice. If the notice is
                                                                                                the notice to the consumer;
                                        required by § 680.21(a)(1)(ii) of this part.                                                                  provided jointly by multiple affiliates
                                                                                                   (2) Mails a printed copy of the notice
                                           (b) Examples—(1) Reasonable and                      to the last known mailing address of the              and each affiliate shares a common
                                        simple opt-out methods. Reasonable and                  consumer;                                             name, such as ‘‘ABC,’’ then the notice
                                        simple methods for exercising the opt-                     (3) Provides a notice by e-mail to a               may indicate that it is being provided by
                                        out right include—                                      consumer who has agreed to receive                    multiple companies with the ABC name
                                           (i) Designating a check-off box in a                 electronic disclosures by e-mail from                 or multiple companies in the ABC group
                                        prominent position on the opt-out form;                 the affiliate providing the notice; or                or family of companies, for example, by
                                           (ii) Including a reply form and a self-                 (4) Posts the notice on the Internet               stating that the notice is provided by
                                        addressed envelope together with the                    Web site at which the consumer                        ‘‘all of the ABC companies,’’ ‘‘the ABC
                                        opt-out notice;                                         obtained a product or service                         banking, credit card, insurance, and
                                           (iii) Providing an electronic means to               electronically and requires the                       securities companies,’’ or by listing the
                                        opt out, such as a form that can be                     consumer to acknowledge receipt of the                name of each affiliate providing the
                                        electronically mailed or processed at an                notice.                                               notice. But if the affiliates providing the
pwalker on PROD1PC71 with RULES2




                                        Internet Web site, if the consumer agrees                  (c) Examples of no reasonable                      joint notice do not all share a common
                                        to the electronic delivery of information;              expectation of actual notice. A                       name, then the notice must either
                                           (iv) Providing a toll-free telephone                 consumer may not reasonably be                        separately identify each affiliate by
                                        number that consumers may call to opt                   expected to receive actual notice if the              name or identify each of the common
                                        out; or                                                 affiliate providing the notice:                       names used by those affiliates, for


                                   VerDate Aug<31>2005   20:51 Oct 29, 2007   Jkt 214001   PO 00000   Frm 00040   Fmt 4701   Sfmt 4700   E:\FR\FM\30OCR2.SGM   30OCR2
                                                         Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations                                                 61463

                                        example, by stating that the notice is                  before expiration of the opt-out period               provides. Acceptable changes include, for
                                        provided by ‘‘all of the ABC and XYZ                    is a reasonable period of time before                 example:
                                        companies’’ or by ‘‘the ABC banking                     expiration of the opt-out in all cases.                  1. Rearranging the order of the references
                                        and credit card companies and the XYZ                      (d) No effect on opt-out period. An                to ‘‘your income,’’ ‘‘your account history,’’
                                                                                                                                                      and ‘‘your credit score.’’
                                        insurance companies;’’                                  opt-out period may not be shortened by                   2. Substituting other types of information
                                           (2) A list of the affiliates or types of             sending a renewal notice to the                       for ‘‘income,’’ ‘‘account history,’’ or ‘‘credit
                                        affiliates whose use of eligibility                     consumer before expiration of the opt-                score’’ for accuracy, such as ‘‘payment
                                        information is covered by the notice,                   out period, even if the consumer does                 history,’’ ‘‘credit history,’’ ‘‘payoff status,’’ or
                                        which may include companies that                        not renew the opt out.                                ‘‘claims history.’’
                                        become affiliates after the notice is                                                                            3. Substituting a clearer and more accurate
                                        provided to the consumer. If each                       § 680.28 Effective date, compliance date,             description of the affiliates providing or
                                                                                                and prospective application.                          covered by the notice for phrases such as
                                        affiliate covered by the notice shares a
                                        common name, such as ‘‘ABC,’’ then the                     (a) Effective date. This part is effective         ‘‘the [ABC] group of companies,’’ including
                                                                                                January 1, 2008.                                      without limitation a statement that the entity
                                        notice may indicate that it applies to
                                                                                                   (b) Mandatory compliance date.                     providing the notice recently purchased the
                                        multiple companies with the ABC name                                                                          consumer’s account.
                                        or multiple companies in the ABC group                  Compliance with this part is required
                                                                                                                                                         4. Substituting other types of affiliates
                                        or family of companies, for example, by                 not later than October 1, 2008.                       covered by the notice for ‘‘credit card,’’
                                        stating that the notice is provided by                     (c) Prospective application. The                   ‘‘insurance,’’ or ‘‘securities’’ affiliates.
                                        ‘‘all of the ABC companies,’’ ‘‘the ABC                 provisions of this part shall not prohibit               5. Omitting items that are not accurate or
                                        banking, credit card, insurance, and                    you from using eligibility information                applicable. For example, if a person does not
                                        securities companies,’’ or by listing the               that you receive from an affiliate to                 limit the duration of the opt-out period, the
                                        name of each affiliate providing the                    make solicitations to a consumer if you               notice may omit information about the
                                                                                                receive such information prior to                     renewal notice.
                                        notice. But if the affiliates covered by
                                                                                                October 1, 2008. For purposes of this                    6. Adding a statement informing
                                        the notice do not all share a common                                                                          consumers how much time they have to opt
                                        name, then the notice must either                       section, you are deemed to receive
                                                                                                                                                      out before shared eligibility information may
                                        separately identify each covered affiliate              eligibility information when such                     be used to make solicitations to them.
                                        by name or identify each of the common                  information is placed into a common                      7. Adding a statement that the consumer
                                        names used by those affiliates, for                     database and is accessible by you.                    may exercise the right to opt out at any time.
                                        example, by stating that the notice                                                                              8. Adding the following statement, if
                                        applies to ‘‘all of the ABC and XYZ                     PART 698—AMENDED                                      accurate: ‘‘If you previously opted out, you
                                        companies’’ or to ‘‘the ABC banking and                                                                       do not need to do so again.’’
                                                                                                I 2. Revise the authority citation for Part              9. Providing a place on the form for the
                                        credit card companies and the XYZ                       698 to read as follows:                               consumer to fill in identifying information,
                                        insurance companies;’’                                                                                        such as his or her name and address.
                                           (3) A general description of the types                 Authority: 15 U.S.C. 1681e, 1681g, 1681j,
                                        of eligibility information that may be                  1681m, 1681s, and 1681s-3; sections 211(d)            C-1 Model Form for Initial Opt-out notice
                                                                                                and 214(b), Pub. L. 108-159, 117 Stat.1952.             (Single-Affiliate Notice)
                                        used to make solicitations to the
                                                                                                I 3. Amend § 698.1 by revising                        C-2 Model Form for Initial Opt-out notice
                                        consumer;
                                                                                                paragraph (b) to read as follows:                       (Joint Notice)
                                           (4) That the consumer previously                                                                           C-3 Model Form for Renewal Notice (Single-
                                        elected to limit the use of certain                     § 698.1    Authority and purpose.                       Affiliate Notice)
                                        information to make solicitations to the                                                                      C-4 Model Form for Renewal Notice (Joint
                                        consumer;                                               *      *    *    *      *
                                                                                                                                                        Notice)
                                           (5) That the consumer’s election has                    (b) Purpose. The purpose of this part              C-5 Model Form for Voluntary ‘‘No
                                        expired or is about to expire;                          is to comply with sections 607(d),                      Marketing’’ Notice
                                           (6) That the consumer may elect to                   609(c), 609(d), 612(a), 615(d), and 624 of
                                                                                                the Fair Credit Reporting Act, as                     C-1 Model Form for Initial Opt-out Notice
                                        renew the consumer’s previous election;                                                                       (Single-Affiliate Notice)
                                           (7) If applicable, that the consumer’s               amended by the Fair and Accurate
                                        election to renew will apply for the                    Credit Transactions Act of 2003, and                    [Your Choice to Limit Marketing]/
                                                                                                sections 211(d) and 214(b) of the Fair                [Marketing Opt-out]
                                        specified period of time stated in the
                                        notice and that the consumer will be                    and Accurate Credit Transactions Act of               — [Name of Affiliate] is providing this
                                        allowed to renew the election once that                 2003.                                                     notice.
                                        period expires; and                                     I 4. Add Appendix C to Part 698 as
                                                                                                                                                      — [Optional: Federal law gives you the right
                                           (8) A reasonable and simple method                                                                             to limit some but not all marketing from
                                                                                                follows:                                                  our affiliates. Federal law also requires
                                        for the consumer to opt out.                                                                                      us to give you this notice to tell you
                                           (c) Timing of the renewal notice—(1)                 APPENDIX C TO PART 698—MODEL
                                                                                                FORMS FOR AFFILIATE MARKETING                             about your choice to limit marketing
                                        In general. A renewal notice may be                                                                               from our affiliates.]
                                        provided to the consumer either—                        OPT-OUT NOTICES
                                                                                                                                                      — You may limit our affiliates in the [ABC]
                                           (i) A reasonable period of time before                  A. Although use of the model forms is not              group of companies, such as our [credit
                                        the expiration of the opt-out period; or                required, use of the model forms in this                  card, insurance, and securities] affiliates,
                                           (ii) Any time after the expiration of                Appendix (as applicable) complies with the                from marketing their products or services
                                        the opt-out period but before                           requirement in section 624 of the Act for                 to you based on your personal
                                        solicitations that would have been                      clear, conspicuous, and concise notices.                  information that we collect and share
                                        prohibited by the expired opt-out are                      B. Certain changes may be made to the                  with them. This information includes
                                        made to the consumer.                                   language or format of the model forms                     your [income], your [account history
                                           (2) Combination with annual privacy                  without losing the protection from liability              with us], and your [credit score].
pwalker on PROD1PC71 with RULES2




                                                                                                afforded by use of the model forms. These             — Your choice to limit marketing offers from
                                        notice. If you provide an annual privacy                changes may not be so extensive as to affect              our affiliates will apply [until you tell us
                                        notice under the Gramm-Leach-Bliley                     the substance, clarity, or meaningful                     to change your choice]/[for x years from
                                        Act, 15 U.S.C. 6801 et seq., providing a                sequence of the language in the model forms.              when you tell us your choice]/[for at
                                        renewal notice with the last annual                     Persons making such extensive revisions will              least 5 years from when you tell us your
                                        privacy notice provided to the consumer                 lose the safe harbor that this Appendix                   choice]. [Include if the opt-out period



                                   VerDate Aug<31>2005   20:51 Oct 29, 2007   Jkt 214001   PO 00000   Frm 00041   Fmt 4701   Sfmt 4700   E:\FR\FM\30OCR2.SGM   30OCR2
                                        61464            Federal Register / Vol. 72, No. 209 / Tuesday, October 30, 2007 / Rules and Regulations

                                            expires.] Once that period expires, you                   opted out.] If you have already made a          — The [ABC group of companies] is
                                            will receive a renewal notice that will                   choice to limit marketing offers from the           providing this notice.
                                            allow you to continue to limit marketing                  [ABC] companies, you do not need to act         — [Optional: Federal law gives you the right
                                            offers from our affiliates for [another x                 again until you receive the renewal                 to limit some but not all marketing from
                                            years]/[at least another 5 years].                        notice.                                             the [ABC] companies. Federal law also
                                        — [Include, if applicable, in a subsequent              To limit marketing offers, contact us                     requires us to give you this notice to tell
                                            notice, including an annual notice, for             [include all that apply]:                                 you about your choice to limit marketing
                                            consumers who may have previously                                                                             from the [ABC] companies.]
                                            opted out.] If you have already made a              — By telephone: 1-877-###–####
                                                                                                — On the Web: www.—.com                               — You previously chose to limit the [ABC
                                            choice to limit marketing offers from our                                                                     companies], such as the [ABC credit
                                            affiliates, you do not need to act again            — By mail: check the box and complete the
                                                                                                   form below, and send the form to:                      card, insurance, and securities] affiliates,
                                            until you receive the renewal notice.
                                                                                                                                                          from marketing their products or services
                                        To limit marketing offers, contact us                     [Company name]                                          to you based on your personal
                                        [include all that apply]:                                 [Company address]                                       information that they receive from other
                                        — By telephone: 1-877-###–####                            __ Do not allow any company [in the ABC                 [ABC] companies. This information
                                        — On the Web: www.—.com                                 group of companies] to use my personal                    includes your [income], your [account
                                        — By mail: check the box and complete the               information to market to me.                              history], and your [credit score].
                                           form below, and send the form to:                    C-3 Model Form for Renewal Notice (Single-            — Your choice has expired or is about to
                                                                                                Affiliate Notice)                                         expire.
                                           [Company name]
                                           [Company address]                                      [Renewing Your Choice to Limit                        To renew your choice to limit marketing
                                                                                                Marketing]/[Renewing Your Marketing Opt-              for [x] more years, contact us [include all
                                          __ Do not allow your affiliates to use my
                                        personal information to market to me.                   out]                                                  that apply]:
                                                                                                — [Name of Affiliate] is providing this               — By telephone: 1-877-###–####
                                        C-2 Model Form for Initial Opt-out Notice
                                                                                                    notice.                                           — On the Web: www.—.com
                                        (Joint Notice)
                                                                                                — [Optional: Federal law gives you the right          — By mail: check the box and complete the
                                          [Your Choice to Limit Marketing]/                         to limit some but not all marketing from             form below, and send the form to:
                                        [Marketing Opt-out]                                         our affiliates. Federal law also requires
                                                                                                    us to give you this notice to tell you              [Company name]
                                        — The [ABC group of companies] is                                                                               [Company address]
                                            providing this notice.                                  about your choice to limit marketing
                                        — [Optional: Federal law gives you the right                from our affiliates.]                               __ Renew my choice to limit marketing for
                                            to limit some but not all marketing from            — You previously chose to limit our affiliates        [x] more years.
                                            the [ABC] companies. Federal law also                   in the [ABC] group of companies, such
                                            requires us to give you this notice to tell             as our [credit card, insurance, and               C-5 Model Form for Voluntary ‘‘No
                                            you about your choice to limit marketing                securities] affiliates, from marketing their      Marketing’’ Notice
                                            from the [ABC] companies.]                              products or services to you based on                Your Choice to Stop Marketing
                                        — You may limit the [ABC companies], such                   your personal information that we share
                                                                                                    with them. This information includes              — [Name of Affiliate] is providing this
                                            as the [ABC credit card, insurance, and
                                                                                                    your [income], your [account history                  notice.
                                            securities] affiliates, from marketing their
                                                                                                    with us], and your [credit score].                — You may choose to stop all marketing from
                                            products or services to you based on
                                            your personal information that they                 — Your choice has expired or is about to                  us and our affiliates.
                                            receive from other [ABC] companies.                     expire.
                                                                                                                                                      To stop all marketing offers, contact us
                                            This information includes your [income],            To renew your choice to limit marketing for           [include all that apply]:
                                            your [account history], and your [credit            [x] more years, contact us [include all that
                                                                                                apply]:                                               — By telephone: 1-877-###–####
                                            score].
                                                                                                                                                      — On the Web: www.—.com
                                        — Your choice to limit marketing offers from            — By telephone: 1-877-###–####
                                            the [ABC] companies will apply [until                                                                     — By mail: check the box and complete the
                                                                                                — On the Web: www.—.com                                  form below, and send the form to:
                                            you tell us to change your choice]/[for x           — By mail: check the box and complete the
                                            years from when you tell us your                       form below, and send the form to:                    [Company name]
                                            choice]/[for at least 5 years from when                                                                     [Company address]
                                            you tell us your choice]. [Include if the             [Company name]
                                                                                                  [Company address]                                     __ Do not market to me.
                                            opt-out period expires.] Once that period
                                            expires, you will receive a renewal                   __ Renew my choice to limit marketing for             The Federal Trade Commission.
                                            notice that will allow you to continue to           [x] more years.                                         Dated: October 22, 2007.
                                            limit marketing offers from the [ABC]                                                                       By direction of the Commission.
                                            companies for [another x years]/[at least           C-4 Model Form for Renewal Notice (Joint
                                                                                                Notice)                                               Donald S. Clark,
                                            another 5 years].
                                                                                                                                                      Secretary.
                                        — [Include, if applicable, in a subsequent                [Renewing Your Choice to Limit
                                            notice, including an annual notice, for             Marketing]/[Renewing Your Marketing Opt-              [FR Doc. E7–21348 Filed 10–29–07: 8:45 am]
                                            consumers who may have previously                   out]                                                  BILLING CODE 6750–01–S
pwalker on PROD1PC71 with RULES2




                                   VerDate Aug<31>2005   20:51 Oct 29, 2007   Jkt 214001   PO 00000   Frm 00042   Fmt 4701   Sfmt 4700   E:\FR\FM\30OCR2.SGM   30OCR2