NASD Regulation Withdraws Proposed Rule Regarding Confidential Customer Financial Information

INFORMATIONAL

Confidential Customer Information

Executive Summary

In light of recently enacted federal law, NASD Regulation, Inc. (NASD Regulation^SM) has withdrawn its rule proposal announced in Notice to Members 97-12 (March 1997) regarding the use and release of confidential customer financial information. The new law mandates rulemaking governing the privacy of consumer financial information by federal agencies, including the Securities and Exchange Commission (SEC), thereby eliminating the need for NASD Regulation to pursue its own rules.

On June 22, 2000, the SEC issued Regulation S-P, "Privacy of Consumer Financial Information." Regulation S-P goes into effect on a voluntary basis starting November 13, 2000; it becomes mandatory on July 1, 2001. A copy of Regulation S-P is included with this Notice.

Questions/Further Information

Legal questions or comments concerning this Notice may be directed to Gregory Dean, Assistant General Counsel, Office of General Counsel, NASD Regulation, at (202) 728-8159. Other questions or comments concerning this Notice may be directed to Paul Voketaitis, Member Regulation, NASD Regulation, at (202) 728-8843.

Background

In Notice to Members 97-12, NASD Regulation proposed requirements regarding the use of confidential financial information obtained from a customer by a member firm, either directly or through a business affiliate, and the release of such information to any third party, whether affiliated or nonaffiliated. In general, the proposal prohibited the release by a member (or its affiliate) of confidential customer financial information unless prior written consent was obtained from the customer or proper notification was given to the customer about the intended release of the information.

NASD Regulation received approximately 50 comments in response to the proposal in Notice to Members 97-12. Many of the comments raised significant concerns about the proposed rule. Because of the substantial opposition to the proposed rule and due to potential congressional action in this area, NASD Regulation did not take any action on the proposal.

Gramm-Leach-Bliley Act

On November 12, 1999, the President signed into law the Gramm-Leach-Bliley Act (GLB).¹ Title V of the GLB sets forth privacy requirements for use of nonpublic personal financial information by banks, securities industry members, insurance companies, and other financial institutions. The GLB required the Federal Reserve Board, the Office of the Comptroller of the Currency, the Federal Deposit Insurance Corporation, the Office of Thrift Supervision (collectively known as the "federal banking regulators"), the SEC, the National Credit Union Administration (NCUA), and the Federal Trade Commission (FTC) to coordinate the issuance of regulations governing the collection, use, and safeguarding of nonpublic personal financial information. In addition, the law recommended that the federal regulators work with state insurance commissioners on the regulations. The federal banking regulators, NCUA, and FTC issued proposed regulations in February 2000 and issued final regulations in May 2000. The SEC's final regulation, Regulation S-P, "Privacy of Consumer Financial Information," was issued in June 2000.

Due to the privacy provisions of GLB and the SEC's issuance of Regulation S-P, NASD Regulation believes that its proposed rule regarding confidential customer financial information is no longer necessary. On July 26, 2000, the NASD Regulation Board approved a measure to withdraw Notice to Members 97-12.

SEC Regulation S-P

On March 2, 2000, the SEC issued a proposed regulation, Regulation S-P,2 and on June 29, the SEC's final regulation was published in the Federal Register.³ Regulation S-P will go into effect on November 13, 2000, on a voluntary basis, and will become mandatory on July 1, 2001.

Regulation S-P is built around an "opt-out" policy. This means that as long as certain notices are given to consumers and customers, then financial institutions⁴ (broker/dealers) are permitted to share their clients' financial information with the broker/dealers' affiliated and non-affiliated third parties unless the consumers and customers opt out of the information sharing arrangement. The SEC defines a "consumer" as an individual who obtains or has obtained a financial product or service from a financial institution. Typically, a consumer has no further contact with the financial institution other than the one-time delivery of products or services. In addition, the SEC defines a "customer" as a consumer who has developed a continuing relationship with a financial institution to provide products or services.⁵

According to the SEC, in the first year a broker/dealer becomes subject to the rule, a broker/dealer must comply with the following requirements:

The SEC also recommends that broker/dealers review their contracts with third parties for administrative services and joint marketing agreements to ensure that the contracts reflect the firms' privacy policies. After the first year, broker/dealers would be required to revise notices only to reflect changes in their privacy policies. Similarly, these firms would have to revise their policies and procedures on safeguarding customer information as appropriate to ensure the protection of the information.

Privacy Notices

For the privacy notices, the rule requires broker/dealers to disclose details on the broker/dealers' information sharing arrangements. Specifically, the rule requires broker/dealers to disclose:

• the categories of nonpublic personal information that a broker/dealer may collect;






 
•  
•  
•  
• the categories of nonpublic personal information that a broker/dealer may disclose;






 
•  
•  
•  
• the categories of affiliates and nonaffiliated third parties to whom a broker/dealer discloses nonpublic personal information other than service providers and third parties that aid in fulfilling the service requested by a consumer;






 
•  
•  
•  
• the broker/dealer's policies with respect to sharing information about former customers;






 
•  
•  
•  
• the categories of information that are disclosed under agreements with third party service providers and joint marketers and the categories of third parties providing the services;






 
•  
•  
•  
• a consumer's right to opt out of the disclosure of nonpublic personal information to nonaffiliated third parties;






 
•  
•  
•  
• any disclosures regarding affiliate information sharing opt outs a financial institution is providing under the Fair Credit Reporting Act; and






 
•  
•  
•  
• the institution's policies and practices with respect to protecting the confidentiality, security, and integrity of nonpublic personal information.

Essentially, consumers and customers must be given notice when information is going to be shared and then be given the opportunity to opt out of that sharing arrangement.

In certain circumstances, Regulation S-P permits broker/dealers to use "short-form" initial notices for consumers with whom the broker/dealer does not have a customer relationship. The short-form notice must be accompanied by an opt-out notice and information on where the consumer may obtain additional information on the firm's privacy policies.

Under Regulation S-P, any information given by consumers or customers to broker/dealers to obtain a product or service will generally be considered to be nonpublic financial information. In addition, any list, description, or other grouping of consumers and customers that is derived from this information also may be considered nonpublic information. A broker/dealer may consider the information received to be publicly available (and therefore not subject to the restrictions of Regulation SP) if the broker/dealer reasonably believes that the information is lawfully available from three sources:

Information Sharing Arrangements

Another important aspect of Regulation S-P concerns the information sharing arrangements broker/dealers may have with their affiliates and with nonaffiliated third parties.

Affliates

Generally, broker/dealers may share consumers' and customers' information with the broker/dealers' affiliates as long as that fact is disclosed in the privacy notices. Consumers and customers may not opt out of that information sharing arrangement.

Nonaffliated Third Parties

If, however, a broker/dealer has an information sharing agreement with nonaffiliated third parties, then that fact must be disclosed, and consumers and customers may generally opt out of having their information shared under that agreement.

The GLB does provide a series of exceptions that permit broker/dealers to share information with nonaffliated third parties and in which consumers and customers may not opt out of those sharing arrangements. These exceptions include, but are not limited to, arrangements with joint marketers and service providers. While consumers and customers may not opt out of these information sharing arrangements, these arrangements must be disclosed in the privacy statements.

Introducing And Clearing Brokers

With regard to the information sharing arrangements between introducing brokers and clearing brokers, the regulation considers introducing brokers and clearing brokers as each having an individual relationship with consumers and customers. In other words, Regulation S-P recognizes that either the introducing broker or the clearing broker could share nonpublic consumer or customer financial information with third parties outside of the introducing/clearing relationship. The regulation will, however, permit the introducing brokers and clearing brokers to send one joint privacy notice to consumers and customers as long as the introducing and clearing brokers' privacy policies and notices are accurate for each institution.

Delivery Of Initial Privacy Notices

The delivery of the initial privacy notices to consumers and customers is another important aspect to Regulation S-P. For a consumer, the privacy notice must be delivered by broker/dealers before any nonpublic information is to be disclosed to third parties. For a customer, the privacy notice must be delivered by broker/dealers prior to the establishment of the customer relationship. Recognizing that many customer relationships with broker/dealers may be established through telephone calls, Regulation S-P will permit the initial privacy notices to be given as part of a Customer Agreement Form even if the form is sent out after the request for service by a consumer or customer. This may only be permitted when the sending of the notice prior to the establishment of a customer relationship "would substantially delay the consumer's transaction" and the customer agrees to receive the notice at a later time.

As Regulation S-P highlights the use of electronic communications and Web sites, the privacy policies, initial and annual notices, and optout notices may, under certain conditions, be delivered through e-mail and the Internet.

Small Firm Compliance

With regard to small firms, the SEC believes that compliance will be relatively simple. As stated in the SEC's release, since most small firms do not share nonpublic consumer financial information other than with service providers, the SEC believes that a simple set of model notices will assist small firms in their compliance. The SEC includes examples and model disclosure forms as part of the Federal Register release; however, unlike the federal banking regulators', NCUA's, and FTC's rules, the SEC will not permit the use of the examples and model forms as a safe harbor by firms.

Regulation S-P And Other Federal Agencies' Regulations

While Regulation S-P is substantially similar to the final regulations issued by the federal banking regulators, NCUA, and FTC, there are differences (e.g., the SEC's lack of a safe harbor for the use of the SEC's model forms). Firms that are affiliated with banks and/or other financial entities should pay particular attention to the differences between these regulations and adopt procedures concerning the release of consumer and customer financial information that ensure compliance with all applicable requirements.

GLB And State Law

GLB was not intended to alter or supersede any state law, and expressly permits states to adopt any statute, regulation, order, or interpretation that affords persons greater protection than is provided under GLB's privacy provisions.

Endnotes

¹ Public Law 106-102.

² Privacy of Consumer Financial Information (Regulation S-P), Exchange Act Release No. 42484 (March 2, 2000), 65 Fed. Reg. 12354 (March 8, 2000).

³ Exchange Act Release No. 42974 (June 22, 2000), 65 Fed. Reg. 40333 (June 29, 2000).

⁴ For the term "financial institution," the SEC uses the definition contained in the GLB law which is any institution that engages in financial activities as described in section 4(K) of the Bank Holding Company Act of 1956. For Regulation S-P, the term includes broker/dealers, investment advisers, investment companies, and other entities engaging in activities that are financial in nature or incidental to such financial activities.

⁵ Generally, references in Regulation S-P to "consumers" also apply to "customers."

SECURITIES AND EXCHANGE COMMISSION

00-66 Attachment

17 CFR Part 248

[Release Nos. 34-42974, IC-24543, IA-1883; File No. S7-6-00]

RIN 3235-AH90

Privacy of Consumer Financial Information (Regulation S-P)

AGENCY: Securities and Exchange Commission.

ACTION: Final rule.

SUMMARY: The Securities and Exchange Commission is adopting Regulation S-P, privacy rules promulgated under section 504 of the Gramm-Leach-Bliley Act. Section 504 requires the Commission and other federal agencies to adopt rules implementing notice requirements and restrictions on a financial institution's ability to disclose nonpublic personal information about consumers. Under the Gramm-Leach-Bliley Act, a financial institution must provide its customers with a notice of its privacy policies and practices, and must not disclose nonpublic personal information about a consumer to nonaffiliated third parties unless the institution provides certain information to the consumer and the consumer has not elected to opt out of the disclosure. The Act also requires the Commission to establish for financial institutions appropriate standards to protect customer information. The final rules implement these requirements of the Gramm-Leach-Bliley Act with respect to investment advisers registered with the Commission, brokers, dealers, and investment companies, which are the financial institutions subject to the Commission's jurisdiction under that Act.

DATES: Effective Date: This regulation is effective November 13, 2000.

Compliance Dates: Compliance will be mandatory as of July 1, 2001. Joint marketing and service agreements in effect as of July 1, 2000 must be brought into compliance with § section 248.13 of Regulation S-P by July 1, 2002.

FOR FURTHER INFORMATION CONTACT: For information regarding the rules as they relate to brokers or dealers, contact George Lavdas or Jerome Roche, Office of Chief Counsel, Division of Market Regulation, (202) 942-0073, or regarding the rules as they relate to investment companies or registered investment advisers, Penelope W. Saltzman or Hugh P. Lutz, Office of Regulatory Policy, (202) 942-0690, Division of Investment Management, Securities and Exchange Commission, 450 5th Street, NW., Washington, DC 20549.

SUPPLEMENTARY INFORMATION: The Securities and Exchange Commission (the "Commission") today is adopting new Regulation S-P, 17 CFR 248.1-248.30, under Title V of the Gramm-Leach-Bliley Act [Pub. L. No. 106-102, 113 Stat. 1338 (1999), to be codified at 15 U.S.C. 6801-6831], the Securities Exchange Act of 1934 [15 U.S.C. 78] ("Exchange Act"), the Investment Company Act of 1940 [15 U.S.C. 80a] ("Investment Company Act"), and the Investment Advisers Act of 1940 [15 U.S.C. 80b] ("Investment Advisers Act").

I. Background

Subtitle A of Title V of the Gramm-Leach-Bliley Act ("G-L-B Act" or the "Act"), captioned Disclosure of Nonpublic Personal Information ("Title V"), limits the instances in which a financial institution may disclose nonpublic personal information about a consumer to nonaffiliated third parties, and requires a financial institution to disclose to all of its customers the institution's privacy policies and practices with respect to information sharing with both affiliates and nonaffiliated third parties. Title V also requires the Office of the Comptroller of the Currency, Board of Governors of the Federal Reserve System, Federal Deposit Insurance Corporation, Office of Thrift Supervision (collectively, the "Banking Agencies"), Secretary of the Treasury, National Credit Union Administration, Federal Trade Commission (collectively with the Banking Agencies, the "Agencies"), and the Commission, after consulting with representatives of State insurance authorities designated by the National Association of Insurance Commissioners, to prescribe regulations necessary to carry out the purposes of Title V.¹

Commission representatives participated with representatives from the Agencies in drafting rules to implement Title V. As required by the G-L-B Act, the rules we are adopting today are, to the extent possible, consistent with and comparable to the rules adopted by the Agencies.² Regulation S-P contains rules of general applicability that are substantially similar to the rules adopted by the Agencies. The rules also contain examples that illustrate the application of the general rules. These examples differ from those used by the Agencies in order to provide more meaningful guidance to the financial institutions subject to the Commission's jurisdiction.

Title V also requires the Commission (and each of the Agencies) to establish appropriate standards for financial institutions subject to their jurisdiction to safeguard customer information and records. Regulation S-P includes requirements for investment advisers registered with the Commission ("registered advisers"), brokers, dealers (collectively, "broker-dealers"), and investment companies ("funds") to adopt appropriate policies and procedures that address safeguards to protect this information.³

¹ G-L-B Act § 504(a)(1).

² See G-L-B Act § 504(a). The Banking Agencies published a joint release adopting rules to implement Title V earlier this month. Privacy of Consumer Financial Information, 65 FR 35162 (June 1, 2000) ("Banking Agencies' Release"). The National Credit Union Administration approved its final rules on May 8, 2000 [Privacy of Consumer Financial Information; Requirements for Insurance, 65 FR 31722 (May 18, 2000)]. The Federal Trade Commission adopted its privacy rules on May 12, 2000 [Privacy of Consumer Financial Information, 65 FR 33646 (May 24, 2000)].

³ Under the G-L-B Act, investment advisers registered with the States are regulated by the Federal Trade Commission. See G-L-B Act § 505(a)(7).

II. Overview of Comments Received

On March 2, 2000, the Commission issued a notice of proposed rulemaking (the "proposal" or "proposed rules").⁴ The Commission received a total of 115 comments in response to the proposal.⁵ Of these, approximately 14 were from individuals, virtually all of whom encouraged the Commission to provide greater protection of individuals' financial privacy. Many individuals noted their concerns generally about the loss of privacy and the receipt of unwanted solicitations by marketers.⁶ Other commenters advocated that we extend privacy protections in a number of ways. These suggestions included requiring (i) financial institutions to provide consumers with access to information about them maintained by the institutions and the opportunity to correct errors, (ii) more detailed disclosures of the information collected and disclosed, and (iii) disclosures of a financial institution's privacy policies and practices earlier in the process of establishing a customer relationship.

The National Association of Insurance Commissioners ("NAIC") submitted a comment on behalf of the State insurance authorities that generally supported the Commission's proposed rules. The NAIC also proposed various measures to provide certain protections for consumers, such as specifying means to exercise the right to opt out of the disclosure of information. The NAIC further advised the Commission to clarify the boundary of federal and State jurisdiction over privacy regulations and ensure that the financial privacy rules under the Act are compatible with the privacy rules relating to medical information that are to be issued by the Secretary of the Department of Health and Human Services ("HHS") under the Health Insurance Portability and Accountability Act ("HIPAA") of 1996.⁷

We received approximately 20 letters from broker-dealers, funds, registered advisers, insured depository institutions, bank holding companies, and their representatives.⁸ These commenters suggested many changes to the proposed rules. The most common suggestions included: (i) Extending the effective date of the rules; (ii) amending the definition of "nonpublic personal information" to focus more clearly on what they believe is "financial" information; (iii) streamlining information required in the initial and annual disclosures; (iv) clarifying how one or more of the statutory exceptions operate; (v) revising or clarifying the definitions of "consumer" and "customer"; and (vi) adding flexibility to provide initial notices at some point other than "prior to" the time a customer relationship is established. We have modified the proposed rules in light of the comments received.⁹ These comments, and our responses to them, are discussed in the following section-by-section analysis.

⁴ Privacy of Consumer Financial Information (Regulation S-P), Exchange Act Release No. 42484 (Mar. 2, 2000) [65 FR 12354 (Mar. 8, 2000)] ("Proposing Release").

⁵ The Banking Agencies, FTC, and NCUA received a total of 8,126, 640, and 99 comments, respectively, in response to their proposed rules.

⁶ Commenters also requested that the Commission support legislation that the commenters believe would provide additional protections. In addition, the Commission received a comment letter from the Congressional Privacy Caucus, which encouraged the Commission to exercise its rulemaking authority to provide more protections than were proposed. The Chairman of the Commission also received two letters signed by several members of Congress, and a third letter from other commenters, which urged the Commission not to delay the compliance date of the final rules until July 1, 2001.

⁷See Standards for Individually Identifiable Health Information, 64 FR 59918 (Nov. 3, 1999) (as amended by 65 FR 427 (Jan. 5, 2000)).

⁸ Representatives of a wide variety of other interests, including the health care industry, retail merchants, insurance companies, credit bureaus, and higher education, also submitted comment letters.

⁹ We also have included a guide to assist brokerdealers, funds, and registered advisers in their efforts to comply with the privacy rules. See infra section VI.

III. Section-by-Section Analysis

The final Regulation presents the various sections in five subparts that consist of related sections. Related concepts are grouped together to make the rules easier to follow. A comparison table is included in section V to assist readers in locating provisions that appeared in the proposal. We also have added an Appendix to the final rules, setting out sample disclosures for broker-dealers, funds, and registered advisers to consider.

Section 248.1 Purpose and Scope

We are revising section 248.1, which identifies the purposes and scope of the rules. As stated in the proposal, the rule is intended to require a broker-dealer, fund, or registered adviser to provide notice to customers about its privacy policies and practices; to describe the conditions under which the institution may disclose nonpublic personal information about consumers to nonaffiliated third parties; and to provide a method for consumers to prevent the financial institution from disclosing that information to certain nonaffiliated third parties by "opting out" of that disclosure, subject to various exceptions as stated in the rules. Most of the comments received on this section focused on the scope of the rules. Several commenters suggested that the Commission clarify how the rules apply to insurance companies. Section 505 of the G-L-B Act sets out the Commission's enforcement authority with respect to broker-dealers, funds, and registered advisers. The section explicitly excludes "persons providing insurance" from the Commission's (and the Agencies') enforcement authority (and, by operation of section 504(a)(1) of the G-L-B Act, from the Commission's and the Agencies' rulemaking authority). We believe that the G-L-B Act relies on the States to enforce Title V with respect to any insurance activities conducted by broker-dealers, funds, or registered advisers. Consistent with this reading of the statute, the final rule excludes the provision of insurance by a broker-dealer, fund, or registered adviser from the scope of Regulation S-P. If the insurance product also is a security, however, any broker-dealer or fund that provides that security, or registered adviser that provides advice with respect to that security is subject to Regulation S-P.¹⁰ In addition, insurance company separate accounts that are "investment companies" under the Investment Company Act are subject to this part.¹¹

Several commenters stated that Regulation S-P should apply to foreign financial institutions that solicit business from individuals in the United States. As adopted, the requirements of Regulation S-P apply to any brokerdealer, fund, or investment adviser that is registered with the Commission, regardless of whether its consumers are U.S. persons or non-U.S. persons, and regardless of whether it conducts its activities through U.S. or non-U.S. offices or branches.¹² We also have decided not to apply Regulation S-P to any foreign (or "non-resident") brokerdealer or fund that is not registered with the Commission. Despite the broad reach of the U.S. federal securities laws,¹³ we believe it would be impractical to apply Regulation S-P to those foreign unregistered entities. If a foreign broker-dealer or fund conducts activities through U.S. interstate commerce in a manner that subjects it to the registration requirements of the U.S. securities laws, it is subject to those requirements and any other applicable protections to investors, such as antifraud protections. We do not believe that subjecting these unregistered entities to the obligation to provide the privacy and opt out notices under Regulation S-P would add to the protections provided to investors under the G-L-B Act. As noted above, however, if a foreign broker-dealer, fund, or investment adviser decides to register with the Commission, it would be required to comply fully with Regulation S-P.¹⁴

Several commenters suggested that the rule should not apply to entities that must comply with regulations proposed by HHS to implement the HIPAA.¹⁵ We do not believe that broker-dealers, funds, or registered advisers would be subject to any rules HHS has proposed under HIPAA regarding protected health information. We recognize, however, that there could be areas of overlap between the rules adopted by HHS under HIPAA and the privacy rules. After HHS publishes its final rules, we will consult with HHS to avoid the imposition of duplicative or inconsistent requirements.

Section 248.2 Rule of Construction

We are revising section 248.2, which sets out a rule of construction intended to clarify the effect of the examples used in the rules, to include the sample clauses in the Appendix to the rules. As noted in the Proposing Release, the examples (and the sample clauses) are not intended to be exhaustive; rather, they are intended to provide guidance about how the rules would apply in specific situations.¹⁶

Commenters generally agreed that examples are helpful in clarifying how the rules will work in specific circumstances. Some commenters also suggested that we include more examples, and provide examples of model disclosures. A few commenters suggested that the regulation state that a financial institution is not obligated to comply with an example but has the latitude to comply with the general rules in other ways. Other commenters also requested that we treat the examples as safe harbors or establish a presumption that compliance with the examples constitutes compliance with the rules. Others stated that the examples ought to be identical in each privacy regulation adopted by the Commission and the Agencies.

We agree that more examples would be helpful, and have included additional examples in appropriate places throughout the rules. We also have provided sample clauses in the Appendix to assist broker-dealers, funds, and registered advisers in drafting privacy notices. The sample clauses are provided to illustrate the level of detail we believe is appropriate. We caution financial institutions against relying on the sample disclosures without determining the relevance or appropriateness of the disclosure for their operations. We have used statutory terms, such as "nonpublic personal information" and "nonaffiliated third parties," in the sample clauses to convey generally the subject of the clauses. However, a financial institution that uses these terms must provide sufficient information to enable consumers to understand what these terms mean in the context of the institution's notices.¹⁷

We have not added a statement in the final rule regarding a financial institution's ability to comply with the rules in ways other than as suggested in the examples. The rule states that the facts and circumstances of each individual situation will determine whether compliance with an example constitutes compliance with the applicable rule.¹⁸ The examples and the sample clauses do not provide a safe harbor.¹⁹ Nevertheless, we believe that, when read together, the rule of construction, examples, and sample clauses provide broker-dealers, funds, and registered advisers sufficient guidance on ways to comply with the rules as well as sufficient flexibility to comply with the regulation in ways appropriate for the institution.

Section 248.3 Definitions

(a) Affiliate. We are adopting the definition of "affiliate" as proposed. The rule incorporates the definition of "affiliate" in the G-L-B Act.²⁰ An affiliation exists when one company "controls" (as defined in section 248.3(g) below), is controlled by, or is under common control with another company. The definition includes both financial institutions and entities that are not financial institutions. The proposed rule also provided that a broker-dealer, fund, or registered adviser would be considered an affiliate of another company if the other company is regulated under Title V by one of the Agencies, and under that Agency's rules, the other entity would be affiliated with the broker-dealer, fund, or registered adviser. Few commenters addressed this definition, and none disagreed with it.

(b) Broker. We are adopting the definition of "broker" as proposed. The definition incorporates the meaning of "broker" in the Exchange Act. One commenter suggested that the definition exclude foreign banks and savings institutions because they will be subject to the privacy rules of the Banking Agencies.²¹ We disagree, and the rule does not include this exception.²²

Brokers registered with the Commission include foreign entities that may not be subject to the Banking Agencies' privacy rules, which do not extend to foreign entities that do not have offices within the United States.²³

(c) Clear and conspicuous. We are revising the definition of "clear and conspicuous" in response to issues raised by commenters. The proposed rules required various notices to be "clear and conspicuous," and defined the term to mean that the notice must be reasonably understandable and designed to call attention to the nature and significance of the information contained in the notice. The proposal did not mandate the use of any particular technique for making the notices clear and conspicuous, but provided examples of how a notice may be made clear and conspicuous. As noted in the Proposing Release, each financial institution would retain the flexibility to decide for itself how best to comply with this requirement.²⁴

We received a large number of comments on the proposed definition. Several commenters favored adopting the definition as proposed, with some advocating that the final rule include a requirement that disclosures be on a separate piece of paper in order to ensure that they will be conspicuous. Others stated that the definition was unnecessary, given the experience financial institutions have in complying with requirements that disclosures mandated by other laws be clear and conspicuous. Several commenters stated that the definition is inconsistent with requirements in other consumer protection regulations such as Regulation Z ²⁵ and the Truth in Savings regulation,²⁶ which require only that a disclosure be reasonably understandable.²⁷ A few commenters questioned how the requirement would work in a document that contains several disclosures that are required to be clear and conspicuous, while others raised questions about how a disclosure may be clear and conspicuous on an Internet web site.

New standard for "clear and conspicuous." The proposed definition developed the concept of "clear and conspicuous." The phrase "designed to call attention to the nature and significance of the information contained" was intended to provide meaning to the term "conspicuous." We believe that this standard will result in notices to consumers that communicate effectively the information consumers need in order to make an informed choice about the privacy of their information, including whether to open a brokerage account, purchase fund shares, or enter into an advisory contract with an adviser.

Examples of "clear and conspicuous." We recognize that many of the examples are imprecise. We believe, however, that more prescriptive examples, while perhaps easier to conform to, likely would result in requirements that would be inappropriate in a given circumstance. To avoid this result, the examples provide generally applicable guidance about ways in which a brokerdealer, fund, or registered adviser may make a disclosure clear and conspicuous. We note that the examples do not mandate how to make a disclosure clear and conspicuous. A financial institution must decide for itself how best to comply with the general rule, and may use techniques not listed in the examples. To address concerns about the imprecision of the examples, we have incorporated several of the commenters' suggestions in the final rule for ways to make the guidance more helpful.²⁸

Combination of several notices. Commenters stated that a document may combine different types of disclosures that are subject to specific disclosure requirements under different regulations. For example, a fund that includes a privacy notice in its prospectus would have to make the privacy notice clear and conspicuous, and would have to prepare the prospectus according to certain standards under the Securities Act of 1933.²⁹ The final rule provides an example of how a financial institution may make privacy disclosures conspicuous, including privacy disclosures that are combined in a document with other information.³⁰ In order to avoid the potential conflicts between two different rules requiring different sets of disclosures that are subject to different standards, the final rule does not mandate precise specifications for presenting various disclosures.

Disclosures on Internet web pages. Several commenters requested guidance on how they may clearly and conspicuously disclose privacy-related information on their Internet sites. Disclosures over the Internet may present some issues that will not arise in paper-based disclosures. Consumers may view various web pages within a financial institution's web site in a different order each time they access the site, aided by hypertext links. Depending on the hardware and software used to access the Internet, some web pages may require consumers to scroll down to view the entire page. To address these issues, the example concerning Internet disclosures states that broker-dealers, funds, and registered advisers may comply with the rule if they use text or visual cues to encourage scrolling down the page if necessary to view the entire notice and ensure that other elements on the web site (such as text, graphics, hypertext links, or sound) do not distract attention from the notice.³¹ The examples also note that the institution should place a notice or a conspicuous link on a screen that consumers frequently access, such as a page on which consumers conduct transactions.

There is a range of approaches a broker-dealer, fund, or registered adviser could use based on current technology. For example, a broker-dealer could use a dialog box that pops up to provide the disclosure before a consumer provides information to a financial institution. Another approach would be a simple, clearly labeled graphic located near the top of the page or in close proximity to the financial institution's logo, directing the customer, through a hypertext link or hotlink, to the privacy disclosures on a separate web page.

(d) Collect. We are revising the definition of "collect" to clarify the scope of the term.³² The G-L-B Act requires a financial institution to disclose in its initial and annual notices the categories of nonpublic personal information that the institution collects. The proposal defined "collect" to mean obtaining any information that is organized or retrievable on a personally identifiable basis, irrespective of the source of the underlying information. This definition was included to provide guidance about the information that a broker-dealer, fund, or registered adviser must include in its notices and to clarify that the obligations arise regardless of whether the institution obtains the information from a consumer or from some other source.

Commenters suggested that the final rule treat information that is not organized and retrievable in an automated fashion as not "collected." We disagree that information should not be deemed to be collected simply because it is not retrievable in an automated fashion. We believe that the method of retrieval is irrelevant to whether information should be protected under the rule. We agree, however, that the scope of the regulation should be refined, and have changed the definition of "collect" by using language from the Privacy Act of 1974.³³

Other commenters requested that the rule clarify that information that a broker-dealer, fund, or registered adviser receives but then immediately passes along without retaining a copy, is not "collected." We believe that merely receiving information without retaining it would not be "collecting" the information. The final rule reflects this by stating that the information must be organized or retrievable by the financial institution.

(f) Company. We received no substantive comments on the proposed definition of "company" and are adopting it as proposed.³⁴

(g) Consumer. We are adopting as proposed the definition of "consumer," and are revising the examples under the definition in response to issues raised by commenters. The G-L-B Act distinguishes "consumers" from "customers" for purposes of the statute's notice requirements. A brokerdealer, fund, or registered adviser is required to give a "consumer" the notices required under Title V only if the institution intends to disclose nonpublic personal information about the consumer to a nonaffiliated third party for purposes other than as permitted by section 502(e) of the statute.³⁵ We received a large number of comments on this proposed definition that raised questions about how the definition would apply in a variety of situations.

Evaluation of a request for a financial product or service. The proposal defined "consumer" to mean an individual (and his or her legal representative) who obtains, from a financial institution, financial products or services that are to be used primarily for personal, family, or household purposes.³⁶ Because "financial product or service" includes a financial institution's evaluation of an application or request to obtain a financial product or service, a person becomes a consumer even if the application or request is denied or withdrawn.³⁷ The examples for the definition of "consumer" clarify that a consumer includes an individual who provides nonpublic personal information when seeking to obtain brokerage or investment advisory services. For example, an investor who provides nonpublic personal information to several registered advisers (whether orally or in writing) in seeking financial advisory services would be a consumer of each registered adviser, even if the investor does not enter into an advisory contract with any of the advisers.

Many commenters disagreed that someone should be deemed a consumer of a financial institution by virtue of the institution evaluating nonpublic personal information provided by the individual in an application or otherwise. These commenters maintained that the individual has not obtained a financial product or service, as is required by the G-L-B Act. We believe, however, that a "financial product or service" includes the evaluation of information an individual provides to the financial institution in order to obtain some other financial product or service. Broker-dealers, funds, and registered advisers frequently provide a range of services in connection with the delivery of a financial product, including the evaluation of information provided by an individual. The evaluation may be the sole financial product or service delivered, or one of several services provided in connection with establishing a customer relationship. For example, an investor who seeks to invest in certain investment products, such as stock options, must provide a broker-dealer or registered adviser with nonpublic personal information in connection with the request. Based on this nonpublic personal information, the broker-dealer or registered adviser may open an account for the investor, but deny his or her request to invest in options. Whether the evaluation is the sole product or service or one of several, the institution's evaluation of the individual's information is a separate financial product or service.

The proposed definition of "consumer" also is consistent with one of the primary purposes of Title V: To enable an individual to restrict a financial institution from sharing nonpublic personal information about the individual with a nonaffiliated third party. The information an individual provides to a financial institution before a customer relationship is established is likely to contain precisely the types of information that the statute is designed to protect. This information is no less deserving of protection simply because an application is denied or withdrawn. For these reasons, we have retained in the examples in the definition of "consumer" an individual who provides nonpublic personal information to a broker-dealer or investment adviser in connection with obtaining brokerage or investment advisory services.³⁸

Loan sales. Several commenters requested clarification of circumstances in which a borrower becomes a consumer. The final rule provides that a person will be a consumer of any entity that holds ownership or servicing rights to an individual's loan.³⁹ We believe that financial institutions that own or service a loan provide a financial product or service to the individual borrower in question. In some cases, the product or service is the funding of the loan, directly or indirectly. In other cases, the product or service is the processing of payments, sending account-related notices, responding to consumer questions, and complaints about the handling of the account. The final rule defines "consumer" in a way that covers individuals receiving financial products or services in each of these situations.

Agents of financial institutions. Several commenters maintained that an individual should not be considered to be a consumer of an entity that is acting as agent for a financial institution.⁴⁰ These commenters noted that the financial institution that hires the agent is responsible for that agent's conduct in carrying out the agency responsibilities. We agree and continue to believe that the broker-dealer, fund, or registered adviser has a consumer relationship, even if the institution uses agents to help it deliver its products or services. For example, fund consumers would not become consumers of the fund's transfer agent that services the fund's customer accounts. The final rule retains the examples addressing clearing agents and provides a more general example to illustrate this principle.⁴¹

Legal representative. We also agree with the suggestion by several commenters that the definition of "consumer" should clarify that a financial institution may satisfy the obligations stemming from a consumer relationship by dealing either with the individual who obtains a financial product or service from a financial institution or that individual's legal representative. We do not intend that the rule require a financial institution to send opt out and initial notices to both the individual and his or her legal representatives, and have amended the final rule accordingly.⁴²

Trusts. We received several comments concerning whether an individual who obtains financial services in connection with trusts is a consumer or customer of a financial institution. Several commenters urged the Commission generally to exempt a financial institution from the requirements of the rules when it acts as a fiduciary or, in the alternative, to clarify the categories of individuals who are considered to be customers. Commenters proposed, for example, that individuals who are beneficiaries with current interests should be identified as customers, whereas individuals who are only contingent beneficiaries should not be customers. Other commenters stated that when the financial institution serves as trustee of a trust, neither the grantor nor beneficiary is a consumer or customer under the rules. In these commenters' view, the trust itself is the institution's "customer," and therefore the rules should not apply to a financial institution when it acts as trustee. These commenters also stated that when a financial institution is a trustee, it serves as a fiduciary and is subject to other obligations to protect the confidentiality of the beneficiaries' information that are more stringent than those under the provisions in the G-L-B Act. Similarly, these and other commenters claimed that an individual who is a participant in an employee benefit plan administered or advised by a financial institution does not qualify as a consumer or customer. They contended that plan participants have no direct relationship with the financial institution and, in any event, the financial institution is authorized to use information that would be covered under the G-L-B Act only in accordance with the directions of the plan sponsor. The commenters concluded, therefore, that the regulations should specifically exclude individuals who are participants in an employee benefit plan from the definition of customer.

We believe that the definition of "consumer" in the G-L-B Act does not squarely resolve whether the beneficiary of a trust is a consumer of the financial institution that is the trustee. We agree with the commenters who concluded that, when the financial institution serves as trustee of a trust, neither the grantor nor beneficiary is a consumer or customer under the rules. Instead, the trust itself is the entity that obtains the financial services, and the rules do not apply because the trust is not an individual.⁴³ We note that a financial institution that is a trustee assumes obligations as a fiduciary, including the duty to protect the confidentiality of the beneficiaries' information, that are consistent with the purposes of the G-L-B Act and enforceable under State law. Accordingly, we have excluded an individual who is a beneficiary of a trust or a plan participant in an employee benefit plan, from the definitions of "consumer" and "customer." Nevertheless, we believe that an individual who selects a financial institution to be a custodian of securities or assets in an individual retirement account or individual retirement arrangement ("IRA") is a "consumer" under the G-L-B Act. We have included examples in the rule that appropriately illustrate this interpretation of the G-L-B Act.43

Requirements arising from consumer relationship. While the proposed and final rules define "consumer" broadly, we note that this definition will not result in any additional burden to a broker-dealer, fund, or registered adviser if (i) no customer relationship is established and (ii) the institution does not intend to disclose nonpublic personal information about the consumer to nonaffiliated third parties. Under the approach taken in the final rule, a broker-dealer, fund, or registered adviser is under no obligation to provide a consumer who is not a customer with any privacy disclosures unless it intends to disclose the consumer's nonpublic personal information to nonaffiliated third parties outside the exceptions in sections 248.14 and 248.15. The institution may disclose a consumer's nonpublic personal information to nonaffiliated third parties under the final rule, if it delivers the requisite notices and the consumer does not opt out. Thus, the rule allows a financial institution to avoid all of the rule's requirements for consumers who are not customers if the institution chooses not to share information about the consumers with nonaffiliated third parties. Conversely, if a broker-dealer, fund, or registered adviser chooses to share consumers' nonpublic personal information with nonaffiliated third parties, the financial institution is free to do so, provided it notifies consumers about the sharing and affords them a reasonable opportunity to opt out. In this way, the rule attempts to strike a balance between protecting an individual's nonpublic personal information and minimizing the burden on a financial institution.

(h) Consumer reporting agency. We received no comments on the proposed definition of "consumer reporting agency," and we are adopting it as proposed.⁴⁵ The definition incorporates the definition of "consumer reporting agency" in the Fair Credit Reporting Act.⁴⁶

(i) Control. We are adopting the definition of "control" as proposed. "Control" means the power to exercise a controlling influence over the management or policies of a company whether through ownership of securities, by contract, or otherwise. In addition, ownership of more than 25 percent of a company's voting securities creates a presumption of control of the company. This definition is used to determine when companies are affiliated.⁴⁷ Under the definition, companies are considered to be affiliates regardless of whether the control is by a company or individual.

Some commenters suggested that the rule adopt the definition of control used in Form BD to determine when an entity is a "control affiliate." ⁴⁸ Another commenter suggested a test that focuses solely on percent of stock owned in a company in order to avoid the uncertainties from a "control-in-fact" test. One commenter suggested alternative definitions based on (i) the ability to control the use of information in a company in which an ownership interest exists or (ii) a bright line 10 percent ownership test that also provided for aggregating the interests of credit unions and their wholly owned subsidiaries.

We believe that a test based only on stock ownership is unlikely to be flexible enough to address all situations in which companies should be considered to be affiliated. In addition, the proposed definition of control is consistent with the definition in Form BD, except that the definition in Form BD creates a presumption of control in broader circumstances.⁴⁹ The rule limits the presumption of control to ownership of more than 25 percent of the voting securities, consistent with the definition of control in the Investment Company Act.⁵⁰ This definition does not prevent a finding of control-in-fact in the circumstances that create a presumption of control under the definition in Form BD.

(j), (k) Customer, Customer relationship. We received a large number of comments on the definition of "customer" and "customer relationship." A "customer" is a consumer who has a "customer relationship" with a financial institution, and a "customer relationship" is a continuing relationship between a consumer and a broker-dealer, fund, or registered adviser under which the institution provides a financial product or service that is to be used by the consumer primarily for personal, family, or household purposes. As noted in the proposal, a one-time transaction may be sufficient to establish a customer relationship, depending on the nature of the transaction. A consumer would not become a customer simply by engaging in an isolated transaction that by itself would be insufficient to establish a customer relationship, such as when an individual opens a brokerage account solely for the purpose of liquidating or purchasing securities as an accommodation, i.e., on a one-time basis, without the expectation of engaging in other transactions.

Point at which a consumer becomes a customer. Commenters criticized the vagueness of the standard for differentiating consumers from customers. Several suggested that the distinction should be based on when a consumer and financial institution enter into a written contract for a financial product or service.

We recognize that the distinction between consumers and customers will, in some instances, require a financial institution to make a judgment about whether a customer relationship is established. When an individual engages in a transaction and is not likely to expect further communication about that transaction from the financial institution (such as brokerage services as an accommodation to buy or liquidate securities), the individual will not have established a customer relationship as a result of that transaction. In other situations when a consumer typically would receive some measure of continued service following, or in connection with, a transaction (such as when a consumer opens a brokerage account, is the record owner of fund shares, or obtains investment advice), a customer relationship is established. We believe that the distinction set out in the proposed rule, as further clarified by the examples in the final rule of when a customer relationship is and is not established, provides a sufficiently clear line while retaining flexibility to address less clearcut situations on a case-by-case basis.

Use of "isolated transaction" test. The final rule does not define the distinction between consumer and customer based solely on whether the transaction is an isolated event. We used this concept in an example in the proposed rule to illustrate one of the factors that may determine whether a relationship is of a continuing nature. Several commenters suggested that this approach was insufficiently precise to serve as a workable distinction between consumers and customers. We agree that the test may not be useful in all situations, but believe that it will help clarify the status of relationships in certain circumstances. Accordingly, the final rule retains the following example of an "isolated transaction": providing brokerage services as an accommodation to buy or liquidate securities without the expectation of engaging in further transactions does not establish a customer relationship.⁵¹

Purchase of insurance. Some commenters suggested that, in the context of financial institutions that engage in the sale of insurance and that are regulated by the Commission, the customer should be the policyholder and not the beneficiary. As discussed above, Regulation S-P does not apply to the provision of insurance by brokerdealers, funds, or registered advisers. A variable annuity or variable life insurance contract, however, is both an insurance product and a security.⁵² We agree with the commenters, and the final rule includes an example of purchasing a variable annuity as one situation in which a customer relationship is formed.⁵³ In this case, the person obtaining a financial product or service from the financial institution is the person purchasing the annuity.⁵⁴

Sales of loans. As noted above, several commenters raised questions about loan sales. They stated that when a financial institution sells the servicing rights for a loan to another financial institution, the borrower should not be considered a customer of both institutions.

Commenters suggested that the entity with which the borrower communicates about the loan (i.e., the servicer) could have the customer relationship with the borrower, and that the other institutions could have a consumer relationship with the borrower.

We believe that it is appropriate to consider that a loan transaction gives rise to only one customer relationship and that this customer relationship may be transferred in connection with a sale of part or all of the loan. In this way, the borrower will not be inundated by privacy notices, many of which might be from secondary market purchasers that the borrower did not know had any connection to his or her loan. We note, however, that a borrower will remain a consumer of the institution that transfers the servicing rights, as well as a consumer of any other institution that holds an interest in the loan.

Under the final rules, therefore, a financial institution will be considered to have established a customer relationship with any individual to whom it makes a loan.⁵⁵ If the institution transfers the servicing rights of that loan to another institution, the second institution will establish a customer relationship with the individual, and the first institution's customer relationship will end (if the relationship is based solely on the loan).⁵⁶ If the originating lender sells the loan but continues to service the loan, it will continue to have a customer relationship with the borrower, and the purchaser will have a consumer relationship with the borrower.⁵⁷ For example, a broker-dealer who purchases a loan, but not the servicing rights to the loan, will have a consumer relationship, but not a customer relationship, with the borrower.⁵⁸

Fund shares purchased through an intermediary. Several commenters suggested that an individual who is the record owner of fund shares should not be a fund's "customer" if the fund is limited, under its contract with the intermediary who sold the shares, to servicing the investor's account. The commenters argue that these investors would be confused by receiving privacy notices from the fund. We proposed a "bright line" example of record ownership to establish the customer relationship because the fund clearly has nonpublic personal information about its record owners that is personally identifiable. We do not believe that an investor who receives account statements and other information from a fund that services the investor's account will be confused by receiving notices regarding the fund's privacy policies and practices. Moreover, an investor is unlikely to know whether a fund is contractually limited in its use of the investor's nonpublic personal information or whether those contract terms may change. For these reasons, we are adopting the proposed example that record owners of fund shares are the fund's customers.⁵⁹

Fund complex. One commenter suggested that a customer of a fund should be considered a customer of the fund complex, which may include the fund's primary investment adviser, or that a fund customer, at least in some cases, should also be considered a customer of the fund's primary investment adviser. We noted in the Proposing Release that the record owner of fund shares has a customer relationship with both the fund and the principal underwriter (which is a broker-dealer) that sells the shares.⁶⁰ The customer relationship with the broker-dealer arises because the investor has an account with the broker-dealer, who provides financial services directly to the investor. By contrast, an investment adviser to a fund does not generally have an ongoing account relationship with each fund shareholder. Instead, it serves the fund shareholders indirectly through the portfolio management services it provides to the fund.

We recognize that the definition of "customer" may have disparate effects on the ability of some investment advisers to receive nonpublic personal information about fund investors. For example, if the underwriter of a fund is affiliated with the fund's investment adviser, the underwriter can share nonpublic personal information about its customers with the adviser. By contrast, if the underwriter is not affiliated with the fund's investment adviser, the underwriter can share this type of information only under an exception in section 248.13, 248.14, or 248.15, and the adviser's ability to reuse the information would be limited to the purpose for which it received the information. These limitations result from the language of the G-L-B Act, which defines affiliation in terms of "control," and we are unwilling to modify the definition of "customer relationship" to alter the effect of that definition.⁶¹ For these reasons, we believe that, in the absence of an advisory contract with the investor, a fund's primary investment adviser does not have a customer relationship with the fund's customers.⁶²

Transferred accounts. One commenter requested clarification about whether an investor becomes a consumer of a broker-dealer when the consumer's account is transferred to the brokerdealer. An individual who has an account with a broker-dealer or a contract with a registered adviser has established a customer relationship with that broker-dealer or adviser. Thus, the investor is a customer of that brokerdealer or registered adviser, regardless of whether the account was transferred at the customer's request or as the result of a merger, acquisition, or assignment. Accordingly, the final rule includes an example that an individual is a customer of a broker-dealer or registered adviser if the individual's account is transferred to the broker-dealer or adviser.⁶³

Trusts. The final rule adds an example to clarify that an individual will be deemed to establish a customer relationship when a broker-dealer, fund, or registered adviser acts as a custodian for securities or assets in an IRA.⁶⁴ This example is consistent with the explanation set out above in the discussion of "consumer" concerning trusts.⁶⁵

(l) Dealer. We received no comments on the proposed definition of "dealer" and are adopting it as proposed. The definition incorporates the definition of dealer in the Exchange Act.⁶⁶

(m) Federal functional regulator. We are defining the term "federal functional regulator" in place of "government regulator." The proposal sought comment on a definition of "government regulator" which included each of the Agencies, the Commission, and State insurance authorities under the circumstances identified in the definition. This term was used in the exception in proposed section 248.15(a)(4) for disclosures to law enforcement agencies, "including government regulators."

For purposes of the privacy rules, this term is relevant in determining when an entity is an affiliate and when a brokerdealer, fund, or registered adviser may disclose information to a law enforcement agency.⁶⁷ The exception for disclosure as stated in the G-L-B Act uses the term "Federal functional regulator," ⁶⁸ which is defined in the statute at section 509(2) and includes the Secretary of the Treasury for purposes of the exception permitting disclosures to law enforcement agencies. We have decided that it is appropriate to use the term "federal functional regulator" instead of "government regulator."

(n) Financial institution. We are adopting the definition of "financial institution" as proposed. The proposal defined "financial institution" as any institution the business of which is engaging in activities that are financial in nature, or incidental to such financial activities, as described in section 4(k) of the Bank Holding Company Act of 1956.⁶⁹ The G-L-B Act also defines "financial institution," and the proposal excepted from the definition those entities the G-L-B Act also excepts.⁷⁰

Commenters suggested that the final rule include additional exceptions from the definition, such as for securitization trusts, debt buyers, and credit bureaus. We have not included these exceptions in the final rule. We believe it is inappropriate to exclude many of the activities suggested by commenters because the objective of the suggested exclusions can be achieved in other ways. Even if an entity is a financial institution as that term is used in the G- L-B Act, it will not have any disclosure responsibilities under the Act or this rule if it does not provide a financial product or service to a consumer. In most of the situations posited by the commenters, the entity in question will not meet that test and therefore will fall outside the scope of the rules with respect to privacy disclosures.⁷¹

(o) Financial product or service. We are adopting the definition of "financial product or service" as proposed. The proposal defined the term as a product or service that a broker-dealer, fund, or registered adviser could offer by engaging in an activity that is financial in nature, or incidental to such a financial activity, under section 4(k) of the Bank Holding Company Act. An activity that is complementary to a financial activity, as described in section 4(k), was not included in the proposed definition of "financial product or service." The proposal's definition included the broker-dealer, fund, or registered adviser's evaluation of nonpublic personal information collected in connection with a request by a consumer for a financial product or service even if the request ultimately is rejected or withdrawn.⁷² It also included the distribution of information about a consumer for the purpose of assisting the consumer in obtaining a financial product or service.

Several commenters criticized the proposed definition and suggested that the evaluation of application information should not be considered a financial product or service. For the reasons discussed above regarding the definition of "consumer," we continue to believe that it is appropriate to retain evaluation or brokerage of information as within the scope of financial products or services covered by the rules.

(q) Investment adviser. We received no comments on the proposed definition of "investment adviser" and are adopting it as proposed. The definition incorporates the definition of "investment adviser" under the Investment Advisers Act.⁷³

(r) Investment company. We received no substantive comments on the proposed definition of "investment company" and are adopting it as proposed. The definition incorporates the definition of "investment company" under the Investment Company Act, whether or not the company is registered with the Commission.⁷⁴

(s) Nonaffiliated third party. We are adopting the definition of nonaffiliated third party as proposed. The proposal defined the term as any "person" (including natural persons as well as corporate entities) except (i) an affiliate of a financial institution and (ii) a joint employee of a financial institution and a third party. The proposal clarified the circumstances under which a company that is controlled by a broker-dealer, fund, or registered adviser through that institution's merchant banking activities or insurance company activities would be a "nonaffiliated third party" of the broker-dealer, fund, or registered adviser.

We received very few comments in response to the proposed definition. One commenter requested that the final rule state that a disclosure of information to someone who is serving as a joint employee of two financial institutions should be deemed to have been disclosed to both financial institutions. We disagree with this result. Instead, we believe it is appropriate to deem the information to have been given to the financial institution that is providing the financial product or service in question. Thus, for example, if an employee of a bank is also an employee of a brokerage firm, information that employee receives in connection with a securities transaction conducted with the brokerage firm would be considered as received by the brokerage firm.

(t) Nonpublic personal information. We are revising the definition of "nonpublic personal information." Section 509(4) of the G-L-B Act defines the term to mean "personally identifiable financial information" that is provided by a consumer to a financial institution, results from any transaction with the consumer or any service performed for the consumer, or is otherwise obtained by the financial institution. The term also includes any "list, description, or other grouping of consumers (and publicly available information pertaining to them) that is derived using any nonpublic personal information that is not publicly available information." The G-L-B Act excludes publicly available information (unless provided as part of the list, description, or other grouping described above), as well as any list, description, or other grouping of consumers (and publicly available information pertaining to them) that is derived without using nonpublic personal information. The statute does not define either "personally identifiable financial information" or "publicly available information."

The proposed rules implemented the definition of "nonpublic personal information" under the G-L-B Act by restating the categories of information described above. The proposed rules treated information as publicly available if a broker-dealer, fund, or registered adviser could obtain it from a public source. We also asked for comment on an approach that would have deemed information as "publicly available" only if a financial institution actually obtained it from a public source ("alternative approach").⁷⁵ Most commenters supported the proposed approach to publicly available information. They noted that the proposed rule was consistent with the Act and would be far less burdensome on financial institutions. They also stated that any requirement that the information actually be obtained from a public source would impose a needless burden on financial institutions (by requiring, for instance, that a financial institution "tag" information it obtained from public records) and is not required by the Act. Other commenters advocated the alternative approach. They argued that the alternative approach would provide the greatest protection for consumers by treating any information the consumer gives to a financial institution to obtain a financial product or service as nonpublic personal information. This protection would be lost only if a financial institution actually obtained the information from a public source. These commenters also preferred the brightline distinction drawn by the alternative approach.

The final rule adopts an approach that we believe incorporates the benefits of both alternatives. As under the proposed rule, in the final rule information will be deemed to be "publicly available" and therefore excluded from the definition of "nonpublic personal information" if a broker-dealer, fund, or registered adviser reasonably believes that the information is lawfully made available to the general public from one of the three categories of sources listed in the rule.⁷⁶ The examples provided in the rule clarify when a broker-dealer, fund, or registered adviser has a reasonable belief that information is lawfully made available to the general public. For example, an institution would have a reasonable belief if (i) the institution has confirmed, or the consumer has represented, that the information is publicly available from a public source, or (ii) the institution has taken steps to submit the information, in accordance with its internal procedures and policies and with applicable law, to a keeper of federal, State, or local government records who is required by law to make the information publicly available.⁷⁷ The examples also state that a brokerdealer, fund, or registered adviser would have a reasonable belief that a telephone number is publicly available if the institution located the number in a telephone book or if the consumer told the institution that the number is not unlisted.⁷⁸ Moreover, the examples make clear that an institution may not assume information about a particular consumer is publicly available simply because that type of information is normally provided to a government record keeper and made available to the public by the record keeper, because the consumer may have the ability to keep that information non public or to screen his or her identity.

The approach of the final rule is based on the underlying principle that a consumer in many circumstances can control the public availability or identification of his or her information and that a financial institution therefore should not assume that the information about that customer is in fact publicly available. Thus, even though a lender typically enters a mortgage in public records in order to protect its security interest, when a borrower can maintain the privacy of his or her personal information by owning the property and obtaining the loan through a separate legal entity, the customer's name would not appear in the public record. In the case of a telephone number, a person may request that his or her number be unlisted. Thus, in evaluating whether it is reasonable to believe that information is publicly available, a financial institution must determine whether the consumer has kept the information or his or her identity from being a matter of public record.⁷⁹

To implement the complex definition of "nonpublic personal information" that is provided in the statute, the final rule adopts a definition that consists, generally speaking, of (i) personally identifiable financial information, plus (ii) a consumer list or description or grouping of consumers (and publicly available information pertaining to the consumers) that is derived using any personally identifiable financial information that is not publicly available information. From that body of information, the final rule excludes publicly available information (except as noted above or if the information is disclosed in a manner that indicates that the individual is the institution's consumer) and any consumer list that is derived without using personally identifiable financial information that is not publicly available information.⁸⁰ Examples illustrate how this definition applies in the context of consumer lists.⁸¹

(u) Personally identifiable financial information. We are adopting the definition of "personally identifiable financial information" substantially as proposed. The proposed rule defined the term to include (i) information that a consumer provides a broker-dealer, fund, or registered adviser in order to obtain a financial product or service, (ii) information resulting from any transaction between the consumer and a broker-dealer, fund, or registered adviser involving a financial product or service, and (iii) information about a consumer that a broker-dealer, fund, or registered adviser otherwise obtains in connection with providing a financial product or service to the consumer. The proposed rule also treated the fact that someone is a consumer of a brokerdealer, fund, or registered adviser as personally identifiable financial information. In essence, the proposed rules treated any personally identifiable information as "financial" if a brokerdealer, fund, or registered adviser obtained the information in connection with providing a financial product or service to a consumer. We noted in the Proposing Release that this interpretation may result in certain information being covered by the rules that may not commonly be considered intrinsically financial, such as health status.⁸²

We received a large number of comments in response to the definition of "personally identifiable financial information." Many commenters objected to including in the term certain identifying information that they did not view as "financial," such as name, address, and telephone number. Many commenters argued that "personally identifiable financial information" should not include the fact that someone is a customer of a financial institution. These commenters noted that many customer relationships are matters of public record (such as would be the case, for instance, any time a transaction results in the recording of a security interest) while other customer relationships are matters of public knowledge (because consumers frequently disclose the relationships by writing checks, using credit cards, and so on). Many commenters stated that aggregate data about a financial institution's customers that lack personal identifiers should not be considered personally identifiable financial information.

Treatment of identifying information as financial. We continue to believe that it is appropriate to treat any information as "financial" information if a financial institution obtains it in order to provide a financial product or service. We also believe this approach is consistent with the G-L-B Act. Although the statute does not define the term "financial," it does include a broad definition of "financial institution" used in the G-L- B Act, which encompasses a large number of entities (such as travel agencies, insurance companies, and data processors) that engage in activities not traditionally considered financial. As a consequence of that definition, the range of information that has a bearing on the terms and availability of a financial product or service or that a financial institution uses in connection with providing a financial product or service is extremely broad and may include, for instance, medical information and other types of information that might not commonly be thought of as financial. It includes information a broker-dealer, fund, or registered adviser requests from the consumer, obtains from a transaction involving a financial product or service with the consumer, or otherwise obtains in connection with providing a financial product or service to a consumer. Thus, the information included in the definition of "financial" is information the broker-dealer, fund, or registered adviser has determined is relevant to providing a financial product or service.

We are sensitive to the concern expressed by several commenters about the need for ready access to identifying information to locate individuals who are attempting to evade their financial obligations. These commenters suggested that names, addresses, and telephone numbers should not be treated as financial information. We believe, however, that this information is financial, and is covered by the G-L- B Act. Broker-dealers, funds, and registered advisers rely on a broad range of information, including information such as addresses and telephone numbers, when providing financial products or services. Broker-dealers, funds, and registered advisers use location information to provide a wide variety of financial services, such as sending account statements and disbursing funds to a consumer. We concluded that it would be inappropriate to exclude certain items of information from the definition of personally identifiable financial information simply because a particular broker-dealer, fund, or registered adviser might not rely on those items when providing a particular financial product or service.⁸³

Customer relationship as "personally identifiable financial information." We disagree with those commenters who maintain that customer relationships should not be considered to be personally identifiable financial information. This information is "personally identifiable" because it identifies the individual as a customer of the institution. The information is financial because it reveals a financial relationship with the institution and the receipt of financial products or services from the institution.

Changes made to the definition. We have revised the definition of "personally identifiable financial information" to make it easier to read and understand. In addition, the final rule adds to the examples of information covered by the rule any information that the institution collects through an information-collecting device from a web server, often referred to as a "cookie." ⁸⁴ This example illustrates one of the many ways that a financial institution may obtain information about a consumer in connection with providing a financial product or service to that consumer.

In addition, in response to many comments from the securities industry, the final rule also includes an example that clarifies that aggregate information (or "blind data") lacking personal identifiers is not covered by the definition of "personally identifiable financial information." ⁸⁵ We agree with the commenters who argued that this type of data does not "identify" any individual.

(v) Publicly available information. We are adopting the definition of "publicly available information" substantially as proposed. The proposal defined the term to include information that is lawfully available to the general public from official public records (such as real estate recordations or security interest filings), information from widely distributed media (such as a telephone book, television or radio program, or newspaper), and information that is required to be disclosed to the general public by federal, State, or local law (such as prospectuses and periodic shareholder reports). The proposed rule stated that publicly available information from widely distributed media would include information from an Internet site that is available to the general public without requiring a password or similar restriction. As previously explained in the discussion of "nonpublic personal information," we have adopted the proposed approach in the final rule, but with additional clarifying provisions.

Many commenters questioned the appropriateness of excluding from the definition of "publicly available information" information that a person obtains over the Internet by using a password or complying with a similar restriction. These commenters noted that many Internet sites are available to a large number of people, each of whom needs a user name and identification number to access the sites. Several of these commenters suggested that it would be more appropriate to focus on whether the information was lawfully placed on the Internet.

We agree with these comments, and have revised the final rule to remove the reference to passwords or similar restrictions from the example of the Internet as a "widely distributed" medium of communication. In its place, we have substituted a standard that requires the information, whether from the Internet or otherwise, to be available on an unrestricted basis. Information that an individual specifically requests be compiled, such as information that a locator or "look up" service provides with respect to a particular individual that may combine confidential information in addition to publicly available information, will not be considered available to the general public on an unrestricted basis, regardless of whether the information is provided over the Internet or otherwise. The rule also states that an Internet site is not restricted merely because an Internet service provider or a site operator requires a fee or password, as long as access is otherwise available to the general public. One common use of passwords is to confine the access of web site users to specific, individual information. However, web site operators also may require user identifications and passwords as a method of tracking access rather than restricting access to the information available through the website. Internet service providers may charge fees to users to access the site rather than to restrict access to particular information. Other sites available to the general public, such as daily newspapers, also may charge a fee to access archived information. Therefore, we believe that the definition of "widely distributed media" should properly focus on whether the information is lawfully available to the general public, rather than on the type of medium from which information is obtained.

We note that the concept of information being lawfully obtained was included in the proposal, and is retained in the final rule.⁸⁶ Thus, information unlawfully obtained will not be deemed to be publicly available notwithstanding that it may be available to the general public through widely distributed media.

(w) You. We are adopting the definition of "you" largely as proposed. The proposed definition of "you" referred to broker-dealers, funds, and registered advisers, which are the entities within the Commission's jurisdiction under Title V. We are, however, revising the definition to clarify that the provision of insurance by financial institutions under the Commission's primary jurisdiction is not covered under these rules.⁸⁷

A. Subpart A-Privacy and Opt Out Notices

Sections 248.4 through 248.9 of Regulation S-P include requirements concerning the delivery of initial and annual notices about the privacy policies and practices of a financial institution, and about the opportunity and methods for consumers to opt out of their institution's sharing of their nonpublic personal information with nonaffiliated third parties.

Section 248.4 Initial Privacy Notice to Consumers Required

We are revising the requirements relating to initial privacy notices to consumers, in response to issues raised by commenters. The G-L-B Act requires a financial institution to provide an initial notice of its privacy policies and practices in two circumstances. For customers, the notice must be provided at the time of establishing a customer relationship.⁸⁸ For consumers who are not customers, the notice must be provided before disclosing nonpublic personal information about the consumer to a nonaffiliated third party.⁸⁹

The proposed rules implemented these requirements by mandating that a financial institution provide the initial notice to an individual prior to the time a customer relationship is established and the opt out notice prior to disclosing nonpublic personal information to nonaffiliated third parties. The rule required these disclosures to be clear and conspicuous and to accurately reflect the institution's privacy policies and practices. The proposal also set out rules governing when a customer relationship is established and how a financial institution is to provide notice.⁹⁰

We received many comments raising concerns about proposed section 248.4. Most commenters from the securities industry raised questions about the time when initial notices must be provided, the point at which a customer relationship is established, and how initial notices may be provided.

Providing initial notices "prior to" time customer relationship is established. Almost all the commenters from the securities industry stated that, because the statute requires only that the initial notice be provided "at the time of establishing a customer relationship," the regulation should not require that the notice be provided "prior to" the point when a customer relationship is established. Some of these commenters were concerned that the rule could be interpreted as requiring a financial institution to provide disclosures at a point different from when they must provide other federally mandated consumer disclosures during the process of establishing a customer relationship.

Although we believe many commenters misinterpreted the proposed language concerning the timing for providing initial notices, we have revised the rule to clarify the requirement. The final rule states that, as a general rule, the initial notice must be given not later than the time when a financial institution establishes a customer relationship.⁹¹ As stated in the Proposing Release, the initial notices may be provided at the same time a broker-dealer, fund, or registered adviser is required to give other notices, such as the requirement that credit terms in margin transactions be disclosed,⁹² or that a registered adviser provide each client with a written disclosure statement ("brochure") not later than the time of entering an investment advisory contract with the client.⁹³ This approach, like the approach taken in the proposed rule, strikes a balance between (i) ensuring that consumers will receive privacy notices at a meaningful point during the process of "establishing a customer relationship" and (ii) minimizing unnecessary burden on broker-dealers, funds, and registered advisers that may otherwise result if the final rule were to require financial institutions to provide consumers with a series of notices at various times in a transaction.

Providing notices after customer relationship is established. Several commenters stated that the rule should provide financial institutions with the flexibility to deliver the initial notice after the customer relationship is established under certain circumstances. These commenters offered several situations in which a customer relationship is established without direct contact between the consumer and the financial institution. The commenters stated that delivery of the initial notice before the customer relationship is established in these situations would be impractical. Commenters also indicated that in many circumstances requiring delivery at this time would have a significant adverse effect on the ability to provide a financial product or service to a consumer as quickly as the consumer desires.

To accommodate the wide range of situations presented by the commenters, we have modified the examples of when subsequent delivery of the initial notice is appropriate, so that they now are more broadly applicable. As stated in the final rule in section 248.4(e), a broker-dealer, fund, or registered adviser may satisfy the delivery requirement by providing the initial notice within a reasonable time after establishing a customer relationship, in three instances. First, the institution may provide notice after the fact if the customer has not elected to establish the customer relationship.⁹⁴ This might occur, for example, when a brokerage account is transferred to another broker by a trustee selected by the Securities Investor Protection Corporation ("SIPC") and appointed by a United States Court.⁹⁵ Second, a broker-dealer, fund, or registered adviser may send a notice after establishing a customer relationship when to do otherwise would substantially delay the consumer's transaction and the consumer agrees to receive the notice at a later time.⁹⁶ An example of this is when an investor requests over the telephone that a broker-dealer execute a securities trade. The final example states that delayed delivery is permissible when a nonaffiliated brokerdealer or registered adviser purchases fund shares or establishes a brokerage account on behalf of a customer.⁹⁷

We note that in most situations, a broker-dealer, fund, or registered adviser should give the initial notice at a point when the consumer still has a meaningful choice about whether to enter into the customer relationship.⁹⁸ The exceptions listed in the examples, while not exhaustive, are intended to illustrate the less frequent situations when delivery either would pose a significant impediment to the conduct of a routine business practice or the consumer agrees to receive the notice later in order to obtain a financial product or service immediately.

In circumstances when it is appropriate to deliver an initial notice after the customer relationship is established, a broker-dealer, fund, or registered adviser should deliver the notice within a reasonable time thereafter. Several commenters requested that the final rule specify how many days a financial institution has in which to deliver the notice under these circumstances. However, we believe that a rule prescribing the maximum number of days would be inappropriate because (i) the circumstances of when an after-the-fact notice is appropriate are likely to vary significantly, and (ii) a rule that attempts to accommodate every circumstance is likely to provide more time than is appropriate in many instances. Therefore, we have retained the more general rule as set out in the proposal.⁹⁹

As we noted in the Proposing Release, nothing in the rule is intended to discourage a financial institution from providing an individual with a privacy notice at an earlier point in the relationship in order to make it easier for the individual to compare its privacy policies and practices with those of other institutions in advance of conducting transactions.¹⁰⁰

New notices not required for each new financial product or service. Several commenters asked whether a new initial notice is required every time a consumer obtains a financial product or service from that broker-dealer, fund, or registered adviser. These commenters suggested that a consumer would not materially benefit from repeated disclosures of the same information, and that requiring additional initial notices to be provided to the same consumer would be burdensome on financial institutions.

We agree that it would be burdensome, with little corresponding benefit to the consumer, to require a financial institution to provide the same consumer with additional copies of its initial notice every time the consumer obtains a financial product or service. Accordingly, the final rule states that a broker-dealer, fund, or registered adviser will satisfy the notice requirements when an existing customer obtains a new financial product or service if the institution's initial, revised, or annual notice (as appropriate) is accurate with respect to the new financial product or service.¹⁰¹

Joint accountholders. We agreed with several commenters who recommended that the final rule state that a financial institution is not obligated to provide more than one notice to joint accountholders.¹⁰² Accordingly, the final rule clarifies that one notice may be sent in connection with a joint account.¹⁰³ A broker-dealer, fund, or registered adviser may, in its discretion, provide notices to each party to the account. This situation might arise, for example, when a financial institution does not want one opt out election to apply automatically to all joint accountholders.¹⁰⁴

Mergers. A few commenters requested guidance on what notices are required in the event of a merger of two financial institutions or an acquisition of one financial institution by another. In such a situation, the need to provide new initial (and opt out) notices to the customers of the entity that ceases to exist will depend on whether the notices previously given to those customers accurately reflect the policies and practices of the surviving entity. If they do, the surviving entity will not be required under the rule to provide new notices.¹⁰⁵

As was stated in the Proposing Release, a financial institution may not fail to maintain the protections that it represents in the notice that it will provide.¹⁰⁶ We expect that brokerdealers, funds, and registered advisers will take appropriate measures to adhere to their stated policies and practices.

Section 248.5 Annual Privacy Notice to Customers Required

We are adopting largely as proposed the requirements relating to annual privacy notices to consumers. Section 503 of the G-L-B Act requires a financial institution to provide notices of its privacy policies and practices at least annually to its customers "during the continuation" of a customer relationship. The proposed rules implemented this requirement by requiring a clear and conspicuous notice that accurately reflects the privacy policies and practices then in effect to be provided at least once during any period of twelve consecutive months.¹⁰⁷ The proposed rule noted that the rule governing how to provide an initial notice also would apply to annual notices, and stated that a financial institution would not be required to provide annual notices to a customer with whom it no longer has a continuing relationship.¹⁰⁸

Many commenters from the securities industry requested that the final rule permit annual notices to be given each calendar year, instead of every 12 months. A few commenters recommended that the rule require notices each calendar year, with no more than 15 months elapsing between mailings. To clarify the extent of financial institutions' flexibility, the final rule retains the general rule requiring annual notices but then provides an example, stating that a broker-dealer, fund, or registered adviser may select a calendar year as the 12-month period within which notices will be provided, and deliver the first annual notice at any point in the calendar year following the year in which the customer relationship was established.¹⁰⁹ The final rule also requires that a broker-dealer, fund, or registered adviser apply the 12- consecutive-month period to its customers consistently.

Several commenters suggested that a financial institution be permitted to make the annual notice available upon request only, particularly if there have been no material changes to the notice since it was last delivered. These commenters argued that little value is added by providing customers with additional copies each year of the same information. Some suggested that financial institutions be permitted to provide a "short-form" annual notice, in which the institution informs its customers that there has been no change to its privacy policies and practices and that the customers may obtain a copy upon request.

We have not amended the final rule to permit this approach, for two reasons. First, we believe that the G-L-B Act requires a full set of disclosures to each customer once a year.¹¹⁰ Second, the revisions to the disclosure provisions reflected in the final rule clarify that a broker-dealer, fund, or registered adviser is not required to provide a lengthy and detailed privacy notice. Small institutions that do not share information with third parties beyond the statutory exceptions should be able to provide a short, streamlined notice. The rule also permits a broker-dealer, fund, or registered adviser to provide annual notices to customers over the institution's web site if the customer conducts transactions electronically and agrees to the electronic disclosures.¹¹¹ As a result, the final rule achieves much of the burden reduction sought by those requesting a short-form annual notice option.¹¹²

Section 248.6 Information To Be Included in Initial and Annual Privacy Notices

We are revising the requirements for information to be included in initial and annual privacy notices. The revisions clarify the level of detail required in these notices, and permit a "short-form" initial notice in certain circumstances.

Section 503 of the G-L-B Act identifies the items of information that a broker-dealer, fund, or registered adviser must include in its initial and annual notices. Section 503(a) of the GL- B Act sets out the general requirement that a financial institution must provide customers with a notice describing the institution's policies and practices with respect to, among other things, disclosing nonpublic personal information to affiliates and nonaffiliated third parties. Section 503(b) of the Act identifies certain elements that must be addressed in that notice.

The proposed rule implemented section 503 by requiring a financial institution to provide information concerning:

• The categories of nonpublic personal information that a brokerdealer, fund, or registered adviser may collect;






 
•  
•  
•  
• The categories of nonpublic personal information that a brokerdealer, fund, or registered adviser may disclose;






 
•  
•  
•  
• The categories of affiliates and nonaffiliated third parties to whom a broker-dealer, fund, or registered adviser discloses nonpublic personal information, other than those to whom information is disclosed under an exception in section 502(e) of the G-L-B Act;






 
•  
•  
•  
• The broker-dealer, fund, or registered adviser's policies with respect to sharing information about former customers;






 
•  
•  
•  
• The categories of information that are disclosed under agreements with third party service providers and joint marketers and the categories of third parties providing the services;






 
•  
•  
•  
• A consumer's right to opt out of the disclosure of nonpublic personal information to nonaffiliated third parties;






 
•  
•  
•  
• Any disclosures regarding affiliate information sharing opt outs a financial institution is providing under the Fair Credit Reporting Act; and






 
•  
•  
•  
• The institution's policies and practices with respect to protecting the confidentiality, security, and integrity of nonpublic personal information.

We received a large number of comments concerning these requirements, and most made the points summarized below.

Level of detail required. Many commenters observed that the level of detail required by the proposed rule would result in lengthy, complicated, and confusing disclosures. These comments have led us to revise the rule to clarify the level of detail required in a financial institution's initial and annual disclosures.

We do not intend to require a brokerdealer, fund, or registered adviser to publish lengthy disclosures that precisely identify every type of information collected or shared, the name of every entity with which the institution shares information, and a complete description of the technical specifications of how the institution protects its customers' records or the identity of each employee who has access to those records. Instead, the rule is intended to require notices that provide consumers with the types of third parties with which a financial institution shares nonpublic personal information, the types of information it shares, and the other information about the institution's privacy policies and practices listed above. The final rule, like the proposal, permits a brokerdealer, fund, or registered adviser to comply with these notice requirements by describing its privacy policies and practices.¹¹³ We believe that in most cases the initial and annual disclosure requirements can be satisfied by disclosures contained in a tri-fold brochure.

In response to commenters' concerns that consumers will not read long, detailed disclosures, we have revised the examples of the disclosures to clarify the level of detail that we think is appropriate. We have provided sample clauses in the Appendix to the rules, and have set out a compliance guide below in this release. Because the examples are not exclusive, the final rule permits a financial institution to use different categories than those provided in the examples, thereby providing additional flexibility for financial institutions in complying with the disclosure requirements. In addition, we have revised the language that precedes the items of information to be addressed in the initial notice, to clarify that a broker-dealer, fund, or registered adviser is required only to address those items that apply to the institution. Thus, for instance, if an investment adviser does not disclose nonpublic personal information to third parties, it may simply omit any reference to the categories of affiliates and nonaffiliated third parties to whom the institution discloses nonpublic personal information.

As noted in the Proposing Release, the required content is the same for both the initial and annual notices of privacy policies and practices.¹¹⁴ While the information contained in the notices must be accurate as of the time the notices are provided, a financial institution may prepare its notices based on current and anticipated policies and practices.

Short-form initial notice. We have reconsidered the need to give consumers a copy of a financial institution's complete initial notice when there is no customer relationship. In these circumstances, we believe that the objectives of the statute can be accomplished in a less burdensome way than was proposed. Accordingly, we have exercised our exemptive authority under section 504(b) to create an exception to the general rule that a financial institution must provide both the initial and opt out notices to a consumer before disclosing nonpublic personal information about that consumer to nonaffiliated third parties.

Section 248.6(d) provides that a financial institution may provide a "short-form" initial privacy policy notice along with the opt out notice to a consumer with whom the institution does not have a customer relationship. The short-form notice must clearly and conspicuously state that the disclosure containing information about the institution's privacy policies and practices is available on request, and must provide one or more reasonable means by which the consumer may obtain a copy of the notice. We believe that the short-form is appropriate because a consumer who does not become a customer of a broker-dealer, fund, or registered adviser may have less interest in certain elements of the institution's privacy policies. Thus, the consumer may receive greater benefit from obtaining a short-form notice with the opt out notice, which informs the consumer about the categories of his or her information the institution may share and the categories of nonaffiliated third parties that may receive the information. The rule also requires a broker-dealer, fund, or registered adviser to provide a consumer who is interested in the more complete privacy disclosures with a reasonable means to obtain them.

Information about affiliate sharing. Several commenters suggested that the rule should not require that initial and annual notices include categories of affiliates with whom a financial institution shares information. These commenters noted that the Act specifically requires disclosures of categories of nonaffiliated third parties only, and that the only statutorily mandated disclosures concerning affiliate sharing are disclosures required, if any, concerning affiliate sharing under the Fair Credit Reporting Act ("FCRA").¹¹⁵ These commenters concluded that the Commission and the Agencies, by expanding the disclosure requirements in the manner prescribed in the proposed rule, would be exceeding their rulemaking authority and imposing an unnecessary burden on financial institutions.

We believe that the language and legislative history of section 503 support requiring disclosures of affiliate sharing beyond what may be required by the FCRA. First, section 503(b) does not state that the items listed in the section are to be the only items set out in a financial institution's initial and annual disclosures. Instead, it uses the nonrestrictive phrase "shall include" when discussing the contents of the disclosures, thereby preserving flexibility for the Commission (which was expressly granted authority under section 503(a) to prescribe rules governing these notices) to require that additional items be addressed in the disclosures consistent with those specifically enumerated.

Second, section 503(a) states that the financial institution shall provide in its initial and annual notices "a clear and conspicuous disclosure * * * of such financial institution's policies and practices with respect to—(1) disclosing nonpublic personal information to affiliates and nonaffiliated third parties, consistent with section 502, including the categories of information that may be disclosed; * * *" While the FCRA disclosures would be a subset of the disclosures required by section 503(a)(1), they may not be sufficient to fully satisfy that requirement.

Third, the legislative history of the G- L-B Act suggests that Congress intended the disclosures to provide more information about affiliate sharing than what may be required under the FCRA.¹¹⁶ That history underscores the Congressional intent of ensuring that individuals are given the opportunity to make informed decisions about the privacy policies and practices of financial institutions. We believe that limiting the disclosures about affiliate sharing just to those disclosures that may be required under the FCRA would frustrate that purpose.¹¹⁷

Disclosures of the right to opt out. Other commenters suggested that the final rule eliminate the requirement that the initial and annual notices contain disclosures about a consumer's right to opt out. These commenters pointed out that the statute does not specifically require these disclosures.

As previously discussed, section 503(a) of the statute requires a financial institution to disclose its policies and practices with respect to sharing information, both with affiliated and nonaffiliated third parties. Given that a financial institution's practices with respect to sharing nonpublic personal information with nonaffiliated third parties will be affected by the opt out rights created by the statute, an institution will need to describe these opt out rights in order to provide a complete disclosure that satisfies the statute.

Other comments. We received many comments expressing support for a number of the provisions in proposed section 248.6. For example, several commenters agreed with the approach of permitting a financial institution to state generally that it makes disclosures to nonaffiliated third parties "as permitted by law" to describe disclosures made under one of the exceptions. Others agreed with the proposed flexibility to allow a disclosure to be based on current and contemplated information sharing. In light of these comments, we have adopted proposed section 248.6 with changes as discussed above. The final rule makes several other stylistic changes to the material in section 248.6 that are intended to make the rule easier to read.

Section 248.7 Form of Opt Out Notice to Consumers; Opt Out Methods

We are adopting as proposed the requirement that any opt out notice provided by a broker-dealer, fund, or registered adviser be clear and conspicuous and accurately explain the right to opt out.¹¹⁸ The final rule also requires, as proposed, that a financial institution provide the consumer with a reasonable means by which to opt out, and honor an opt out election as soon as reasonably practicable. The rule also states that an opt out election survives until revoked by the consumer. In addition, we have adopted provisions to address the application of these rules to joint accounts, the means by which an opt out right may be exercised, duration of an opt out, the level of detail required in the opt out notice, and the time by which an opt out election must be honored. The final rule also includes stylistic changes to make it easier to read.

Joint accounts. We agree with the commenters who stated that a financial institution should have the option of providing one notice per account, regardless of the number of persons on the account, and the final rule includes a new section to address this issue.¹¹⁹ Under the final rule, a financial institution may provide one initial, annual, and opt out notice per account. However, each of the accountholders must have the right to opt out. The final rule also requires a broker-dealer, fund, and registered adviser to state in the opt out notice provided to a joint accountholder whether the institution will consider an opt out by a joint accountholder as an opt out by all of the accountholders or whether each accountholder is permitted to opt out separately.

Means of opting out. At the suggestion of many commenters, the final rule includes a provision that permits a broker-dealer, fund, or registered adviser to require that a consumer opt out through a specific means, if the means is reasonable for the consumer.¹²⁰ We recognize that a financial institution may not have systems in place or trained personnel to handle opt out elections at each point of contact between a consumer and financial institution and therefore may choose not to honor opt out elections communicated to the institution through means other than those specified for the consumer.

As was proposed, the examples provide that a broker-dealer, fund, or registered adviser may not require a consumer to write his or her own letter in order to opt out.¹²¹ The final rule adds an example of a toll-free telephone number as another way by which financial institutions may allow consumers to opt out.¹²²

Duration of opt out. Several commenters requested changes to the proposed provision concerning duration of an opt out.¹²³ They noted that a financial institution would be required to keep track of opt out elections if, for example, a person opts out during the course of establishing a customer relationship with a financial institution, terminates that relationship, and then establishes another customer relationship several years later, perhaps under a different name or with someone on a joint account. The commenters suggested that it would be more appropriate in these circumstances to treat the opt out election made in connection with the first relationship as applying solely to that relationship.

We agree with the commenters' suggestions. Under the final rule, a broker-dealer, fund, or registered adviser is to treat an opt out election made by a customer in connection with a prior customer relationship as applying solely to the nonpublic personal information that the institution collected during, or related to, that relationship. That opt out will continue until the customer revokes it.¹²⁴ However, if the customer relationship terminates and a new one is established at a later point, the institution must then provide a new opt out notice to the customer in connection with the new relationship, and any prior opt out election does not apply to the new relationship.¹²⁵

Level of detail required in opt out notice. We are adopting as proposed the rule requirements for the form of the opt out notice.¹²⁶ A few commenters interpreted the proposal as requiring a more detailed disclosure of categories of nonpublic personal information and nonaffiliated third parties in the opt out notice than is required in the initial and annual notices.¹²⁷ We did not intend this result, and specifically referred to section 248.6 in the proposed opt out provision to address precisely this concern. The disclosures in the initial and annual notices of the categories of nonpublic personal information being disclosed and the categories of nonaffiliated third parties to whom the information is disclosed will suffice for the opt out notices as well. If the opt out notice is a part of the same document that contains the disclosures that must be included in the initial notice, then the financial institution is not required to restate those disclosures in the opt out notice. In these circumstances, the rule requires only that when the opt out and privacy notices are read together, they clearly disclose the categories of nonpublic personal information the institution intends to share and the categories of nonaffiliated third parties with whom it will share.

One commenter suggested that, while a broker-dealer, fund, or registered adviser should have the option of providing an opt out notice that is sufficiently broad to cover anticipated disclosures, the institution also should be permitted to provide a customer who already has opted out with a new opt out notice in connection with a new financial product or service. If the consumer does not opt out a second time, the institution would be free to disclose nonpublic personal information obtained in connection with that financial product or service.

We agree that a broker-dealer, fund, or registered adviser should have the flexibility to provide opt out notices that are either narrowly tailored to specific types of nonpublic personal information and types of nonaffiliated third parties or that are more broadly worded to anticipate future disclosure plans. We note, however, that when a consumer has elected to opt out of sharing certain nonpublic personal information, the opt out remains in effect until the consumer affirmatively revokes the opt out. Similarly, when a consumer opts out after receiving an opt out notice that is broad enough to cover the new type of information the institution intends to share, the consumer does not have to opt out again.

Time by which opt out must be honored. We are adopting in the final rule the proposed requirement that a financial institution comply with an opt out election "as soon as reasonably practicable." ¹²⁸ Many commenters asked us to clarify in the final rule when a financial institution must stop disclosing nonpublic personal information to nonaffiliated third parties after it receives an opt out. Suggestions for a more precise standard ranged from immediate to several months after receiving the opt out. We believe that a more general rule is appropriate in light of the wide range of practices among financial institutions. A broker-dealer, fund, or registered adviser might view a specific standard as a safe harbor in all circumstances and thus fail to implement an opt out as early as it could. In addition, a standard that reflects existing industry practices and capabilities is likely to become outmoded quickly as advances in technology increase efficiency. We therefore decline to adopt a more rigid standard.

Section 248.8 Revised Privacy Notices

We are adopting as proposed the rule regarding revised privacy notices.¹²⁹ The rule prohibits a financial institution, directly or through its affiliates, from disclosing nonpublic personal information about its consumers to nonaffiliated third parties unless the institution first provided a copy of its privacy notice and opt out notice. The rule also requires that these notices be accurate when given.¹³⁰ Thus, if a broker-dealer, fund, or registered adviser wants to disclose nonpublic personal information in a way that is not accurately described in its notices, the institution must provide new notices before disclosing that information. The rule also provides examples of when a new notice is required.¹³¹

Section 248.9 Delivering Privacy and Opt Out Notices

The requirements for delivery of initial, annual, and opt out notices were set out in three different sections of the proposed rules.¹³² The final rules combine in one section the requirements for delivery of each type of notice.¹³³ The general provision requires that an institution provide a notice to a consumer in a manner such that the consumer can reasonably be expected to receive actual notice in writing, or, if the consumer agrees, electronically.¹³⁴

Posting initial notices on an Internet web site. The final rule retains the proposed example of posting a notice on an Internet web site and requiring a consumer to acknowledge receipt of the notice as a step in the process of obtaining a financial product or service, as one way to comply with the rule.¹³⁵ A few commenters suggested that a financial institution be allowed to deliver initial notices simply by posting the institution's notice on its Internet web site. We believe that posting the notice on a web site alone would not be sufficient in all cases for a broker-dealer, fund, or registered adviser reasonably to expect that its consumers will receive the notice.¹³⁶ Accordingly, we have not expanded the rule beyond the circumstances described in the proposed example.

Posting annual notices on an Internet web site. At the suggestion of several commenters, the final rule clarifies that a broker-dealer, fund, or registered adviser may reasonably expect a customer who uses the institution's Internet web site to obtain financial products or services will receive actual notice if the customer has agreed to accept notices at the institution's web site, and if the institution continuously posts a current notice of its privacy policies and practices in a clear and conspicuous manner on the web site.¹³⁷ We agree that it is appropriate to provide annual notices in this way for customers who conduct transactions electronically and agree to accept notices on a web site. We also believe that this revision will reduce the burden on broker-dealers, funds, and registered advisers while ensuring that customers who transact business electronically will have continuous access to institutions' privacy policies and practices.

Householding. Two commenters requested that the Commission permit broker-dealers and funds to deliver a single privacy notice to consumers who share the same address ("householding"). The Commission currently permits householding of prospectuses and fund shareholder reports, and the commenters argue that the same justifications that support the existing householding rules, such as reducing the number of duplicate documents investors receive, would apply with respect to privacy notices.¹³⁸ We agree that householding is appropriate in certain circumstances, and the final rule adds an example that allows a broker-dealer or fund to consider that customers have actually received an annual privacy notice if the institution includes the notice with or in a prospectus or shareholder report delivered under conditions set forth in rules permitting householding of those documents.¹³⁹

The example requires that the annual privacy notice be delivered with or in a prospectus or shareholder report that is householded because we believe that customers whose disclosure documents are householded also would consent to having their annual privacy notices householded. We cannot assume that the same would be true for other customers. The example also limits householding to annual privacy notices because we believe that any reduction in the number of initial notices consumers might receive due to householding would be minimal. Individuals who share the same address may not become consumers of a brokerdealer, fund, or registered adviser at the same time.

Disclosures to customers requesting no communication. We received comment that the final rule clarify that a financial institution may honor a customer's request not to receive information from the institution about his or her relationship with the institution. The final rule clarifies that a broker-dealer, fund, or registered adviser need not send an annual privacy notice to a customer who affirmatively requests no communication from the institution, provided that the notice is available upon request.¹⁴⁰

Reaccessing a notice. The final rule provides an example that permits a broker-dealer, fund, or registered adviser to provide only the current privacy notice on a web site to someone seeking to obtain the privacy notice after having received the initial notice.¹⁴¹ This example responds to a request for clarification in the rule concerning potential confusion and burden that might result if the rule required a financial institution to make available every version of its privacy policies.

Joint notices. The final rule affirms that two or more financial institutions may provide a joint notice as long as the notice is accurate with respect to each institution.¹⁴² This provision reflects requests by many commenters from the securities industry that the rule permit this flexibility. We believe that brokerdealers, funds, and registered advisers should be able to combine initial, annual, or revised disclosures in one document and to give, on a collective basis, a consumer only one copy of the notice. For example, a clearing broker could provide a joint notice with an introducing broker for which it clears transactions on a fully disclosed basis, or a fund complex could provide a joint notice for all the funds in the complex. We emphasize that the notice must be accurate for each institution that uses the notice, and must identify each institution by name.¹⁴³

B. Subpart B—Limits on Disclosure

Sections 248.10 through 248.12 of Regulation S-P contain limitations concerning (i) disclosure of nonpublic personal information to nonaffiliated third parties, (ii) redisclosure or reuse of information that a financial institution discloses to other parties, and (iii) sharing of account number information for marketing purposes.

Section 248.10 Limits on Disclosure of Nonpublic Personal Information to Nonaffiliated Third Parties

We are adopting the limits on disclosure of nonpublic personal information to nonaffiliated third parties, substantially as proposed.¹⁴⁴ Section 502(a) of the G-L-B Act generally prohibits a financial institution, directly or through its affiliates, from sharing nonpublic personal information about a consumer with a nonaffiliated third party unless the institution (i) provides the consumer with a notice of the institution's privacy policies and practices, (ii) provides the consumer with a clear and conspicuous notice that the consumer's nonpublic personal information may be disclosed to nonaffiliated third parties, (iii) gives the consumer an opportunity to opt out of that disclosure, and (iv) informs the consumer how to opt out.¹⁴⁵

Most commenters on this section focused on the question of what is a reasonable opportunity to opt out. Some suggested that the rule permit a financial institution to begin sharing information immediately after it provides the opt out and initial notice in connection with an electronic transaction, such as an ATM transaction. Others advocated a mandatory delay of 120 days after the notices are provided.

We believe that the wide variety of suggestions underscores the appropriateness of a more general test rather than a mandatory waiting period in all cases. If a broker-dealer intends to disclose nonpublic personal information that it obtains through an isolated transaction and the consumer is provided a convenient means of opting out as part of the transaction, it would be reasonable not to force the brokerdealer to wait before sharing the information.¹⁴⁶ For notices that are provided by mail, however, we believe the consumer should have additional time. In these latter circumstances, we consider it reasonable to permit the consumer to opt out by mailing back a form, by calling a toll-free number, or by any other reasonable means within 30 days after the date the opt out notice was mailed.¹⁴⁷ The final rule also provides an example of a reasonable opportunity for opting out in connection with accounts opened electronically.¹⁴⁸ However, we have not tried to anticipate every scenario and establish a specific period for each. Instead, the rule provides that the consumer must be given a reasonable opportunity to opt out and then includes some illustrative examples of what would be reasonable in different contexts.¹⁴⁹

Section 248.11 Limits on Redisclosure and Reuse of Information

We are revising the limits on redisclosure and reuse to clarify their scope. The limits on redisclosure and reuse that apply to recipients of nonpublic personal information and their affiliates will depend on whether the information was provided under an exception in section 502(e) of the G-L-B Act.

Section 502(c) of the G-L-B Act provides that a nonaffiliated third party that receives nonpublic personal information from a financial institution must not, directly or indirectly through an affiliate, disclose that information to any person that is not affiliated with the financial institution or the third party, unless the disclosure would be lawful if made directly by the financial institution. A broker-dealer, fund, or registered adviser generally may disclose nonpublic personal information to a nonaffiliated third party (i) for any purpose if the consumer has received a privacy and opt out notice and has not exercised the right to opt out, (ii) under section 502(b), and (iii) in accordance with specific enumerated exceptions under section 502(e).

The limits on redisclosure and reuse in the proposed rule reflected our belief that implicit in the joint marketing and enumerated exceptions is the idea that information may be used only for the purposes for which the third party received it.¹⁵⁰ The proposed rules implemented section 502(c) by imposing limits on redisclosure for a broker-dealer, fund, or registered adviser that receives information from a nonaffiliated financial institution, and for any nonaffiliated third party that receives nonpublic personal information from a broker-dealer, fund, or registered adviser.¹⁵¹ The proposed rules also implemented the implicit limitations on reuse by imposing limits on the ability of broker-dealers, funds, and registered advisers and nonaffiliated third parties to reuse nonpublic personal information they receive.¹⁵²

We sought comment on the correct interpretation of "lawful" in the context of section 502(c), and whether a recipient of nonpublic personal information could "lawfully" disclose information if the disclosure complied with a notice provided by the institution that initially made the disclosure. Finally, we invited comment on whether the rules should require a financial institution that discloses nonpublic personal information to a nonaffiliated third party to develop policies and procedures to ensure that the third party complies with the limits on redisclosure of that information.

Limits on reuse and redisclosure. Commenters who disagreed with the proposal to impose limits on reuse argued that Congress, by addressing limits on redisclosures in section 502(c), provided the only limits that may be imposed on what a recipient of nonpublic personal information can do with that information. We disagree.

Although section 502(c) does not expressly address reuse, reuse limitations are, as indicated, implicit in the provisions authorizing or permitting disclosures. For example, it would be inconsistent with the purposes of the Act to permit information disclosed in accordance with section 502(e)(1) (which permits disclosures as necessary to effect, administer, or enforce a transaction with a consumer or in connection with certain routine activities related to such a transaction) to be used for the third party recipient's marketing purposes. Moreover, permitting reuse without limits would undermine the protections afforded to a consumer who does not establish a customer relationship. Such a person does not receive notice that the disclosures under section 502(e) are even made because these disclosures do not entitle the consumer to any privacy or opt out notice. Thus, the limits on reuse are the only protection under the statute for a consumer who is not a customer. Accordingly, consistent with the purposes of the G-L-B Act, the rule limits the reuse of information received under an exception of the Act.¹⁵³

By contrast, when a consumer decides not to opt out after receiving adequate notices and the opportunity to do so, that consumer has decided to permit the broker-dealer, fund, or registered adviser to share his or her nonpublic personal information with the categories of entities identified in the institution's notices. The consumer's primary protection in the case of a disclosure falling outside the section 502(e) exceptions comes from receiving the mandatory disclosures and the right to opt out. The G-L-B Act provides additional protection in section 502(c) by restricting a recipient's ability to redisclose information to entities not affiliated with either the recipient or the financial institution making the initial disclosure. Thus, if a consumer permits a broker-dealer, fund, or registered adviser to disclose nonpublic personal information to the categories of nonaffiliated third parties that are described in the institution's notices, recipients of that nonpublic personal information appear authorized under the statute to make disclosures consistent with those notices.

Limits on redisclosure and reuse when information is received under section 502(e). If a broker-dealer, fund, or registered adviser receives nonpublic personal information provided under section 502(e), it may disclose the information to its affiliates or to the affiliates of the financial institution from which it received the information. The broker-dealer, fund, or registered adviser also may disclose and use the information under the same type of exceptions in the ordinary course of business to carry out the activity covered by the exception under which the institution received the information.¹⁵⁴ The affiliates of the broker-dealer, fund, or registered adviser may disclose and use the information, but only to the extent permissible for the broker-dealer, fund, or registered adviser.¹⁵⁵

These same general rules apply to a third party other than a broker-dealer, fund, or registered adviser that receives nonpublic personal information from a broker-dealer, fund, or registered adviser. Thus, the third party receiving the information under one of the section 502(e) exceptions may disclose the information to its affiliates or to the affiliates of the broker-dealer, fund, or registered adviser that made the disclosure. The third party also may disclose and use the information under one of the section 502(e) exceptions as noted in the rule. The affiliates of the third party may disclose and use the information only to the extent permissible for the third party.

Limits on redisclosure and reuse when information is not received under section 502(e). If a broker-dealer, fund, or registered adviser receives nonpublic personal information outside one of the section 502(e) exceptions, it may disclose the information to (i) its affiliates, (ii) the affiliates of the financial institution that made the initial disclosure, or (iii) any other person if the disclosure would be lawful if made directly by the financial institution from which the information was received.¹⁵⁶ Thus, the receiving broker-dealer, fund, or registered adviser may disclose under one of the section 502(e) exceptions.

If a third party receives information from a broker-dealer, fund, or registered adviser outside one of the section 502(e) exceptions, the third party may disclose to its affiliates or to the affiliates of the broker-dealer, fund, or registered adviser. The third party also may disclose to any other person if the disclosure would be lawful if made by the broker-dealer, fund, or registered adviser. The third party's affiliates may disclose and use the information to the same extent permissible for the third party.

If an entity receives information outside of one of the section 502(e) exceptions, that entity will in essence "step into the shoes" of the brokerdealer, fund, or registered adviser that made the initial disclosures. Thus, if the broker-dealer, fund, or registered adviser made the initial disclosures after representing to its consumers that it had carefully screened the entities to whom it intended to disclose the information, the receiving entity must comply with those representations. Otherwise, the subsequent disclosure by the receiving entity would not comply with the notices given to consumers and would not, therefore, be lawful. Even if these representations do not prevent the recipient from redisclosing the information, the recipient's ability to redisclose will be limited by whatever opt out instructions the consumer gave to the broker-dealer, fund, or registered adviser making the initial disclosures and by any new opt out instructions the consumer gives after the initial disclosure. The receiving entity, therefore, must have procedures in place to monitor continually the status of who opts out and to what extent. Given these practical limitations on the ability of a recipient to disclose under another institution's privacy and opt out notices, entities are most likely to redisclose under one of the section 502(e) exceptions (as implemented by sections 248.14 and 248.15 of the final rule).

Monitoring third parties. Most commenters stated that financial institutions should not have to monitor compliance with the redisclosure and reuse provisions of the rule, and we have decided not to revise the rule to impose a specific duty on brokerdealers, funds, and registered advisers to monitor third parties' use of nonpublic personal information they provide. The rule does not, however, address whether obligations to monitor reuse and redisclosure may arise in other contexts. Most of the commenters who requested that we not impose such a duty stated that they have contracts in place that limit the recipient's use of the information. In addition, the limits on reuse as stated in the final rule provide a basis for an enforcement action to be brought against an entity that violates those limits.¹⁵⁷

Section 248.12 Limits on Sharing Account Number Information for Marketing Purposes

We are revising the proposed rule regarding limits on sharing account number information for marketing purposes¹⁵⁸ by (i) adding two exceptions that we believe are necessary to enable broker-dealers, funds, and registered advisers to engage in legitimate, routine business practices and that are unlikely to pose a significant potential for abuse, and (ii) clarifying that the prohibition does not apply in two circumstances frequently mentioned in the comments.¹⁵⁹ Section 502(d) of the G-L-B Act prohibits a financial institution from disclosing, "other than to a consumer reporting agency, an account number or similar form of access number or access code for a credit card account, deposit account, or transaction account of a consumer to any nonaffiliated third party for use in telemarketing, direct mail marketing, or other marketing through electronic mail to the consumer." The proposal applied this statutory prohibition to disclosures made directly or indirectly by a brokerdealer, fund, or registered adviser, and sought comment on whether the rule should include any exceptions to the prohibition. Some commenters suggested various exceptions while other commenters supported a flat prohibition in order to protect consumers from unscrupulous practices.

Disclosures to a financial institution's agent or service provider. Several financial institutions stated that they use agents or service providers to conduct marketing on the institution's behalf. This might occur, for example, when a broker-dealer instructs a service provider that assists in the delivery of required regulatory notices to include a "statement stuffer" about the brokerdealer's products and services. We recognize the need to disclose account numbers in this instance, and believe that this kind of disclosure poses little risk to the consumer.

Several commenters argued that the final rule should exclude disclosures to agents because they effectively act as the financial institution in marketing the financial products and services of the broker-dealer, fund, or registered adviser. We are concerned, however, that the agent of these financial institutions may engage in practices contrary to the institution's instructions. While a broker-dealer, fund, or registered adviser frequently will use agents to assist it in marketing its products, providing agents access to a consumer's account number may erode a consumer's protections. Accordingly, we have added an exception to permit a broker-dealer, fund, or registered adviser to disclose account numbers to an agent for the purpose of marketing the institution's financial product or services as long as the agent has no authority to initiate charges to the account.¹⁶⁰

Encrypted numbers. Many commenters urged us to exercise our exemptive authority to permit the transmission of account numbers in encrypted form or to clarify that the prohibition applies only to disclosure to nonaffiliated third parties who are not subject to one of the exceptions under sections 248.13, 248.14, or 148.15. Several commenters noted that financial institutions frequently use encrypted account numbers and other internal identifiers of an account to ensure that a consumer's instructions are properly executed. The inability to continue using these internal identifiers would increase the likelihood of errors in processing a consumer's instructions. These commenters also noted that if internal identifiers are not used, a consumer would have to provide an account number in order to ensure proper handling of a request. This procedure could expose the consumer to a greater risk than would the use of an internal tracking system that preserves the confidentiality of a number that may be used to access the account. One commenter also noted that customer account numbers are protected by strict contractual confidentiality provisions.

We believe an encrypted account number without the key is not the same as the number itself and thus falls outside the prohibition in section 502(d). The G-L-B Act focuses on numbers that provide access to an account. The encrypted number, however, operates as an identifier attached to an account for internal tracking purposes only, and without the key does not permit someone to access an account. For this reason the final rule clarifies that an account number, or similar form of access number or access code, does not include a number or code in an encrypted number form, as long as the financial institution does not provide the recipient with the means to decrypt the number.¹⁶¹

C. Subpart C-Exceptions

Sections 248.13 through 248.15 of Regulation S-P include exceptions from the provisions requiring financial institutions to provide privacy notices and opt out notices to consumers. These exceptions permit broker-dealers, funds, and registered advisers to disclose information to nonaffiliated third parties in circumstances such as maintaining or servicing a customer's account, or complying with federal, State, or local laws.

Section 248.13 Exception to Opt Out Requirements for Service Providers and Joint Marketing

We are adopting substantially as proposed an exception to the opt out requirements for service providers and joint marketing, with revisions to clarify the rule's scope.¹⁶² Section 502(b) of the G-L-B Act permits financial institutions to share information with a nonaffiliated third party without providing the consumer a right to opt out if the third party is to perform services for (or functions on behalf of) the financial institution, including marketing the institution's own products or services, or financial products or services offered under a joint agreement between two or more financial institutions. Section 502(b)(2) requires the financial institution to "fully disclose" to the consumer that it will provide this information to the nonaffiliated third party before sharing the information and to enter into a contract with the third party that requires the third party to maintain the confidentiality of the information. As noted in the proposed rule, this contract should be designed to ensure that the third party (i) will maintain the confidentiality of the information at least to the same extent as is required for the financial institution that discloses it, and (ii) will use the information solely for the purposes for which the information is disclosed or as otherwise permitted under the proposed rules.¹⁶³

Commenters expressed concern that routine servicing agreements between a financial institution and, for instance, a customer account servicer would be subject to the requirements of the proposed rules.¹⁶⁴ These commenters noted that section 502(e) of the G-L-B Act contains several exceptions that permit broker-dealers, funds, and registered advisers to share information necessary to allow a third party to perform services for the institution. The commenters requested clarification that sharing information with a service provider under one of the section 502(e) exceptions is not subject to the requirements imposed under section 502(b)(2) of the G-L-B Act. We agree that when a broker-dealer, fund, or registered adviser is permitted to share nonpublic personal information with a nonaffiliated third party under section 502(e), the institution does not have to comply first with the requirements imposed by section 502(b)(2).

A few commenters also argued that it is illogical to impose requirements on service providers that receive information under section 502(b)(2) when no requirements are imposed on service providers that receive information under section 502(e). We believe, however, that a plain reading of section 502(b)(2) leads to that result.¹⁶⁵ We read the phrase "if the financial institution fully discloses * * *" as used in section 502(b)(2) to modify the phrase "This subsection shall not prevent a financial institution from providing nonpublic personal information to a nonaffiliated third party to perform services for or functions on behalf of the financial institution, * * *." We therefore conclude that any disclosure to a service provider not covered by section 502(e) must satisfy the disclosure and written contract requirements of section 502(b)(2).

The Proposing Release requested comment on whether the rule should include safeguards beyond those provided by the G-L-B Act to protect a financial institution from the risks that can arise from agreements with third parties. The majority of commenters who addressed the issue argued that the rule should not. We agree that the protections set out in the statute, as implemented by section 248.13(a)(1), are adequate for purposes of the privacy rules. Those protections require a financial institution to provide the initial notice required by section 248.4 as well as to enter into a contractual agreement with a third party that prohibits the third party from disclosing or using the information other than to carry out the purposes for which the institution disclosed the information, including use under an exception in sections 248.14 or 248.15 in the ordinary course of business to carry out those purposes. These limitations will preclude recipients from sharing a consumer's nonpublic personal information through a chain of third party joint marketing agreements.

Many commenters recommended that the Commission permit broker-dealers, funds, and registered advisers to grandfather prior joint marketing and servicing agreements, or permit institutions to comply with the requirements by notifying existing service providers about the privacy rules' requirements. One commenter stated that without a grandfather provision, institutions would need more than six months to review prior agreements and negotiate amendments with third parties. We believe that a balance must be struck that minimizes interference with existing contracts while preventing evasions of the regulation. To achieve these goals, the final rule provides that contracts entered into on or before July 1, 2000 must be brought into compliance with the provisions of section 248.13 by July 1, 2002.¹⁶⁶

Section 248.14 Exceptions to Notice and Opt Out Requirements for Processing and Servicing Transactions

We have revised the proposed exceptions to notice and opt out requirements for processing and servicing transactions ¹⁶⁷ to include disclosures made in connection with (i) servicing or processing financial products or services requested by the consumer or (ii) maintaining or servicing a customer account.¹⁶⁸ As previously discussed, section 502(e) of the G-L-B Act creates exceptions to the requirements that apply to the disclosure of nonpublic personal information to nonaffiliated third parties. Paragraph (1) of that section sets out certain exceptions for disclosures made in connection with the administration, processing, servicing, and sale of a consumer's account. Proposed section 248.10 implemented those exceptions by restating them with only stylistic changes that were intended to make the exceptions easier to read. The Proposing Release noted that the exceptions set out in proposed sections 248.10 and 248.11 do not affect a financial institution's obligation to provide initial and annual notices of its privacy policies and practices.

We received many comments from broker-dealers, funds, and registered advisers noting that, by deleting the statutory phrase "in connection with" from the exceptions for information shared (i) to service or process a financial product or service requested by the consumer or (ii) to maintain or service a customer account, we narrowed the application of the exception. We did not intend this result, and have changed the final rule accordingly.¹⁶⁹

Several other commenters requested that the final rule provide specific examples of situations that would fall within the exception for processing and servicing customer accounts (such as transfers from a broker-dealer to its registered representatives, or as necessary to arbitrate a dispute, with the consent of the consumer's fiduciary or representative). Others stated that certain services, such as those provided by attorneys, are "necessary" to effect, administer, or enforce a transaction. We believe that disclosures to these types of professionals and under the circumstances posited by the commenters may be necessary to effect, administer, or enforce a transaction in a given situation. However, we have not listed specific types of disclosures in the regulation as necessarily falling within the scope of the exception because we are concerned that a general statement could be applied inappropriately to shelter disclosures that, in fact, are not necessary to effect, administer, or enforce a transaction.

Other commenters suggested that the final rule clarify, in situations in which a financial institution uses an agent to provide services to a consumer, that the consumer does not have to request directly or authorize the service provider to provide the financial product or service but may request it from the financial institution instead. For example, a consumer may ask the fund or its transfer agent for additional account information that the transfer agent provides as a service for the fund. We agree that the communication may be between the consumer and the service provider, and note that the rule governing agents as set out in the definition of "consumer" above provides the flexibility sought by the commenters. An individual will not be a consumer of an entity that is acting as agent for a broker-dealer, fund, or registered adviser in connection with that institution's providing a financial product or service to the consumer.

Section 248.15 Other Exceptions to Notice and Opt Out Requirements

We are adopting as proposed the section that includes "other" exceptions to the notice and opt out requirements. As noted above, section 502(e) of the G-L-B Act contains several exceptions to the requirements that otherwise would apply to the disclosures of nonpublic personal information to nonaffiliated third parties. The proposed rule set out those exceptions for disclosures that are not made in connection with the administration, processing, servicing, or sale of a consumer's account, and made stylistic changes to the statutory language that were intended to clarify the exceptions.¹⁷⁰ The proposal also provided an example of the consent exception in the context of a consumer who consents to having a broker or investment adviser confirm the amount of assets in the customer's account to a nonaffiliated mortgage lender so that the lender can evaluate the customer's application for a loan. We invited comment on whether we should add safeguards to the exception for consent in order to minimize the potential for consumer confusion.

Several commenters responded to the request for comment on whether the consent exception should include consumer safeguards, such as a requirement that the consent be written, be indicated by a signature on a separate line, or automatically terminate after a certain period of time. Some commenters favored the additional safeguards discussed in the proposal, while others maintained that safeguards are unnecessary. Several suggested that the consent exception include a provision noting that participation in a program where a consumer receives "bundled" products and services necessarily implies consent to the disclosure of information between the entities that provide the bundled products or services. Others suggested that certain terms and conditions be imposed on any consent agreement, such as a time by which the financial institution must stop disclosing nonpublic personal information once a consent is revoked.

We have declined to elaborate on the requirements for obtaining consent or the consumer safeguards that should be in place when a consumer consents. We believe that the resolution of this issue is appropriately left to the particular circumstances of a given transaction. We note that any broker-dealer, fund, or registered adviser that obtains the consent of a consumer to disclose nonpublic personal information should take steps to ensure that the limits of the consent are well understood by both the institution and the consumer. We also note that a consumer may always revoke his or her consent. In light of the safeguards already in place, we have decided not to adopt additional safeguards in the consent exception.

Many commenters offered specific suggestions for additional exceptions or revisions to the proposed exceptions. In some cases, the suggestions are accommodated elsewhere in the regulation (such as exceptions to permit disclosures to independent contractor registered representatives or attorneys to effect a transaction).¹⁷¹ In other cases, the suggestions are inconsistent with the statute.¹⁷² Accordingly, we have retained the statement of the exceptions as proposed.¹⁷³

D. Subpart D—Relation to Other Laws; Effective Date

Sections 248.16 through 248.18 of Regulation S-P include provisions that explain the interaction between the regulation and certain other laws, and that provide an effective date and compliance date for the regulation.

Section 248.16 Protection of Fair Credit Reporting Act

We are adopting as proposed the section that explains the interaction between Regulation S-P and the Fair Credit Reporting Act.¹⁷⁴ Section 506 of the G-L-B Act makes several amendments to the FCRA to vest rulemaking authority in various agencies and to restore the Banking Agencies' regular examination authority. Paragraph (c) of section 506 states that, except for these amendments to the FCRA, nothing in Title V of the G-L-B Act is to be construed to modify, limit, or supersede the operation of the FCRA, and no inference is to be drawn on the basis of the provisions of Title V whether information is transaction or experience information under section 603 of the FCRA. Proposed section 248.14 implemented section 506(c) of the G-L-B Act by restating the statute, making only minor stylistic changes intended to make the rule clearer. Comments about this provision focused on whether the Commission, by requiring annual notice of a consumer's right to opt out under the FCRA, was modifying, limiting, or superseding the operation of the FCRA. For the reasons explained in the discussion of section 248.6, above, we do not believe that the annual disclosure mandated by the G- L-B Act affects in any way the obligations imposed by the FCRA.

Section 248.17 Relation to State laws.

We are adopting as proposed the section that explains the interaction between Regulation S-P and State laws.¹⁷⁵ Section 507 of the G-L-B Act provides that Title V does not preempt any State law that provides greater protections than are provided by Title V. Determinations of whether a State law or Title V provides greater protections are to be made by the Federal Trade Commission ("FTC") after consultation with the agency that regulates either the party filing a complaint or the financial institution about whom the complaint was filed, and may be initiated by any interested party or on the FTC's own motion. The proposed rule essentially restated section 507, stating that the proposed rules (as opposed to the statute) do not preempt State laws that provide greater protection for consumers than do the rules.

Commenters on this section expressed concern about the potential differences between federal and State privacy laws. Several supported coordination and cooperation among federal and State regulators to ensure consistency in privacy policies. Some commenters requested clarification of whether a particular State law would be considered more restrictive, while others suggested that the final rules establish a choice of law principle for financial institutions operating in more than one State. These and other suggestions made by the commenters appear to exceed the scope of this rulemaking.

Section 248.18 Effective Date; Transition Rule

We are adopting as proposed the effective date for Regulation S-P of November 13, 2000, and are providing a compliance date of July 1, 2001.¹⁷⁶ We also are adding a provision that clarifies the requirement that financial institutions provide initial privacy and opt out notices to customers by July 1, 2001, and a provision that phases in compliance with respect to existing service agreements.¹⁷⁷

Section 510 of the G-L-B Act states that, as a general rule, the relevant provisions of Title V take effect six months after the date on which rules are required to be adopted, i.e., November 12, 2000. However, section 510(1) authorizes us to prescribe a later date in the rules adopted under section 504. The Proposing Release sought comment on the effective date prescribed by the statute.¹⁷⁸ It also would have required that financial institutions provide initial notices, within 30 days of the effective date of the final rule, to people who were customers as of the effective date. The Proposing Release noted that a financial institution would have to provide opt out notices before the rule's effective date if the institution wanted to continue sharing nonpublic personal information with nonaffiliated third parties without interruption.¹⁷⁹

The Congressional Privacy Caucus, several members of Congress, and other commenters have urged the Commission and the Agencies not to delay the effective date past the date set forth in the G-L-B Act.¹⁸⁰ By contrast, the overwhelming majority of commenters from the securities industry who addressed this provision requested additional time to comply with the final rule. Commenters stated that six months would not be sufficient to take the steps needed to comply with the regulation, including preparing new disclosure forms, developing software needed to track opt outs, training employees, and creating management oversight systems. Several commenters suggested that it would be less effective and potentially more confusing for consumers to receive several notices around the end of the year 2000 than it would be for the notices to be delivered during a "rolling phase-in." Others noted that the proposed effective date would place a severe strain on financial institutions at a time when other year-end notices need to be prepared and delivered. Several commenters noted that financial institutions have not budgeted for the expenses in the current year that likely will be incurred. Requests for extensions of the effective date typically ranged from six to 24 months from the proposed effective date of the rule (i.e., from November 13, 2000).

Many commenters also stated that a 30-day phase-in for initial notices to existing customers is not feasible, given the large number of notices, the short period of time allowed, and the competing demands on financial institutions at the time when the initial notices must be sent. A few suggested that the rule require initial notices to be sent only to people who establish customer relationships after the effective date of the rule, and allow a financial institution to send annual notices to existing customers at some point during the next 12 months and annually thereafter.

We agree that six months may be insufficient in certain instances for a financial institution to have ensured that its forms, systems, and procedures comply with the rule. In order to accommodate situations requiring additional time, we will give financial institutions until July 1, 2001 to be in full compliance with the regulation. Financial institutions are expected, however, to begin compliance efforts promptly, to use the period prior to June 30, 2001 to implement and test their systems, and to be in full compliance by July 1, 2001. Given that this provides financial institutions more than 12 months in which to comply with the rules, we have determined that there no longer is any need for a separate phasein for providing initial notices. Thus, a financial institution will need to deliver all required opt out notices and initial notices before July 1, 2001. We believe that this extension represents a fair balance between those seeking prompt implementation of the protections afforded by the statute and those concerned about the reliability of the systems that are put in place.

We encourage financial institutions to provide disclosures as soon as practicable. Broker-dealers, funds, and registered agents that do not disclose nonpublic personal information to third parties have fewer burdens under the regulation (both in terms of the notice requirements and opt out mechanism) and should therefore be able to provide privacy notices to their consumers sooner. Depending on the readiness of an institution to process opt out elections, institutions might wish to consider including the privacy and opt out notices in the same mailing as is used to provide tax information or account statements to consumers in the first quarter of 2001 to increase the likelihood that a consumer will not mistake the notices for an unwanted solicitation.

The extension of the compliance date should provide much of the relief sought by those who suggested that initial notices should not be required for existing customers. By allowing financial institutions to deliver notices over a significantly longer period of time than was proposed, the concentrated burden that would have been imposed by the proposed rules is avoided. Accordingly, we have not adopted the suggestion that initial notices be required only for new customers after the effective date of the rule.

Broker-dealers, funds, and registered advisers need not give initial notices to customers whose relationships have terminated before the date by which institutions must be in compliance with the rules. Thus, if an account is inactive according to a financial institution's policies before July 1, 2001, then no initial notice would be required in connection with that account. However, because these former customers would remain consumers, a broker-dealer, fund, or registered adviser would have to provide a privacy and opt out notice to them if the institution intended to disclose their nonpublic personal information to nonaffiliated third parties beyond the exceptions in sections 248.14 and 248.15.

Full compliance with the rules' restrictions on disclosures is required on July 1, 2001. To be in full compliance, broker-dealers, funds, and registered advisers must have provided their existing customers with a privacy notice, an opt out notice, and a reasonable amount of time to opt out before that date. If these have not been provided, the disclosure restrictions will apply. This means that a brokerdealer, fund, or registered adviser would have to cease sharing customers' nonpublic personal information with nonaffiliated third parties on that date, unless it may share the information under an exception under sections 248.14 or 248.15. Broker-dealers, funds, and registered advisers that both provide the required notices and allow a reasonable period of time to opt out before July 1, 2001, may continue to share nonpublic personal information after that date for customers who do not opt out.

E. Subpart E-Safeguard Procedures

Section 248.30 Procedures To Safeguard Customer Information and Records

Commenters on this section supported the proposal, and we are adopting this section as proposed. Section 501 of the G-L-B Act directs the Commission (and the Agencies) to establish appropriate standards for financial institutions relating to administrative, technical, and physical safeguards to protect customer records and information. The rules implement this section by requiring every brokerdealer, fund, and registered adviser to adopt policies and procedures to address the safeguards described above. Consistent with the Act, the proposed rule further requires that the policies and procedures be reasonably designed to: (i) insure the security and confidentiality of customer records and information; (ii) protect against any anticipated threats or hazards to the security or integrity of customer records and information; and (iii) protect against unauthorized access to or use of customer records or information that could result in substantial harm or inconvenience to any customer.

Some commenters recommended that the Commission add an example to clarify that various financial institutions in a fund complex could satisfy the rule by adopting a single set of policies and procedures for the fund complex. We believe that a single set of policies and procedures for a fund complex could satisfy the rule's requirements, as long as those policies and procedures have been determined to be appropriate for each institution to which they apply.

¹⁰See infra discussion of sections 248.3(j), (k) (noting that variable annuities and variable life insurance contracts are insurance products and securities).

¹¹See infra section 248.3(r).

¹² The Regulation also applies to any unregistered broker, dealer or fund in the United States. See section 248.1. In accordance with the G-L-B Act, however, Regulation S-P does not apply to any investment adviser that is not registered with the Commission. See G-L-B Act §§ 505(a)(5) (Commission has jurisdiction over broker-dealers, funds, and registered advisers); 505(a)(7) (Federal Trade Commission has jurisdiction over financial institutions not subject to the specific jurisdiction of the federal functional regulators). We also note that the privacy rules of Banking Agencies do not apply to foreign offices of financial institutions. See, e.g., Banking Agencies' Release, sections 40.1, 216.1, 332.1, 573.1.

¹³See, e.g., Alfadda v. Fenn, 935 F.2d 475 (2d Cir.), cert. denied, 502 U.S. 1005 (1991); see also Steele v. Bulova Watch Co., 344 U.S. 280 (1952).

¹⁴ We note that a foreign broker-dealer, fund, or investment adviser that registers with the Commission also must comply with regulatory requirements concerning service of process in the United States. See Exchange Act rule 15b1-5(a) [17 CFR 240.15b1-5(a)] (requiring foreign broker-dealer that registers with the Commission to consent to service of process in the United States). See also Investment Company Act rule 7d-1(b)(7) [17 CFR 7d-1(b)(7)]; Investment Advisers Act rule 0-2 [17 CFR 275.0-2].

¹⁵See supra note 7.

¹⁶See Proposing Release, supra note 4, at discussion of section 248.2.

¹⁷ The sample disclosures address solely the level of detail required and do not attempt to provide guidance on issues such as type size, margin width, or other characteristics that affect whether a notice is clear and conspicuous.

¹⁸Cf. Banking Agencies' Release, supra note 2, at sections 40.2, 216.2, 332.2, 573.2 ("Compliance with an example or use of a sample clause, to the extent applicable, constitutes compliance with this part.").

¹⁹Compare Banking Agencies' Release, supra note 2, sections 40.2, 216.2, 332.2, 573.2.

²⁰ G-L-B Act § 509(6).

²¹See supra discussion of section 248.2. We are unaware of any savings institution that is registered as a broker and would be subject to Regulation S-P.

²²See also supra discussion of section 248.1 (privacy rules apply to the foreign offices of registered broker-dealers, funds, and advisers, in addition to the U.S. offices of all broker-dealers, funds, and registered advisers).

²³ Banking Agencies' Release, supra note 2, sections 40.1(b), 216.1(b), 332.1(b), 573.1(b).

²⁴See Proposing Release, supra note 4, at discussion of proposed section 248.3(c).

²⁵ 12 CFR part 226.

²⁶ Regulation DD, 12 CFR part 230.

²⁷ Many of these commenters expressed concern that the examples would invite litigation because of ambiguities inherent in terms used in the examples in the proposed rule such as "ample line spacing," "wide margins," and "explanations * * * subject to different interpretations."

²⁸See section 248.3(c)(2).

²⁹See 17 CFR 230.421(b).

³⁰See section 248.3(c)(2)(ii)(E). Because we believe that privacy disclosures may be clear and conspicuous when combined with other disclosures, the rule does not mandate that privacy disclosures be provided on a separate piece of paper. The requirement is not necessary and would significantly increase the burden on financial institutions.

³¹ Section 248.3(c)(2)(iii).

³²See section 248.3(d).

³³ 5 U.S.C. 552a.

³⁴ See section 248.3(f).

³⁵See G-L-B Act § 502(a). See also sections 248.14 and 248.15. By contrast, the broker-dealer, fund, or registered adviser must give all "customers" a notice of the institution's privacy policy at the time of establishing a customer relationship and annually thereafter during the continuation of the customer relationship. G-L-B Act § 503(a).

³⁶See proposed section 248.3(g)(1).

³⁷See discussion of section 248.3(o) below.

³⁸See section 248.3(g)(2)(i).

³⁹ Those consumers may not be customers, however. See infra discussion of section 248.3 (explaining how the definition of "customer" will be applied in the loan context). See section 248.4(c)(2).

⁴⁰See proposed section 248.3(g)(2)(iii).

⁴¹See section 248.3(g)(2)(iii), (v).

⁴² Section 248.3(g)(1).

⁴³ Similarly, a trust, partnership, or personal corporation that has an account with a brokerdealer, fund, or registered adviser would not be a customer for purposes of the privacy rules because these entities are not individuals.

⁴⁴See section 248.3(g)(2)(vii)-(viii), 248.3(k)(2)(i)(D). Three commenters also requested clarification in the examples on whether an individual who uses a financial tool that a financial institution makes available on the Internet is the institution's consumer. The commenters noted that individuals generally use these tools on a one-time or sporadic basis, and the tool typically does not require the user to enter his or her name or address. Thus, the information provided through the Internet tool is not personally identifiable. We agree that under these circumstances the individual would not be the institution's "consumer" and that these circumstances are covered in the examples under the definition of "consumer" and personally identifiable financial information. See section 248.3(g)(2)(ii), 248.3(u)(2)(ii)(B).

⁴⁵See section 248.3(h). The definition is used in sections 248.6(c)(1)(iv), 248.12(a), and 248.15(a)(5) of the final rules.

⁴⁶ 15 U.S.C. 1681a(f).

⁴⁷See discussion of section 248.3(a) above.

⁴⁸See Form BD, Uniform Application for Broker-Dealer Registration, Explanation of Terms, 1. Form BD defines "control" to mean the power, directly or indirectly, to direct the management or policies of a company, whether through ownership of securities, by contract, or otherwise. In addition, there is a presumption of control for any person that (i) is a director, general partner, or officer exercising executive responsibility (or having similar status or functions); (ii) has the right to vote 25 percent or more of a class of voting securities or the power to sell or direct the sale of 25 percent or more of a class of voting securities; or (iii) in the case of a partnership, has the right to receive upon dissolution, or has contributed, 25 percent or more of the capital.

⁴⁹Id. See also section 248.3(i).

⁵⁰See 15 U.S.C. 80a-2(a)(9).

⁵¹See section 248.3(k)(2)(ii).

⁵²See e.g., SEC v. Variable Annuity Life Ins. Co., 359 U.S. 65 (1959) (variable annuities); Exemption of Certain Variable Life Insurance Contracts and Their Issuers from Federal Securities Laws, Investment Company Act Release No. 7644 (Jan. 31, 1973) [38 FR 4315 (Feb. 13, 1973)] (variable life contracts).

⁵³See section 248.3(k)(2)(i)(E).

⁵⁴ These individuals could include a contract owner and could also include any other individual who has the rights of a contract owner, such as the ability to direct underlying investments.

⁵⁵See section 248.3(k)(2)(i)(A) (consumer who has a brokerage account (including a margin account) has a continuing relationship with a broker-dealer).

⁵⁶ The originating lender will then have a consumer relationship with the borrower.

⁵⁷ In those circumstances, the borrower will be entitled to receive initial and annual notices from the loan servicer.

⁵⁸ A broker-dealer who purchases loans for securitization would have to provide notice and opt out to borrowers before sharing nonpublic personal information about the borrowers with nonaffiliated third parties, unless the sharing was necessary to effect or administer the securitization. See section 248.14(a)(3).

⁵⁹ One commenter also requested that the Commission except from the notice requirements closed-end funds whose information about record owners is limited to name, address, and number of shares held and who neither have affiliates nor share nonpublic personal information with third parties. The G-L-B Act does not exempt closed-end funds from privacy provisions of Title V. Although closed-end funds may bear the costs of mailing initial privacy notices to new customers, they can reduce the burden of annual notices by including them with a shareholder report. See discussion of section 248.3(c) (definition of "clear and conspicuous").

⁶⁰See Proposing Release, supra note 4, at text following n.37.

⁶¹See G-L-B Act § 509(6).

⁶² The investment adviser may receive nonpublic personal information about the fund's shareholders in connection with performing services on behalf of the fund or servicing the shareholders' accounts. The G-L-B Act permits a fund to share this information with the adviser if the adviser is an affiliate or if the adviser is a nonaffiliated third party. See G-L-B Act §§ 502(b)(2), (e). See also sections 248.13, 248.14.

⁶³ Section 248.3(k)(2)(i)(A).

⁶⁴ Section 248.3(k)(2)(i)(D).

⁶⁵ See supra discussion of section 248.3(g).

⁶⁶ 15 U.S.C. 78c(a)(5).

⁶⁷ The term also is used in the definition of "affiliate." See section 248.3(a).

⁶⁸See G-L-B Act § 502(e)(5).

⁶⁹ 69 12 U.S.C. 1843(k).

⁷⁰ G-L-B Act § 509(3); proposed section 248.3(m)(2). Two commenters requested that the rule clarify that an independent contractor registered representative of a broker-dealer is not a separate financial institution when acting in the capacity of a registered representative. We believe that the rules address this situation and need no further revision. An independent contractor registered representative is considered an "associated person" of a broker-dealer under the Exchange Act if the representative's activities are subject to control by the broker-dealer, such as when there is a principal and agent relationship. See Letter to Gordon S. Macklin, President, National Association of Securities Dealers, Inc. from Douglas Scarff, Director, Division of Market Regulation, Commission (June 18, 1982) (on file with the Commission). As discussed above, a broker-dealer's consumer is not considered a consumer of the broker-dealer's agent. See section 248.3(g)(2)(v). An independent contractor, however, also may be a registered adviser who as such, acts in a different capacity than as agent for the brokerdealer. In these circumstances, the registered representative is a different financial institution. Therefore, an investor who obtains investment advisory services from that registered representative acting as an investment adviser would be a consumer of the investment adviser.

⁷¹ These entities will, however, be subject to the limits on reuse and redisclosure under section 248.11 with respect to any nonpublic personal information they receive from a nonaffiliated financial institution that has disclosure obligations under these rules.

⁷²But see section 248.3(g)(2)(ii) (an individual is not a consumer of a broker-dealer, fund, or registered adviser if the individual provides the institution only with name, address, and general areas of interest in connection with a request for a prospectus, investment adviser brochure, or other information about financial products or services).

⁷³ 15 U.S.C. 80b-2(a)(11).

⁷⁴ 15 U.S.C. 80a-3. As noted in the Proposing Release, a business development company, which is an investment company but is not required to register with the Commission, is subject to Regulation S-P. See Proposing Release, supra note 4, at n.30. See also 15 U.S.C. 80a-2(a)(48). An entity that is not an "investment company" under the Investment Company Act, is not subject to Regulation S-P. See 15 U.S.C. 80a-3(c).

⁷⁵ The Banking Agencies (other than the Board of Governors of the Federal Reserve) and the Federal Trade Commission proposed alternative rule text for this approach. See Privacy of Consumer Financial Information, 65 FR 8770, 8790-91, 8804-05, 8811-12 (Feb. 22, 2000); Privacy of Consumer Financial Information, 65 FR 11174, 11189-90 (Mar. 1, 2000) (Federal Trade Commission proposal).

⁷⁶See section 248.3(v)(1). See also 17 CFR 230.144A(d)(1), .903(b)(1)(i).

⁷⁷ Section 248.3(v)(2).

⁷⁸See section 248.3(v)(3)(iii)(2).

⁷⁹Compare Banking Agencies' Release, supra note 2, sections 40.3(p), 216.3(p), 332.3(p), 573.3(p) (definition of "publicly available information").

⁸⁰See sections 248.3(t)(2).

⁸¹See section 248.3(t)(3).

⁸²See Proposing Release, supra note 4, at discussion of proposed section 248.3(v).

⁸³ We note that names, addresses, and telephone numbers, if publicly available, will not be subject to the opt out provisions of the statute unless that information is "derivative information" (i.e., information that is part of a list, description, or other grouping of consumers that is derived from personally identifiable financial information that is not publicly available information). An investment adviser's client list is an example of this type of information, even if the list includes clients' names, addresses, and telephone numbers that are otherwise publicly available. In circumstances in which a consumer does not opt out, a financial institution may disclose nonpublic personal information about a consumer to a nonaffiliated third party if the disclosure is consistent with the institution's opt out and privacy notices.

⁸⁴See section 248.3(u)(2)(i)(F).

⁸⁵See section 248.3(u)(2)(ii)(B).

⁸⁶See section 248.3(v)(1).

⁸⁷ As noted above, however, broker-dealers and funds that provide insurance products that also are securities and registered advisers who provide advice with respect to those products will be subject to this part with respect to their provision of those securities and advice about those securities. See supra discussion of section 248.1.

⁸⁸ G-L-B Act § 503(a).

⁸⁹ G-L-B Act § 502(a).

⁹⁰See proposed section 248.4.

⁹¹ Section 248.4(a)(1).

⁹² 17 CFR 240.10b-16. See Proposing Release, supra note 4, at text accompanying n.35.

⁹³ 17 CFR 275.204-3(b) (requiring delivery of the brochure (i) not less than 48 hours before entering into an investment advisory contract with the client or (ii) at the time of entering into the contract as long as the client has at least 5 business days to cancel the contract without penalty).

⁹⁴See section 248.4(e)(1)(i).

⁹⁵See 15 U.S.C. 78eee-78fff-1.

⁹⁶See section 248.4(e)(1)(ii).

⁹⁷See section 248.4(e)(1)(iii).

⁹⁸See, e.g, section 248.9(b)(1)(iii) (example of reasonable expectation that consumer will receive actual notice of initial privacy notice on Internet web site provides that consumer acknowledges receipt of notice as a necessary step to obtaining a particular financial product or service).

⁹⁹See section 248.4(e)(1).

¹⁰⁰See Proposing Release, supra note 4, at discussion of proposed section 248.4.

¹⁰¹See section 248.4(d).

¹⁰² A few commenters noted that disclosure obligations arising from joint accounts are well settled under other rules, such as the regulations implementing the Equal Credit Opportunity Act, see 12 CFR part 202, and the Truth in Lending Act, 15 U.S.C. 1601. Commenters noted that under both Regulation B and Regulation Z, a financial institution is permitted to give one notice. The authorities cited include requirements that the financial institution give disclosures as appropriate to the "primary applicant" if readily apparent, see 12 CFR 202.9(f), or to a person "primarily liable on the account." See 12 CFR 226.5(b).

¹⁰³See section 248.9(g).

¹⁰⁴See discussion of section 248.9 below on how to provide opt out notices.

¹⁰⁵ If the surviving or acquiring institution does not deliver new notices, it must honor any opt outs the predecessor or acquired institution received from consumers.

¹⁰⁶ Proposing Release, supra note 4, at section discussing proposed section 248.4.

¹⁰⁷See section 248.5(a).

¹⁰⁸ Proposed section 248.5(c)(1).

¹⁰⁹See section 248.5(a)(2).

¹¹⁰ The G-L-B Act states that "not less than annually during the continuation of [a customer] relationship, a financial institution shall provide a clear and conspicuous disclosure to such consumer [i.e., one with whom a customer relationship has been formed], * * * of such financial institution's policies and practices with respect to" the information enumerated in the Act. G-L-B Act § 503.

¹¹¹See also discussion of section 248.9 below.

¹¹² Members of the banking industry also commented on the paragraph in this section regarding termination of a customer relationship and examples set forth in the Banking Agencies' proposing release. See section 248.5(b). We have made a technical revision to one of the examples in response to the only comment that specifically addressed the Commission's proposed examples. See section 248.5(b)(2)(iii).

¹¹³See section 248.6(e).

¹¹⁴ Proposing Release, supra note 4, at discussion of proposed section 248.6.

¹¹⁵See 15 U.S.C. 1681a(d)(2)(A)(iii). Section 603(d)(2)(A)(iii) of the FCRA excludes from the definition of "consumer report" the communication of certain consumer information among affiliated entities if the consumer is notified about the disclosure of such information and given an opportunity to opt out of the disclosure of that information. The information that can be disclosed to affiliates under this provision includes, for instance, information from consumer reports and applications for financial products or services. In general, this information includes personal information provided directly by the consumer to the institution, such as income and assets, in addition to information contained within consumer reports.

¹¹⁶See, e.g., remarks of Sen. Gramm (noting that the privacy bill contains "for the first time a full disclosure requirement. It requires every bank in America, when you open your account to tell you precisely what their policy is: Do they share personal financial information within the bank? Do they share it outside the bank?"), 145 Cong. Rec. S13786 (daily ed. Nov. 3, 1999); remarks of Sen. Hagel, id. at S13876 ("Financial institutions would be required to disclose their privacy policies to their customers on a timely basis. If customers do not believe adequate protections exist at their institution, they can take their business elsewhere.").

¹¹⁷ Commenters from other industries who addressed the issue argued that a financial institution should not be required to include FCRA disclosures in its annual notices. To the extent that broker-dealers share information about margin loans, they may be subject to the FCRA. As previously discussed, section 503(b)(4) of the G-L-B Act requires a financial institution's initial and annual notice to include the disclosures required, if any, under section 603(d)(2)(A)(iii) of the FCRA. The proposed rules implemented section 503(b)(4) of the G-L-B Act by requiring that a broker-dealer, fund, or registered adviser's initial and annual notice include any disclosures a financial institution makes under section 603(d)(2)(A)(iii) of the FCRA. Proposed section 248.6(a)(7). Several commenters noted that the FCRA requires disclosures of a consumer's right to opt out of affiliate sharing only once, and that the G-L-B Act states, in section 506(c), that nothing in the G-L-B Act is to be construed to modify, limit, or supersede the operation of the FCRA. These commenters maintain that the "if any" language of section 503(b)(4), read in the context of section 506, suggests that, because at most only one notice must be provided under the FCRA, section 503 should require only one FCRA disclosure under the privacy rules.

As discussed above, we believe that in order to comply with the requirement that it disclose its policies and practices with respect to sharing information with affiliated and nonaffiliated third parties, a financial institution must describe the circumstances under which it will share information with affiliates. The ability of consumers to opt out of affiliate information sharing under the FCRA affects a financial institution's policies and practices with respect to disclosing information to its affiliates. Failing to include this information and an explanation of how the opt out right may be exercised would make the disclosures incomplete.

In addition, section 503 does not distinguish between the disclosures to be provided in the initial notice from those to be provided in the annual notice. Thus, section 503 suggests that any disclosures that are required under the FCRA must be included in both the initial and annual notices.

We interpret the "if any" language as an acknowledgment that not all institutions provide FCRA notices because not all institutions engage in the type of affiliate sharing covered by the FCRA. We do not believe that requiring the FCRA notice to appear as part of the annual notice under the privacy rules, modifies, limits, or supersedes the operation of the FCRA; financial institutions will have exactly the same FCRA obligations following the effective date of the privacy rules as they had before. The only difference will be that, as required by the G-L-B Act, a financial institution's initial and annual disclosures about its privacy policy and practices will need to reflect how the institution complies with the affiliate sharing provisions of the FCRA.

¹¹⁸See section 248.8(a).

¹¹⁹See section 248.7(d).

¹²⁰See section 248.7(a)(2)(iv).

¹²¹See section 248.7(a)(2)(iii)(A).

¹²²See section 248.7(a)(2)(ii)(D).

¹²³See proposed section 248.8(e).

¹²⁴See section 248.7(g)(1).

¹²⁵See section 248.7(g)(2).

¹²⁶See section 248.7(a)(1).

¹²⁷See proposed section 248.8(a)(2)(i) (a financial institution "provides adequate notice * * * if [the institution] identifies all of the categories of nonpublic personal information that [the institution] discloses or reserves the right to disclose to nonaffiliated third parties as described in [section 248.6]").

¹²⁸See section 248.7(e).

¹²⁹See section 248.8. The final rule is in a separate section for emphasis.

¹³⁰See section 248.8(a)(1).

¹³¹See section 248.8(b).

¹³²See proposed sections 248.4(d) (initial notice), 248.5(b) (annual notice), and 248.8(b) (opt out notice).

¹³³See section 248.9.

¹³⁴ Section 248.9(a).

¹³⁵See section 248.9(b)(1)(iii).

¹³⁶ Nevertheless, there may be circumstances in which an Internet web site notice might be delivered in a way that will enable the brokerdealer, fund, or registered adviser to reasonably expect that the consumer will receive it.

¹³⁷See section 248.9(c)(i).

¹³⁸See Delivery of Disclosure Documents to Households, Investment Company Act Release No. 24123 (Nov. 4, 1999) [64 FR 62540 (Nov. 16, 1999)]. The Commission also has proposed rule amendments to permit householding of proxy or information statements. See Delivery of Proxy and Information Statements to Households, Investment Company Act Release No. 24124 (Nov. 4, 1999) [64 FR 62548 (Nov. 16, 1999)]. The comment period on this proposal ended January 18, 2000.

¹³⁹See section 248.9(c)(2).

¹⁴⁰See section 248.9(c)(1)(ii). A customer may request no communication or that the institution refrain from sending the annual notices. We note, however, that broker-dealers, funds, and registered advisers must provide customers with any communications (such as shareholder reports or confirmation statements) required under the federal securities laws. See, e.g., 15 U.S.C. 80a-29(e). These institutions also must provide customers with initial, opt out, and revised privacy notices. See sections 248.4, 248.7, 248.8.

¹⁴¹See section 248.9(e)(2)(iii).

¹⁴²See section 248.9(f). See also Proposing Release, supra note 4, at paragraph following n.34 ("[t]he proposed rules do not prohibit two or more institutions from providing a joint initial, annual, or opt out notice * * *").

¹⁴³ Records concerning privacy notices delivered to consumers and consumer opt outs must be maintained in accordance with the recordkeeping requirements of 17 CFR 240.17a-4 (broker-dealers); 270.31a-2 (funds); 275.204-2 (registered advisers). See also section 248.30 (requiring broker-dealers, funds, and registered advisers to establish procedures and policies to safeguard customer information and records).

¹⁴⁴ Section 248.10.

¹⁴⁵ Proposed section 248.7 implemented these provisions by requiring a broker-dealer, fund, or registered adviser to give the consumer the initial notice required by section 248.4, the opt out notice required by section 248.8, and a reasonable opportunity to opt out.

¹⁴⁶See section 248.10(a)(3)(iii).

¹⁴⁷See section 248.10(a)(3)(i).

¹⁴⁸See section 248.10(a)(3)(ii).

¹⁴⁹ Some commenters stated that the proposal inappropriately implied that the opportunity to opt out by mail is available only when a consumer has a customer relationship with the financial institution. See proposed section 248.7(a)(3)(i). The final rule deletes the reference to a customer relationship in that section to avoid creating that implication. See section 248.10(a)(3)(i).

¹⁵⁰ For example, as discussed further below in this section, permitted use for an enumerated exception would not include use for marketing purposes.

¹⁵¹See proposed section 248.12(a)(1), 248.12(b)(1).

¹⁵²See proposed section 248.12(a)(2), 248.12(b)(2).

¹⁵³See G-L-B Act § 504(a)(1) (authorizing the Commission to prescribe regulations necessary to carry out the purposes of Title V).

¹⁵⁴See sections 248.14, 248.15.

¹⁵⁵See section 248.11(a).

¹⁵⁶ The examples also provide that a brokerdealer, fund, or registered adviser may redisclose information according to the privacy notices of the institution making the initial disclosures, as limited by any opt out elections received by that institution. Section 248.11(b)(2).

¹⁵⁷See section 248.11(c).

¹⁵⁸See proposed section 248.13.

¹⁵⁹See section 248.12.

¹⁶⁰See section 248.12(b)(1).

¹⁶¹See section 248.12(c).

¹⁶²See proposed section 248.9, section 248.13.

¹⁶³See proposed section 248.9, (a)(2). The exceptions were set forth in proposed sections 248.10 and 248.11.

¹⁶⁴See section 248.13.

¹⁶⁵ The statute states, in relevant part, that section 502(b)—shall not prevent a financial institution from providing nonpublic personal information to a nonaffiliated third party to perform services for or functions on behalf of the financial institution, including the marketing of the financial institution's own products or services, or financial products or services offered pursuant to joint agreements between two or more financial institutions that comply with the requirements imposed by the regulations prescribed under section 504, if the financial institution fully discloses the providing of such information and enters into a contractual agreement with the third party that requires the third party to maintain the confidentiality of such information.

¹⁶⁶ Section 248.18(c).

¹⁶⁷See proposed section 248.10.

¹⁶⁸ Section 248.14.

¹⁶⁹See section 248.14(a). 170 Proposed section 248.11.

¹⁷¹See section 248.14(a) (excepting from initial and opt out notice requirements disclosures to nonaffiliated third parties as necessary to effect a transaction that a consumer requests or in connection with servicing or processing a financial product that a consumer requests or authorizes).

¹⁷² One commenter, for example, suggested that the rule completely exempt a financial institution from all of the requirements under Title V if the institution makes no disclosures other than those permitted by section 502(e).

¹⁷³See section 248.15.

¹⁷⁴ Section 248.16.

¹⁷⁵ Section 248.17.

¹⁷⁶ Section 248.18(a).

¹⁷⁷ Section 248.18(b), (c).

¹⁷⁸ Because Nobvember 12, 2000 is a Sunday, the proposed rule provided an effective date of Monday, November 13, 2000. See proposed rule 248.16(a).

¹⁷⁹See Proposing Release, supra note 4, at discussion of proposed section 248.16.

¹⁸⁰See supra note 6.

IV. Appendix-Sample Clauses

In order to provide additional guidance to broker-dealers, funds, and registered advisers concerning the level of detail we believe is appropriate under the Act, we have prepared a variety of sample clauses for institutions to consider. We urge broker-dealers, funds, and registered advisers to carefully review whether these clauses accurately reflect a given institution's policies and practices before using the clauses. Broker-dealers, funds, and registered advisers are free to use different language and to include additional detail as they think is appropriate in their notices.

V. Comparison Chart

Below is a chart showing the comparison of the sections in the final privacy rules and the proposal. Only changes are noted.

¹⁸¹ If you disclose or reserve the right to disclose nonpublic personal information to a nonaffiliated third party under other circumstances, you must comply with other provisions in the rules, notably sections 248.7, 248.8, and 248.13, if applicable. If you disclose or reserve the right to disclose nonpublic personal information to an affiliate you must comply with other provisions in the rules, notably section 248.6(a)(7), as applicable.

¹⁸² You need to describe only those general categories that apply to your policies and practices. Accordingly, if you do not collect information from a "consumer reporting agency," for instance, then you need not describe that category in your notices.

VI. Guidance for Certain Institutions

To minimize the burden and costs to a broker-dealer, fund, or registered adviser ("you") and generally clarify the operation of the final rules, we have included this guidance that you may use in conjunction with the sample clauses in the Appendix. This guidance specifically applies to you if you:

In addition, if you disclose nonpublic personal information in accordance with the exception in section 248.13 (for service providers and joint marketers) you also must include an accurate description of that information, as illustrated by the sample clause in section (K) below.

In general, if you disclose nonpublic personal information to nonaffiliated third parties only as authorized under an exception, then your only responsibilities under the regulation are to provide initial and annual privacy notices to each of your customers. You do not need to provide an opt out notice or opt out rights to your customers.

VII. Cost-Benefit Analysis

The Commission is sensitive to the costs and benefits that result from its rules and understands that the rules may impose costs on broker-dealers, funds, and registered advisers.

Nevertheless, the rules implement the privacy provisions of Title V and, we believe, impose no costs in addition to those that would result from compliance with the G-L-B Act.

We believe that the requirements to provide opt out notices and to protect customer information will benefit consumers and customers by protecting the privacy of their nonpublic personal information. In addition, the requirements to provide initial and annual privacy notices will allow customers to compare the privacy policies of financial institutions.

We also believe that the rules provide greater certainty to the private sector on how to comply with the G-L-B Act because they are consistent with and comparable to the rules adopted by the Agencies. The examples in the rules and the sample clauses in the Appendix also should provide guidance on how the rules will be enforced with respect to broker-dealers, funds, and registered advisers. Finally, in order to reduce compliance burdens, the rules allow broker-dealers, funds, and registered advisers flexibility to distribute notices and to adopt policies and procedures to protect customer information that are best suited to the institution's business and needs. These benefits are difficult to quantify, and we received no data from commenters.

We estimate that approximately 5500 broker-dealers, 4300 funds, and 8100 registered advisers will be required to comply with the rules. In the first year after the rules are adopted, these institutions must comply with the following requirements: (i) Prepare notices describing the institution's privacy policies; (ii) provide an initial privacy notice and opt out notice to each consumer; (iii) provide an initial privacy notice to each new customer (who did not receive a notice when he or she was a consumer); (iv) provide an annual privacy notice to each existing customer; (v) adopt policies and procedures that address the protection of customer information and records. After the first year, broker-dealers, funds, and registered advisers would be required to revise notices only to reflect changes in their privacy policies. Similarly, these institutions would have to revise their policies and procedures on safeguarding customer information as appropriate to ensure the protection of the information.

In the Proposing Release, we estimated certain costs of complying with the proposed rules.¹⁸³ We estimated that a registered adviser would spend on average $615 to draft a privacy notice,¹⁸⁴ and a broker-dealer or fund would spend on average $4920 to draft a privacy notice.¹⁸⁵ Therefore, we estimated a one-time cost to the industry of approximately $53.2 million to draft privacy notices.¹⁸⁶ For mailing the notices, we estimated that it would cost broker-dealers, funds, and registered advisers $2.6 million to provide to their customers initial notices in the first year after adoption, and the same amount to provide annual notices to customers each year after that.¹⁸⁷ In addition, we assumed that most broker-dealers, funds, and registered advisers currently have in place procedures to protect customer information. Thus, we estimated that each institution would on average require approximately 30 hours to review and revise its policies and procedures, with a one-time cost to the industry to comply with the rules of approximately $80.6 million.¹⁸⁸ We received two comments on the cost-benefit analysis, both of which opined that we underestimated the costs and burdens of complying with Regulation S-P. One commenter suggested that we increase our estimate of the cost to mail annual notices to reflect the cost of providing revised privacy notices.¹⁸⁹ This commenter suggested that the cost for privacy notices would increase annual mailing costs by approximately $1.3 million per year.¹⁹⁰

These commenters further noted that our estimates did not address other costs of compliance, including: Modifying existing systems and databases, developing new systems to track delivery of privacy notices and (if necessary) opt out elections, and training personnel. One commenter estimated that the overall cost of implementing the rules for a large firm would be at least $1 million. The other commenter provided no estimates for these additional costs. Neither commenter provided any specific data to explain the amount of time or the costs associated with the time they believe will be required to implement the rules.

The cost of developing and maintaining records of delivery of privacy notices and opt out elections, and costs for personnel training will vary greatly depending upon the size of the financial institution, its customer base, number of affiliates, and the extent to which the institution intends to share information. We have been unable to obtain any reliable information with which to quantify the amount of these costs. We recognize that the costs for a large institution that shares information with affiliates and nonaffiliated third parties and that has many customers may exceed $1 million, and that this could increase the compliance costs of the rules. We also believe that the costs for a small institution, such as a registered adviser, that has far fewer customers and does not share with affiliates or nonaffiliated third parties will be significantly less.

As discussed above, the privacy notices will allow customers of broker-dealers, funds, and registered advisers to compare the privacy policies of different institutions. This information is likely to result in some customers moving their accounts or relationships from one institution to another whose policies are better suited to the customers' needs. We are unable to estimate the number of customers who may make this transfer or the resulting economic impact on the industry. We do not believe, however, that customers would move their accounts from broker-dealers, funds, or investment advisers to a different type of financial institution (such as a bank), because we have no basis for assuming that the privacy policies adopted by 17,900 broker-dealers, investment companies, and registered investment advisers would not be sufficiently varied to address the needs of any customer.

¹⁸³See Proposing Release, supra note 4, at section IV.

¹⁸⁴ For purposes of the Paperwork Reduction Act, Commission staff has estimated that an investment adviser would require 4 hours of professional time (at $150 per hour) and 1 hour of clerical or administrative time (at $15 per hour) to prepare (or revise) its privacy notice, for a total of $615 ((4 x $150) + (1 x $15) = $615).

¹⁸⁵ For purposes of the Paperwork Reduction Act, Commission staff has estimated that a broker-dealer or investment company would require 32 hours of professional time and 8 hours of clerical or administrative time to prepare (or revise) its privacy notice, for a total of $4920 ((32 x $150) + (8 x $15) = $4920).

¹⁸⁶ This amount equals the sum of the costs for broker-dealers, funds, and registered advisers ((5500 + 4300) x $4920) + (8,100 x $615) = $53.2 million. The amount of time required for each institution to prepare (or revise) its privacy notices will vary depending on the extent to which (i) the institution shares information and (ii) the institution's sharing policy differs for certain consumers or customers. An institution that does not share information with affiliates or nonaffiliated third parties may provide a simplified notice. See section 248.6(c)(5). An institution that has many affiliates and has different policies on sharing based on the affiliate or the customer is likely to require much more time to draft its notices. Our estimate was based on the assumption that most broker-dealers and funds share nonpublic personal information about consumers or customers with their affiliates (or as permitted under one of the exceptions discussed above), but many fewer share information with nonaffiliated third parties, and that registered advisers generally do not share with affiliates or nonaffiliated third parties. For purposes of the Paperwork Reduction Act, Commission staff has estimated that a registered adviser would require, on average, about 5 hours, and a broker-dealer or fund would require from 5 to over 100 hours, with an average of about 40 hours, to prepare (or revise) its privacy notice.

¹⁸⁷ We assumed that broker-dealers, funds, and registered advisers generally would include the initial privacy notices to customers with disclosure documents or account statements that customers currently receive, and that the statements generally would be assembled and sent by organizations that specialize in mailing and distribution. The individual cost per institution would vary significantly depending on the number of the institution's customers. The estimate was based on an average additional cost per mailing of $0.02 for 130.7 million investor accounts. We assumed there are 53 million brokerage accounts, 77.3 million individual fund shareholders (see Investment Company Institute, 1999 Mutual Fund Fact Book 41 (May 1999)), and 400,000 customers of registered advisers. We noted that the estimated number of accounts may be significantly higher than the actual number because we were unable to estimate the number of individual accounts used for personal, family, or household purposes.

¹⁸⁸ The estimate represented the costs of 30 hours of professional time (at $150 per hour) ((5500 + 4300 + 8100) x 30 x $150 = $80.6 million). Our estimates were based on staff conversations with representatives from the industry. We understand that many large institutions currently have comprehensive policies and procedures for protecting customer information and records. Although the policies of those institutions may need little revision, there may be many departments or other divisions that will participate in the review. Smaller institutions that need less comprehensive policies may devote more time to implementation or revision of their policies and procedures.

¹⁸⁹See section 248.8.

¹⁹⁰ This estimate was based on a cost of $0.02 per mailing to 130.7 million accounts every other year ($0.02 x 130.7 x 5 = $1.3 million). One commenter stated that it would cost $0.40 per piece to mail the privacy notices, the same cost as mailing a confirmation statement. We believe that this commenter assumed that it would have to provide a privacy notice to its existing customers in a separate mailing (as a confirmation must be sent). The extended compliance date should permit broker-dealers, funds, and registered advisers to mail privacy notices to existing customers together with another mailing, such as an account statement or shareholder report, so that the costs will be significantly reduced. The other commenter used our estimate of $0.02 in its estimate of mailing costs, and we have continued to use that estimate in our final cost-benefit analysis.

VIII. Paperwork Reduction Act

Certain provisions of the rules contain "collection of information" requirements within the meaning of the Paperwork Reduction Act of 1995 (44 U.S.C. 3501-3520). The Commission published notice soliciting comments on the collection of information requirements in the Proposing Release,¹⁹¹ and submitted these requirements to the Office of Management and Budget ("OMB") for review in accordance with 44 U.S.C. 3507(d) and 5 CFR 1320.11. OMB approved the regulation's information collection requirements.¹⁹² An agency may not conduct or sponsor, and a person is not required to respond to, an information collection unless it displays a currently valid OMB control number.¹⁹³

¹⁹¹See Proposing Release, supra note 4, at section V.

¹⁹² The title for the collections of information is: "Regulation S-P." The OMB control number for Regulation S-P is 3235-0537 (expiration date April 30, 2003).

¹⁹³ 44 U.S.C. 3506(c)(1)(B)(v).

IX. Summary of Final Regulatory Flexibility Analysis

The Commission has prepared a Final Regulatory Flexibility Analysis ("FRFA" or "analysis") for Regulation S-P in accordance with 5 U.S.C. 604. The following summarizes the FRFA. A copy of the FRFA may be obtained by contacting Penelope W. Saltzman, Securities and Exchange Commission, 450 5th Street, NW., Washington, DC 20549-0506.

The analysis explains that Regulation S-P implements provisions of Title V and that, in general, Title V requires financial institutions to provide notice to consumers about the institution's privacy policies and practices. The statute also restricts the ability of a financial institution to share nonpublic personal information about consumers with nonaffiliated third parties, and allows consumers to prevent the institution from sharing nonpublic personal information about them with certain nonaffiliated third parties by "opting out" of the information sharing. In addition, Title V requires the Commission to establish appropriate standards for financial institutions subject to their jurisdiction to safeguard customer information and records.

Section 504 of the G-L-B Act authorizes the Commission and the Agencies to prescribe "such regulations as may be necessary" to carry out the purposes of Title V. As discussed in the analysis, we believe that by adopting rules implementing Title V that are consistent with and comparable to those of the Agencies, we will provide the private sector greater certainty on how to comply with the statute and clearer guidance on how the rules will be enforced with respect to the financial institutions subject to Title V that are under the Commission's jurisdiction.

The analysis states that the Proposing Release solicited comments on the IRFA, but we received none. Several commenters who addressed the proposed rules, however, suggested that the Commission reduce compliance burdens by, among other things, providing model forms, providing additional examples, adding additional flexibility for providing the initial notice, and extending the effective date. In response to these comments, we have provided a guide to assist brokerdealers, funds, and registered advisers in complying with the rules. The rules also include an Appendix with sample clauses that could be used in privacy notices under appropriate circumstances, and should be of particular help to small entities. Other revisions to the rules include: (i) A compliance date of July 1, 2001 (to allow more time to comply and more opportunity to include initial notices with other mailings); (ii) an example that permits householding annual privacy notices with prospectuses or investor reports delivered under the Commission's householding rules; ¹⁹⁴ and (iii) permitting delivery of an initial notice within a reasonable time after establishing the customer relationship in two additional circumstances.¹⁹⁵ As explained in the analysis, the rules will affect all broker-dealers, funds, and registered advisers, including small entities.¹⁹⁶ We estimate that approximately 1000 out of 5500 brokerdealers, 227 out of 4300 funds, and 1500 out of 8100 registered advisers are small entities.

The analysis explains that subject to certain exceptions, the rules generally require that a financial institution provide all of its customers the following notices: (i) An initial privacy notice (not later than when the customer relationship is established or, by July 1, 2001 for individuals who are your customers on that date); (ii) an opt out notice (before sharing the customer's nonpublic personal information with nonaffiliated third parties); and (iii) an annual privacy notice for the duration of the customer relationship.

The rules also require a financial institution to provide its consumers an initial privacy notice and an opt out notice prior to disclosing the individual's nonpublic personal information with nonaffiliated third parties. If the institution does not intend to share that information about its consumers, then it need not provide them with a privacy or opt out notice.

The many exceptions to the general rules stated above are set forth in sections 248.13, 248.14, and 248.15. The analysis notes that in cases in which a financial institution enters into a contract with a nonaffiliated third party to undertake joint marketing or to have the third party perform certain functions on behalf of the institution, no opt out notice need be given. In those cases, the institution must disclose to the consumer that it is providing the information and enter into a contract with the third party that restricts the third party's use of the information and requires the third party to maintain confidentiality of the information.

As discussed in the analysis, compliance requirements will vary depending, for example, on an institution's information sharing practices, whether the institution already has or discloses a privacy policy, and whether the institution already has established an opt out mechanism. A financial institution would have to summarize its practices regarding its collection, sharing, and safeguarding of certain nonpublic personal information in its initial and annual notices. However, if the institution does not share that information (or shares only to the extent permitted under the exceptions), its privacy notice may be brief. We believe that many financial institutions already have privacy policies in place as part of usual and customary business practices, and that many broker-dealers, funds, and investment advisers currently do not share nonpublic personal information about consumers with nonaffiliated third parties except as would be consistent with one of the many exceptions in the rules.¹⁹⁷ In the Proposing Release, we estimated that a registered adviser would spend an average of 5 hours to prepare a privacy notice, and a broker-dealer or fund would spend approximately 40 hours on average to prepare a privacy notice. We further understand that those institutions that do share information under one of the permitted exceptions generally have contract provisions that prohibit the third party's use of the information for purposes other than the purpose for which the information was shared. Thus we believe that, as a result of the rules, many financial institutions will not have to provide opt out notices to consumers, will have brief annual privacy notices for customers, and will not need to revise their contracts with nonaffiliated third parties to restrict those parties' use of information.

To minimize the burden and costs of distributing privacy policies, the rules do not specify the method for distributing required notices. As discussed more fully in the analysis, a financial institution may include an initial privacy statement with other required disclosure statements, and may include an annual notice with periodic account statements. We estimate that the costs of distributing the notices will be minimal because an institution will include the notices in mailings or distributions that it already sends to consumers and customers.

The analysis explains that the rules require every broker-dealer, fund, and registered adviser to adopt policies and procedures reasonably designed to safeguard customer records and information. The IRFA noted, and we continue to believe, that most if not all financial institutions already have policies and procedures to address the safety and confidentiality of consumer records and information. Nevertheless, financial institutions may review and revise their policies after the rules are adopted. The amount of time an institution will spend reviewing and revising its policies will depend, among other things, on the institution's current policies and its sharing practices. The rules do not specify the means by which institutions must ensure the safety of customer information and records in order to allow each institution to tailor its policies and procedures to its own systems of information gathering and transfer, and the needs of its customers. As noted in the IRFA, Commission staff estimated that in the first year after the rules are adopted, a financial institution would spend an average of 30 hours to adopt or revise its policies.

Two commenters argued that we underestimated the costs of implementing Regulation S-P. As explained in the analysis, the commenters did not provide estimates of the amount of time or the costs to implement the rules. We have been unable to obtain reliable information regarding these costs. Therefore, we have not provided an estimate of the cost of implementing the rules for individual institutions or for the industry as a whole. Although we recognize that the cost of implementing the rules may be $1 million or more for a large institution that shares information with affiliates and nonaffiliated third parties, we believe the costs for small institutions that do not share nonpublic personal information about consumers will be substantially less.

The analysis explains that the Regulatory Flexibility Act directs the Commission to consider significant alternatives that would accomplish the stated objective, while minimizing any significant adverse impact on small entities. As noted above, we believe that a number of revisions made to the final rules will benefit small entities. Finally, the analysis notes that the rules contain performance rather than design standards. The rules do not specify the (i) form of privacy notices, (ii) method of delivery of the notices to customers and consumers, or (iii) policies and procedures that broker-dealers, funds, and registered advisers must adopt to ensure the privacy of the financial information and records of their customers and consumers. Therefore, the rules provide these entities substantial flexibility that allows them to meet the requirements of Regulation S-P in a way that best suits the institution's individual needs.

¹⁹⁴See section 248.9(c)(2).

¹⁹⁵See section 248.4(e)(1)(ii) and (iii).

¹⁹⁶ For purposes of the Regulatory Flexibility Act, under the Exchange Act a small entity is a broker or dealer that (i) had total capital of less than $500,000 on the date in its prior fiscal year as of which its audited financial statements were prepared or, if not required to file audited financial statements, on the last business day of its prior fiscal year, and (ii) is not affiliated with any person that is not a small entity and is not affiliated with any person that is not a small entity. 17 CFR 240.0-10. Under the Investment Company Act a "small entity" is an investment company that, together with other investment companies in the same group of related investment companies, has net assets of $50 million or less as of the end of its most recent fiscal year. 17 CFR 270.0-10. Under the Investment Advisers Act, a small entity is an investment adviser that "(i) manages less than $25 million in assets, (ii) has total assets of less than $5 million on the last day of its most recent fiscal year, and (iii) does not control, is not controlled by, and is not under common control with another investment adviser that manages $25 million or more in assets, or any person that had total assets of $5 million or more on the last day of the most recent fiscal year. 17 CFR 275.0-7.

¹⁹⁷ For example, as noted in the Proposing Release, investment advisers have fiduciary duties under state law that limit their ability to share information with third parties. See Proposing Release, supra note 4, at n.4. This and other assumptions discussed in this section also are based on staff conversations with representatives from the securities industry.

X. Analysis of Effects on Efficiency, Competition, and Capital Formation

Section 23(a)(2) of the Exchange Act ¹⁹⁸ requires the Commission, in adopting rules under the Exchange Act, to consider the anti-competitive effects of any rules it adopts. The rules, which implement Title V, apply to all brokerdealers, funds, and registered advisers. Each of these institutions must provide initial and annual privacy notices to customers as well as initial notices and opt out forms to consumers before the institution shares nonpublic personal information about consumers with nonaffiliated third parties. These institutions also must establish standards for protecting customer information and records. Other financial institutions will be subject to substantially similar privacy notice and opt out requirements under rules adopted by the Agencies.¹⁹⁹ Under the G-L-B Act, these agencies also are required to adopt rules addressing policies and procedures for protecting customer information.²⁰⁰ Therefore, all financial institutions will have to bear the costs of implementing the rules or substantially similar rules. The rules do not dictate the privacy policies of any financial institution. Some customers may move their accounts from one institution to another based on the institution's privacy policies. Thus, the rules may promote competition among financial institutions based on customers' preferences regarding privacy policies.

Section 3(f) of the Exchange Act ²⁰¹ and section 2(c) of the Investment Company Act ²⁰² require the Commission, when engaging in rulemaking that requires it to consider or determine whether an action is necessary or appropriate in the public interest, to consider whether the action will promote efficiency, competition, and capital formation. We solicited comment on these matters in connection with the proposed rules but received no comment.²⁰³ Our analysis on competition is discussed above. The rules will result in additional costs for financial institutions, which may affect the efficiency of these institutions. On the other hand, the rules will allow customers of financial institutions to compare privacy policies, which may result in customers choosing to do business with a financial institution based on its policies. We are not aware of any effect the rules will have on capital formation.

¹⁹⁸ 15 U.S.C. 78w(a)(2).

¹⁹⁹See, e.g., Banking Agencies' Release, supra note 2.

²⁰⁰ G-L-B Act § 501(b).

²⁰¹ 15 U.S.C. 78c(f).

²⁰² 15 U.S.C. 80a-2(c).

²⁰³See Proposing Release, supra note 4, at section VII.

XI. Statutory Authority

The Commission is adopting Regulation S-P under the authority set forth in section 504 of the G-L-B Act [15 U.S.C. 6804], sections 17 and 23 of the Exchange Act [15 U.S.C. 78q, 78w], sections 31 and 38 of the Investment Company Act [15 U.S.C. 80a-30(a), 80a-37], and sections 204 and 211 of the Investment Advisers Act [15 U.S.C. 80b-4, 80b-11].

Text of Rules

List of Subjects in 17 CFR Part 248

Brokers, Dealers, Investment advisers, Investment companies, Privacy, Reporting and recordkeeping requirements.

For the reasons set out in the preamble, the Commission amends Title 17, Chapter II of the Code of Federal Regulations by adding a new part 248 to read as follows:

PART 248-REGULATION S-P: PRIVACY OF CONSUMER FINANCIAL INFORMATION

Authority: 15 U.S.C. 6801-6809; 15 U.S.C. 78q, 78w, 80a-30(a), 80a-37, 80b-4, and 80b-11.

§ 248.1 Purpose and scope.

§ 248.2 Rule of construction.

The examples in this part and the sample clauses in appendix A of this part provide guidance concerning the rule's application in ordinary circumstances. The facts and circumstances of each individual situation, however, will determine whether compliance with an example or use of a sample clause, to the extent applicable, constitutes compliance with this part.

§ 248.3 Definitions.

As used in this part, unless the context requires otherwise:

Subpart A—Privacy and Opt Out Notices

§ 248.4 Initial privacy notice to consumers required.

§ 248.5 Annual privacy notice to customers required.

§ 248.6 Information to be included in privacy notices.

§ 248.7 Form of opt out notice to consumers; opt out methods.

§ 248.8 Revised privacy notices.

§ 248.9 Delivering privacy and opt out notices.

Subpart B—Limits on Disclosures

§ 248.10 Limits on disclosure of nonpublic personal information to nonaffiliated third parties.

§ 248.11 Limits on redisclosure and reuse of information.

§ 248.12 Limits on sharing account number information for marketing purposes.

Subpart C—Exceptions

§ 248.13 Exception to opt out requirements for service providers and joint marketing.

§ 248.14 Exceptions to notice and opt out requirements for processing and servicing transactions.

§ 248.15 Other exceptions to notice and opt out requirements.

Subpart D—Relation to Other Laws; Effective Date

§ 248.16 Protection of Fair Credit Reporting Act.

Nothing in this part shall be construed to modify, limit, or supersede the operation of the Fair Credit Reporting Act (15 U.S.C. 1681 et seq.), and no inference shall be drawn on the basis of the provisions of this part regarding whether information is transaction or experience information under section 603 of that Act.

§ 248.17 Relation to State laws.

§ 248.18 Effective date; transition rule.

§§ 248.19-248.29 [Reserved]

§ 248.30 Procedures to safeguard customer records and information.

Every broker, dealer, and investment company, and every investment adviser registered with the Commission must adopt policies and procedures that address administrative, technical, and physical safeguards for the protection of customer records and information. These policies and procedures must be reasonably designed to:

Appendix A to Part 248—Sample Clauses

Financial institutions, including a group of financial holding company affiliates that use a common privacy notice, may use the following sample clauses, if the clause is accurate for each institution that uses the notice. (Note that disclosure of certain information, such as assets, income, and information from a consumer reporting agency, may give rise to obligations under the Fair Credit Reporting Act, such as a requirement to permit a consumer to opt out of disclosures to affiliates or designation as a consumer reporting agency if disclosures are made to nonaffiliated third parties.)

A-1—Categories of Information You Collect (All Institutions)

You may use this clause, as applicable, to meet the requirement of § 248.6(a)(1) to describe the categories of nonpublic personal information you collect.

Sample Clause A-1:

We collect nonpublic personal information about you from the following sources:

• Information we receive from you on applications or other forms;






 
•  
•  
•  
• Information about your transactions with us, our affiliates, or others; and






 
•  
•  
•  
• Information we receive from a consumer reporting agency.

A-2—Categories of Information You Disclose (Institutions That Disclose Outside of the Exceptions)

You may use one of these clauses, as applicable, to meet the requirement of § 248.6(a)(2) to describe the categories of nonpublic personal information you disclose. You may use these clauses if you disclose nonpublic personal information other than as permitted by the exceptions in §§ 248.13, 248.14, and 248.15.

Sample Clause A-2, Alternative 1:

We may disclose the following kinds of nonpublic personal information about you:

• Information we receive from you on applications or other forms, such as [provide illustrative examples, such as "your name, address, social security number, assets, and income"];






 
•  
•  
•  
• Information about your transactions with us, our affiliates, or others, such as [provide illustrative examples, such as "your account balance, payment history, parties to transactions, and credit card usage"]; and






 
•  
•  
•  
• Information we receive from a consumer reporting agency, such as [provide illustrative examples, such as "your creditworthiness and credit history"].

Sample Clause A-2, Alternative 2:

We may disclose all of the information that we collect, as described [describe location in the notice, such as "above" or "below"].

A-3—Categories of Information You Disclose and Parties to Whom You Disclose (Institutions That Do Not Disclose Outside of the Exceptions)

You may use this clause, as applicable, to meet the requirements of §§ 248.6(a)(2), (3), and (4) to describe the categories of nonpublic personal information about customers and former customers that you disclose and the categories of affiliates and nonaffiliated third parties to whom you disclose. You may use this clause if you do not disclose nonpublic personal information to any party, other than as permitted by the exceptions in §§ 248.14 and 248.15.

Sample Clause A-3:

We do not disclose any nonpublic personal information about our customers or former customers to anyone, except as permitted by law.

A-4—Categories of Parties to Whom You Disclose (Institutions That Disclose Outside of the Exceptions)

You may use this clause, as applicable, to meet the requirement of § 248.6(a)(3) to describe the categories of affiliates and nonaffiliated third parties to whom you disclose nonpublic personal information. You may use this clause if you disclose nonpublic personal information other than as permitted by the exceptions in §§ 248.13, 248.14, and 248.15, as well as when permitted by the exceptions in §§ 248.14 and 248.15.

Sample Clause A-4:

We may disclose nonpublic personal information about you to the following types of third parties:

• Financial service providers, such as [provide illustrative examples, such as "mortgage bankers, securities broker-dealers, and insurance agents"];






 
•  
•  
•  
• Non-financial companies, such as [provide illustrative examples, such as "retailers, direct marketers, airlines, and publishers"]; and






 
•  
•  
•  
• Others, such as [provide illustrative examples, such as "non-profit organizations"].

We may also disclose nonpublic personal information about you to nonaffiliated third parties as permitted by law.

A-5—Service Provider/Joint Marketing Exception

You may use one of these clauses, as applicable, to meet the requirements of § 248.6(a)(5) related to the exception for service providers and joint marketers in § 248.13. If you disclose nonpublic personal information under this exception, you must describe the categories of nonpublic personal information you disclose and the categories of third parties with whom you have contracted.

Sample Clause A-5, Alternative 1:

We may disclose the following information to companies that perform marketing services on our behalf or to other financial institutions with which we have joint marketing agreements:

• Information we receive from you on applications or other forms, such as [provide illustrative examples, such as "your name, address, social security number, assets, and income"];






 
•  
•  
•  
• Information about your transactions with us, our affiliates, or others, such as [provide illustrative examples, such as "your account balance, payment history, parties to transactions, and credit card usage"]; and






 
•  
•  
•  
• Information we receive from a consumer reporting agency, such as [provide illustrative examples, such as "your creditworthiness and credit history"].

Sample Clause A-5, Alternative 2:

We may disclose all of the information we collect, as described [describe location in the notice, such as "above" or "below"] to companies that perform marketing services on our behalf or to other financial institutions with whom we have joint marketing agreements.

A-6—Explanation of Opt Out Right (Institutions That Disclose Outside of the Exceptions)

You may use this clause, as applicable, to meet the requirement of § 248.6(a)(6) to provide an explanation of the consumer's right to opt out of the disclosure of nonpublic personal information to nonaffiliated third parties, including the method(s) by which the consumer may exercise that right. You may use this clause if you disclose nonpublic personal information other than as permitted by the exceptions in §§ 248.13, 248.14, and 248.15.

Sample Clause A-6:

If you prefer that we not disclose nonpublic personal information about you to nonaffiliated third parties, you may opt out of those disclosures, that is, you may direct us not to make those disclosures (other than disclosures permitted by law). If you wish to opt out of disclosures to nonaffiliated third parties, you may [describe a reasonable means of opting out, such as "call the following toll-free number: (insert number)"].

A-7—Confidentiality and Security (All Institutions)

You may use this clause, as applicable, to meet the requirement of § 248.6(a)(8) to describe your policies and practices with respect to protecting the confidentiality and security of nonpublic personal information.

Sample Clause A-7:

We restrict access to nonpublic personal information about you to [provide an appropriate description, such as "those employees who need to know that information to provide products or services to you"]. We maintain physical, electronic, and procedural safeguards that comply with federal standards to guard your nonpublic personal information.

By the Commission.

Dated: June 22, 2000.

Margaret H. McFarland,
Deputy Secretary.