WASHINGTON and ARLINGTON, Va. - Eventually, CU trade association lobbyists-primarily CUNA's-had to get involved in last year's mammoth, meandering, and largely CU-neutral modernization bill now known as the Gramm-Leach-Bliley Financial Services Modernization Act. The collateral damage to CU operations from a sleeper of an embedded issue that awoke to become a major consumer screamer and legislative nightmare could have been enormous but for the timely preemptive action (CU Times, October 27, 1999.) And this fact is only now becoming painfully clear as credit unions begin to grapple with the intricate, exacting, and possibly expensive provisions of the law's privacy component, incorporated into NCUA's proposed privacy rule and released for public comment in February (CU Times, March 8.) The proposed rule-regulating, in maze-like fashion, the defining, collecting, handling, and use of consumer financial information as well as associated notices and exceptions-is to be finalized by May 12 and implemented by November 13. Passed last year-primarily under the stewardship of House Banking Committee Chairman Jim Leach (R-Iowa)-after several historical failures in the area, Gramm-Leach-Bliley overturned outdated Glass-Steagall Act restrictions on the mingling of banking, insurance, and securities businesses and allowed for much-heralded "one-stop shopping" within the financial services community. But it also raised the specter-through enhanced cross-marketing and information-sharing capacities among the newly combined industries-of consumer privacy abuses, and bill proponents had to act quickly to douse a firestorm of public protest that suddenly flared up around the issue. The result was a patchwork of privacy provisions, cutting across the regulatory turf of a half-dozen federal agencies-within an encompassing patchwork of modernization provisions-that will subject credit unions to privacy regulation by NCUA, the Federal Reserve System, the Federal Trade Commission, and the Securities and Exchange Commission, depending on the services they offer. Painstakingly nuanced CUNA and NAFCU comment letters, submitted March 31, addressed all functional regulators, but the ones to NCUA were perhaps the most important-and unsettling. "Credit unions are very concerned about the initial, annual, and opt out notices...," CUNA Assistant General Counsel Jeffrey Bloch wrote about a provision considered "most burdensome" by the trade association. "Credit unions should not be required to send privacy notices to nonprimary accountholders, co-borrowers, guarantors, or beneficiaries." Block added that the cost of collecting such data would be exorbitant and not cost-effective, and that doing so-because it is often either not collected or not readily available to the CU itself-actually runs at cross-purposes with a law that seeks to ensure consumer privacy. NAFCU largely agreed, with Becker saying (in his comments to all functional regulators), "...credit unions commonly collect `identifying' information...for members only. As a result, credit unions have no way to `collect' information on the nonmember...and therefore cannot be shared with an affiliate or a nonmember third party." He added that all trust beneficiaries should be exempted from rule notice requirements, until their "continuing relationship" becomes activated. And on another issue Bloch wrote,"Compliance with the privacy rule should be voluntary as of November 13, 2000, and should not be mandatory until April 13, 2001." Becker asked for a six month extension of rule implementation. "CUSOs should be considered affiliates of a credit union regardless of the ownership percentage," said Bloch of the proposal requirement that CUs must own at least 25% of a CUSO in order for it to be considered an affiliate (conferring certain information-sharing privileges). Becker agreed. Bloch then went on to list eight more suggestions CUNA had on the subject, including: * defining the crucial concept of "publicly available information" as information that could be derived from a public source even if it is not actually so obtained; * coordinating the method, form, and timing of required privacy and opt-out notices so as to impose the lowest cost and least disruption of CU operations, including allowing initial privacy notice to be conveyed either before or after the membership application is processed (since no transaction can take place prior to processing)-as is the case with Truth in Savings disclosures; and * requesting further guidance concerning the protection of confidentiality, security, and integrity of personal information. In his letter to NCUA, Becker went on to recommend that corporate credit unions be exempted from the privacy regulation; that NCUA's use of the word "customer" and "customer relationship" be replaced by "member" and "continuing relationship"; that a list of financial activities statutorily constituting a "financial institution" be listed in the rule; and that the agency's suggestions for a "detachable pre-addressed form or self-addressed, stamped reply form" be eliminated as a possible opt-out reply vehicle in favor of the less expansive-and expensive-"reply form." Among his general comments to all functional regulators Becker pressed for a definition of "nonpublic personal information" as one that includes "publicly available"-though not necessarily so obtained-information; and he requested that the agencies not use the crucial terms "nonpublic personal information" and "personally identifiable" information interchangeably because the former does not always identify individuals, its differentiation would allow greater information-sharing leeway, and its confusion with the latter could result in privacy notices being required for nonprimary accountholders. -
gmcorrigan@mindspring.com
