Office of Consumer Credit Regulation

Maine Creditor Update

 Issue #40                   

				

Issue #40			Regulatory News for Maine’s Creditors             	        	 October 2001

Special “Privacy Notice” Issue

   In 1999, Congress passed a law called the Gramm-Leach-Bliley Act, which contained certain privacy standards for the collecting and sharing of consumer information.	

   Those same standards have now been incorporated into Maine Law; see PL 2000, Chapter 262.*

   Under the state and federal laws, any company which collects personal, financial information from its customers is required to give those customers a privacy notice.

   In the notice, the company must tell those customers how it collects personal, financial information, and whether it intends to share that information.

   In addition, if a company wishes to share that information with other, unaffiliated companies, the privacy notice must offer the customer a way to “opt out,” in order to prohibit the sharing of the information.

   The notices must be provided at two different times: first, a consumer must be given a copy when he or she first becomes a customer; and second, the notice must be sent once each year to all existing customers.

   The laws affect a wide variety of financial businesses.  In addition to banks and credit unions, many other types of businesses must provide privacy notices: mortgage companies; collection agencies which purchase delinquent accounts; auto dealerships; retail creditors; money transmitters; rent-to-own stores; pawn shops; check cashers; foreign currency exchangers; non-bank ATM operations; real estate settlement agents; and most other providers of financial services to consumers.

   If you have received this special edition of the  Maine Creditor Update,  then it is likely  that you are

a company regulated by the Maine Office of Consumer Credit Regulation and that these new requirements apply to you.  During all upcoming routine compliance exams, our examiners will be making certain that you have drafted these notices, that you are distributing them correctly, and if applicable, that you are honoring consumers’ requests to opt out.  Failure to have such forms available, and to use them properly, will be cited as violations in the written Report of Examination. 

   The Maine law on privacy notices is identical to the federal law, so if you are in compliance with the federal requirements, you are also in compliance with the state statutes.

   To assist companies to comply with the new requirements, we have enclosed the following information for your review:

1)	A new brochure published by the Department of Professional & Financial Regulation, titled “A Consumer’s Guide to Financial Privacy Rights under the Gramm-Leach-Bliley Act”;

2) “Frequently Asked Questions” about privacy notices, designed for consumers’ information and found on our agency’s website at www.MaineCreditReg.org; and 

3) Sample language developed by federal regulatory agencies,** which you and your legal advisor can use to draft a notice for your business.

    If you have any questions you should speak with your own attorney, trade association, or other source of compliance information.  To the extent possible, our agency will continue to use our best efforts to provide general advice and assistance as you bring your company into compliance with these new requirements.

* The 120th Legislature’s Session laws are available at http://janus.state.me.us/legis/ , under “Constitution, Statutes & Laws.”
** For example, the FTC’s final privacy rule can be found at  www.ftc.gov/privacy/glbact/index.html .

PRIVACY NOTICE FREQUENTLY ASKED QUESTIONS

1. I have been receiving privacy notices in the mail from my bank and credit union, finance company, insurance company, and investment firm. What is this all about?
In 1999 the Federal government passed a law called the Gramm-Leach Bliley Act. The law requires these institutions to send you a notice regarding your privacy rights by July 1, 2001. In the notices, the companies must tell you what information they collect about you and with whom they share that information. Further, they must offer you an opportunity to "opt-out" of having your information shared beyond exceptions provided by law. 
2. What exactly is Gramm-Leach-Bliley and who does it affect?
Gramm-Leach-Bliley ("GLB") is also known as the Financial Services Modernization Act. It removed most of the legal barriers that previously existed between the banking, insurance, and securities industries. GLB established consumer privacy standards, including notice requirements, limits on information sharing, and requirements to protect the confidentiality and security of personal information.
Banks, credit unions, mortgage companies, finance companies, insurance companies, insurance agents, and investment firms are all subject to Gramm-Leach-Bliley. The law also applies to some retailers and automobile dealers that collect and share information about consumers to whom they extend credit or for whom they arrange credit.
3. Some of these notices use words like "opt out." What does this mean?
"Opt out" means that you have an opportunity to say no ("opt out") before a financial institution shares information about you. Generally, Gramm-Leach-Bliley requires that consumers be given the right to "opt out" before personal information about them is shared with companies outside of the corporate family. If you exercise your right to "opt out," then (with the limited exceptions discussed below) the institution may not share nonpublic personal information about you with companies that are not part of the same parent organization. It is up to you to tell the company if you don't want your personal financial information shared without your permission. If you do not opt out, the company may share information with third parties in the way they describe in the notice it sends you.
4. What do they mean when they say they share information "as permitted by law"?
There are certain uses of nonpublic personal information for ordinary business purposes that are exceptions to the "opt out" right. These are often described in generic terms in privacy notices, using language such as "disclosures permitted by law." For example, personal information about you may be disclosed to carry out a transaction you have requested, to service your account, to prevent fraud, as part of an examination by regulators, or to an auditor, rating agency, or prospective buyer of the institution. In addition, information other than health information may be shared within the corporate family or under joint marketing agreements with other institutions. In all these cases, the third party receiving the personal information must protect its confidentiality and may not use or disclose the information for other purposes.
5. What kind of information can be shared if I do not opt out?
Any information that the institution may share with companies outside of the corporate family must be described in the privacy notice you receive. The types of personal financial information that may be shared if you do not opt out include:
•	Information you put on an application to obtain a loan, credit card, or other financial product or service; 
•	Account balance information, payment history, overdraft history, investments purchased or owned and credit or debit card purchase information; 
•	The fact that you are a customer; 
•	Any information provided by you in connection with collecting or servicing a loan; 
•	Information provided by you for purposes of analyzing your investments; 
•	Information collected through an Internet "cookie"; 
•	Information from a consumer report. 
6. What kind of a notice does the institution have to give to me about its privacy policy?
GLB requires the institution to give you a privacy notice that describes the types of information collected by the institution and if the institution might share your information, the types of businesses with whom the information might be shared. This notice must first be provided to existing customers by July 1, 2001 and then once a year after that. If you begin to do business with an institution after July 1, 2001, the notice must be given at the time the account is opened and then once a year. 
This notice must also tell you how to exercise your right to "opt out" or say "no" to sharing your information. The institution may require you to return a form they send you or they may give you a toll free telephone number to call. However, the institution cannot require that you write your own letter as the only way to opt out of information sharing. If the institution does not provide an opportunity to "opt-out", then it cannot share your information except as specifically permitted by law in the ordinary course of business.
Finally, the notice must also tell you how the institution will protect the confidentiality and security of your information.
7. Can I still protect my personal financial information under an "opt out" standard and prohibit the sharing of that information?
Yes. If you exercise your right to "opt out," then an institution may not share your personal financial information, unless it is otherwise permitted under state or federal law. Some provisions of Maine law provide considerable civil money penalties for institutions that violate these confidentiality requirements. Banks, for example, could be fined up to $10,000 per violation.
8. If I choose to opt out, how long will it last?
If you choose to opt out, that choice is effective until you revoke it in writing.
9. What if I don't opt out when I first receive the privacy notice? Can I opt out later?
Yes. A consumer can opt out at any time, but it will only affect the future sharing of information and will not be retroactive.
10. What if I don't understand the privacy notices? 
GLB requires that the notices be clear and conspicuous, and that they accurately explain the right to opt out. If an institution does not comply with the privacy requirements or does not provide clear disclosures, the State may investigate, bring an enforcement action, or assess fines. If you don't understand a privacy notice, you may contact the company that sent it to you or you may contact the agencies below for assistance.
11. What should I do if I threw away or lost my privacy notice?
You should contact the institution involved to request a new notice.
12. Are there any other steps that I can take to protect my privacy and limit the sharing of personal information?
Yes, existing state and federal laws give you the right to reduce or eliminate telemarketing calls, unsolicited e-mails and pre-screened credit offers.
•	To prevent pre-screened offers from all three major credit reporting agencies: Call 1-888-5-OPT-OUT (1-888-567-8688). 
•	One major credit reporting agency (Experian) also permits you to opt out of receiving marketing and promotional information from its clients. Call 1-800-407-1088. 
•	To avoid unwanted phone calls from many national marketers, send your name, address and phone number to Direct Marketing Association (DMA), Telephone Preference Service, PO Box 9014, Farmingdale, NY 11735-9014. 
•	To remove your name from national direct mail lists, write Direct Marketing Association, Mail Preference Service, PO Box 9008, Farmingdale, NY 11735-9008. 
•	To remove your e-mail address from many national direct e-mail lists, follow the instructions found at DMA's e-mail preference service website, www.e-mps.org. 
•	Regarding driver's license information, the Maine Secretary of State's Office no longer shares such information with marketing or promotional companies. You only need to contact the Bureau of Motor Vehicles if you wish to "opt in," to permit the sharing of that information. 
13. What if I have problems getting information from my financial services provider?
The following agencies within the Department of Professional and Financial Regulation are available to assist you:
For questions about banks and credit unions, contact the Bureau of Banking: 1-800-965-5235; Internet website: www.MaineBankingReg.org
For questions about insurance companies or insurance agents, contact the Bureau of Insurance: 1-800-300-5000; Internet website: www.MaineInsuranceReg.org
For questions about mortgage companies, finance companies, automobile dealers and other providers of consumer credit contact the Office of Consumer Credit Regulation: 1-800-332-8529; Internet website: www.MaineCreditReg.org
For questions about investment firms and securities issues contact the Office of Securities: 1-877-624-8551; Internet website: www.MaineSecuritiesReg.org.

 *Note:  “Sample Language for Privacy Notices” follows on the next page*

SAMPLE LANGUAGE FOR PRIVACY NOTICES

	Several federal agencies, including the Federal Trade Commission, have issued regulations regarding financial privacy notices.  These regulations include sample language designed to help financial service companies disclose to consumers the different ways they gather and share consumer information.  Suggested opt-out language is also provided.  Since the requirements of Maine law are identical to the federal standards, the sample language from the Federal Trade Commission’s regulation is reprinted below for your review.  You and your legal advisor may find the suggested language helpful as you draft a privacy notice based on your own company’s actual practices.  Use of this sample language is not a substitute for gaining a complete understanding of your company’s responsibilities under the privacy laws.

Source:  16 CFR Part 313, Federal Trade Commission, “Privacy of Consumer Financial Information:  Final Rule”; Pages 33688 – 33689

Appendix A to Part 313—Sample
Clauses *
Financial institutions, including a group of financial holding company affiliates that use a common privacy notice, may use the following sample clauses, if the clause is accurate for each institution that uses the notice. (Note that disclosure of certain information, such as assets and income, and information from a consumer reporting agency, may give rise to obligations under the Fair Credit Reporting Act, such as a requirement to permit a consumer to opt out of disclosures to affiliates or designation as a consumer reporting agency if disclosures
are made to nonaffiliated third parties.)

A–1—Categories of Information You Collect
(All Institutions)
You may use this clause, as applicable, to
meet the requirement of § 313.6(a)(1) to
describe the categories of nonpublic personal information you collect.

Sample Clause A–1
We collect nonpublic personal information
about you from the following sources:
· Information we receive from you on
applications or other forms;
· Information about your transactions with us, our affiliates, or others; and
· Information we receive from a consumer
reporting agency.

A–2—Categories of Information You Disclose
(Institutions That Disclose Outside of the
Exceptions)
You may use one of these clauses, as applicable, to meet the requirement of § 313.6(a)(2) to describe the categories of nonpublic personal information you disclose.  You may use these clauses if you disclose nonpublic personal information other than as permitted by the exceptions in §§ 313.13, 313.14, and 313.15.

Sample Clause A–2, Alternative 1
We may disclose the following kinds of nonpublic personal information about you:
· Information we receive from you on
applications or other forms, such as [provide illustrative examples, such as ‘‘your name, address, social security number, assets, and income’’]; 
· Information about your transactions with us, our affiliates, or others, such as [provide illustrative examples, such as ‘‘your account balance, payment history, parties to transactions, and credit card usage’’]; and
· Information we receive from a consumer reporting agency, such as [provide illustrative

examples, such as ‘‘your creditworthiness and credit history’’].

Sample Clause A–2, Alternative 2
We may disclose all of the information that we collect, as described [describe location in the notice, such as ‘‘above’’ or ‘‘below’’].

A–3—Categories of Information You Disclose and Parties to Whom You Disclose (Institutions That Do Not Disclose Outside of the Exceptions)
You may use this clause, as applicable, to
meet the requirements of §§ 313.6(a)(2), (3),and (4) to describe the categories of nonpublic personal information about customers and former customers that you disclose and the categories of affiliates and nonaffiliated third parties to whom you disclose. You may use this clause if you do not disclose nonpublic personal information to any party, other than as permitted by the exceptions in §§ 313.14, and 313.15.

Sample Clause A–3
We do not disclose any nonpublic personal
information about our customers or former customers to anyone, except as permitted by law.

A–4—Categories of Parties to Whom You
Disclose (Institutions That Disclose Outside of the Exceptions)
You may use this clause, as applicable, to meet the requirement of § 313.6(a)(3) to describe the categories of affiliates and nonaffiliated third parties to whom you disclose nonpublic personal information. You may use this clause if you disclose nonpublic personal information other than as permitted by the exceptions in 
§§ 313.13, 313.14, and 313.15, as well as when permitted by the exceptions in 
§§ 313.14, and 313.15.

Sample Clause A–4
We may disclose nonpublic personal
information about you to the following types of third parties:
· Financial service providers, such as [provide illustrative examples, such as ‘‘mortgage bankers, securities broker-dealers, and insurance agents’’];
· Non-financial companies, such as
[provide illustrative examples, such as
‘‘retailers, direct marketers, airlines, and
publishers’’]; and
· Others, such as [provide illustrative
examples, such as ‘‘non-profit organizations’’].
We may also disclose nonpublic personal
information about you to nonaffiliated third parties as permitted by law.

A–5—Service Provider/Joint Marketing
Exception
You may use one of these clauses, as applicable, to meet the requirements of  § 313.6(a)(5) related to the exception for service providers and joint marketers in § 313.13. If you disclose nonpublic personal information under this exception, you must describe the categories of nonpublic personal information you disclose and the categories of third parties with whom you have contracted.

Sample Clause A–5, Alternative 1
We may disclose the following information to companies that perform marketing services on our behalf or to other financial institutions with whom we have joint marketing agreements:
· Information we receive from you on
applications or other forms, such as [provide illustrative examples, such as ‘‘your name, address, social security number, assets, and income’’];
· Information about your transactions with us, our affiliates, or others, such as [provide illustrative examples, such as ‘‘your account balance, payment history, parties to transactions, and credit card usage’’]; and
· Information we receive from a consumer reporting agency, such as [provide illustrative examples, such as ‘‘your creditworthiness and credit history’’].

Sample Clause A–5, Alternative 2
We may disclose all of the information we
collect, as described [describe location in the notice, such as ‘‘above’’ or ‘‘below’’] to companies that perform marketing services on 
our behalf or to other financial institutions with whom we have joint marketing agreements.

A–6—Explanation of Opt Out Right
(Institutions that Disclose Outside of the
Exceptions)
You may use this clause, as applicable, to meet the requirement of § 313.6(a)(6) to provide an explanation of the consumer’s right to opt out of the disclosure of nonpublic personal information to nonaffiliated third parties, including the method(s) by which the consumer may exercise that right. You may use this clause if you disclose nonpublic personal information other than as permitted by the exceptions in 
§§ 313.13, 313.14, and 313.15.

Sample Clause A–6
If you prefer that we not disclose
nonpublic personal information about you to nonaffiliated third parties, you may opt out of those disclosures, that is, you may direct us not to make those disclosures (other than disclosures permitted by law). If you wish to opt out of disclosures to nonaffiliated third parties, you may [describe a reasonable means of opting out, such as ‘‘call the following toll-free number: (insert number)’’].

A–7—Confidentiality and Security (All
Institutions)
You may use this clause, as applicable, to meet the requirement of § 313.6(a)(8) to describe your policies and practices with respect to protecting the confidentiality and security of nonpublic personal information.
Verdant 11<MAY>2000 14:55 May 23, 2000 
Sample Clause A–7
We restrict access to nonpublic personal information about you to [provide an appropriate description, such as ‘‘those employees who need to know that information to provide products or services to you’’]. We maintain physical, electronic, and procedural safeguards that comply with federal regulations to guard your nonpublic personal information.

NOTE:  This bulletin is solely for informational purposes.  It is not intended to set forth legal rights, duties or privileges, nor is it intended to provide legal advice.  Readers are encouraged to consult applicable statutes and regulations and to contact the Office Consumer Credit Regulation if additional information is needed.