Analysis of the California Financial Information Privacy Act ( SB1 ) by Leland Chan, General Counsel California Bankers Association

Transcription

1 Analysis of the California Financial Information Privacy Act ( SB1 ) by Leland Chan, General Counsel California Bankers Association The California Financial Information Privacy Act ( SB1 ) 1 was signed on August 27, 2003 and became effective July 1, The bill had failed to pass for three successive years, and was finally signed by former Governor Gray Davis as the industry removed its opposition after securing key concessions. Among these are: more equal treatment as between information sharing with affiliates and with joint marketing partners. CBA consistently and vigorously opposed prior versions of the bill that disfavored joint marketing agreements, which are used more by smaller banks. 2 elimination of a private right of action. protection of operational and transactional uses of customer information. more limited use of a separate state privacy notice. preemption of local privacy ordinances. Overview. The overall structure of SB1 is similar to the privacy provisions of the Gramm-Leach-Bliley Act (GLBA). The key definitions largely track those in GLBA, except where noted. 3 The GLBA distinction between customer and consumer is not made in SB1. However, the bill does not require an annual notice for a one-off purchaser of a product or service. If such a consumer s information is to be shared, then the consumer must be furnished with the appropriate notice and option. 4 Note that the helpful guidelines provided in GLBA regarding stale customer relationships (accounts that are inactive) are not included in SB1. 1 SB1 is codified in the California Financial Code, beginning with Section Unless otherwise noted, all references are to the California Financial Code. You may view this or any other California code at 2 The broad GLBA definition of financial institution is used in SB1. In this Bulletin, unless otherwise indicated, the term bank may be used to refer to all covered financial institutions. 3 SB1does not include the specific GLBA carve-out for information that does not identify a consumer, such as aggregate information or blind data that does not contain personal identifiers. Nevertheless, even without a similar exception, it would be difficult to characterize such data, even under the state law, as personally identifiable. 4 Section 4053(d)(5).

2 Two types of notices are contemplated opt-out and opt-in. The sole opt-in requirement applies to disclosures of customer information to nonaffiliated third parties for the marketing of non-financial products and services. Information sharing among affiliates for marketing purposes and with nonaffiliated third parties pursuant to marketing agreements is generally subject to a consumer right to opt-out. However, if a bank does not share information outside the entity for marketing purposes, no California notice is required. No notice or consumer election applies to information sharing among wholly-owned, affiliated financial institutions that are in the same line of business when marketing products and services that share a common brand. There are also special allowances for joint employees of the bank and of the bank s affiliate 5 or nonaffiliated third party, 6 and where customer information is maintained in information systems that are used in common by affiliated entities. CBA and coalition partners were able to ensure that the GLBA exceptions are included in the bill, so that non-marketing uses of information are not affected. Another key change in the final bill is the elimination of a private right of action to obtain civil penalties. Violations are subject to civil penalties of up to $2,500 per incident, but the right to enforce lies exclusively with the state attorney general and functional regulators. 7 Nevertheless, private rights of action filed under the state s Unfair Competition Law (Business & Professions Code Section et. seq.) are not necessarily foreclosed. Financial institutions may be subject to actions to seek injunctive relief and restitution based on alleged violations of SB1 (civil penalties may be sought pursuant to B&P Section only in government actions). At the time SB1 was passed, the affiliate sharing restrictions in SB1 were widely believed to be preempted by the Fair Credit Reporting Act ( FCRA ). The federal district court in Northern California so held last year in a case brought against Daly City and other municipalities, in which CBA participated as friend of the court. The court ruled that the FCRA preempted the financial privacy ordinances passed by the municipalities as to affiliate sharing, but not as to third party sharing. 8 More recently, the district court in the Eastern District of California held that SB1 was not preempted by the FCRA, but indeed is specifically contemplated by the savings clause under GLBA. That decision is being appealed to the Ninth Circuit. Definitions and coverage The key SB1 definitions, including nonpublic personal information (hereafter, customer information or just information ), financial institution, and affiliate track those of GLBA. SB1 covers the disclosure of nonpublic personal information of California residents only. 9 A bank is covered if it is doing business in the state. The case law on what constitutes doing business in California runs the gamut Section 4052(d). 6 Section 4052(e). 7 Section Since the passage of SB1, which preempts local financial privacy ordinances, the municipalities took actions to repeal the ordinances. 9 A state resident is someone whose last known mailing address, other than an Armed Forces Post Office or Fleet Post Office address, as shown in the records of the financial institution, is located in California. Section 4052(f). 10 Consider, for example, West Corp. v. Superior Court (Sanford) (2004) 116 Cal.App.4th 1167, in which California jurisdiction was found where a California resident was permitted to sue an out of state telemarketer even though the defendant had no

3 Opt-in. The most touted provision of SB1 is one that the industry is perhaps least concerned over opt-in for sharing customer information with non-affiliated third parties to market non-financial products. 11 The opt-out form must be provided as a separate document (not incorporated with another document) and, to be effective, must be returned signed and dated by the consumer. The consent must clearly and conspicuously disclose: that by signing, the consumer is consenting to information sharing with the institution s nonaffiliated third parties; that the consent will remain in effect until revoked or modified (which can be done at any time); the procedure for revoking consent; and that the bank will retain the consent (or a copy), that a copy is available upon request, and the consumer may want to keep a copy as a record. It is not necessary to identify the third party with whom information may or will be shared, or to describe specifically what information will be shared. Affiliate sharing Disclosures for marketing purposes. The SB1 restrictions on the sharing of customer information among affiliates apply only to marketing uses of information, and not to transactional or administrative uses. The definition of affiliate 12 is the same as that used in GLBA. Note that banks retain the option to market, without restriction, the products and services of affiliates or nonaffiliated third parties to its own customers if the banks do not disclose customer information in the course of marketing. But the bank is still required to enter into a confidentiality agreement with a non-affiliated third party as to the use of the information received from, or gleaned from the application of, responding customers. The agreement must include the right by the bank to verify compliance by the other entity. Two different rules apply to affiliate sharing. The general rule is that a bank may disclose information to an affiliate for marketing purposes only after providing a notice annually that information may be shared and the consumer has not opted out. But, if the bank and the affiliate are in the same line of business, 13 regulated by the same functional regulator, and the provided product or service shares a common brand as between the sharing entities, the notice and opt-out provisions do not apply. For purposes of this exemption, all depository financial institutions entities are regulated by the same regulator. 14 The common brand must consist of more than just a shared name or logo. While no examples are provided, the limiting language is intended to prevent use of the exemption for cross-marketing diverse products that are similar in label only. But given the other requirements (affiliate relationship, line of business), it is not apparent what kind of products and services are intended to be excluded. employees or offices in California, were not licensed to do business in California, did not own California property, and did not advertise the product in question in California. In fact, it was the plaintiff who called the telemarketer, claiming that that the company initiated the upsell of an unwanted product while knowing she was a California resident. 11 Sections and 4053(a). 12 Section 4052(d). 13 Both the disclosing and receiving entity must be in the same line of business, and the only qualifying businesses are banking, insurance, and securities. Section 4053(c)(2). 14 Section 4053(c).

4 For purposes of this exception only, as applied to supervised banks, an affiliate is defined as a whollyowned bank subsidiary (or chain of wholly-owned subsidiaries), or two banks wholly owned by the same bank or holding company. Note that this definition differs from the general definition in two important aspects. First, the subsidiary must be wholly owned and not simply controlled by the bank, and the affiliate and the bank must both be wholly owned by the parent. In contrast, GLB and the general rule under SB1 both refer to the more common definition of control, meaning 25% ownership or voting power. Credit unions under SB1 are deemed to control their credit union service organizations (CUSO s) only if they are at least 67% owned. Second, when referring to regulated banks, the bill excludes the Federal Reserve among the list of banking regulators. But because the state Department of Financial Institutions jointly supervises state Federal Reserve member banks, this omission should not pose a problem with most banks. Note also that the definition of affiliate for purposes of this exemption does not explicitly include a parent holding company, but the omission may be of no consequence. If the holding company performs no services, then its exclusion does not matter. If the holding company engages in support services for its subsidiaries, then the holding company itself may be deemed a financial institution within the broad meaning of the Bank Holding Company Act (12 U.S.C. 1843(k), and thus be qualified to share information with its financial institution subsidiaries. The ability of the bank to share information with the parent under this exception, however, does not appear to be specifically permitted. SB1 includes an additional exception from the notice and opt-out requirement: information is not deemed to be disclosed merely because customer information is maintained in an information system that is used in common by affiliated entities, even though employees from the related entities have access. Similarly, a disclosure does not result merely from a consumer gaining access to a web site jointly operated or maintained under a common name of a bank and its affiliate. It is uncertain how broadly the joint web site exception will be construed. Use of the term access suggests the conveying of information in the form of an internet cookie or other information collecting device rather than, for example, information obtained in the course of applying for a product on line. As to the joint database exception, use of the term merely suggests that it is intended to preclude application of the notice and opt-out requirements if information is shared solely because a family of companies manages its customer data through a separate entity. As drafted, this exception should not be construed to apply if an affiliate uses the bank customer s information to market its own products. The provision goes on to state that if a consumer has exercised his or her right to prohibit disclosure pursuant to this division, nonpublic personal information [may not be] further disclosed or used by an affiliate except as permitted by this division. This presupposes that a customer is given an opportunity to prohibit disclosure. Certainly, if a customer has opted out pursuant to a notice the bank was required to provide for other reasons, then the affiliate would not be permitted to make further use of the customer s information. 15 But even if a right to prohibit a disclosure is not required for other reasons, it would appear that the intent 15 On occasion, a bank will receive a request to opt-out of affiliate sharing in response to a GLBA notice (even though the opportunity to opt-out was not provided), but SB1 does not contemplate this situation because it refers to a consumer direction pursuant to this division.

5 of this exception is to accommodate shared databases, and not to create a broad exception for marketing among affiliates. Credit card rules. The new law includes three special rules governing banks issuing credit cards that bear the name of a non-affiliated third party. But for these rules, a disclosure would otherwise be subject to optout or opt-in. Where a bank issues a credit account bearing the name of a retailer (or a name proprietary to a company primarily engaged in retail sales), the bank may provide the retailer with cardholder name and address information, and a record of the purchases made with the retailer. If the account can only be used for transactions with the retailer or its retail affiliates, then the bank may disclose any nonpublic personal information regarding the account in connection with offering or providing the retailer s products or services. This provision is included in the definition of necessary to effect, administer, or enforce, which prefaces the general transactional and administrative exceptions. 16 A different provision applies to what is called an affinity card program, where a bank issues credit cards bearing the name of an organization or business entity that is not a financial institution (referred to as an affinity partner, but excluding retailers 17 ). A disclosure under this provision is subject to the notice and opt-out requirements. Pursuant to such a program, a bank may disclose the cardholder s name, address, telephone number, address, and a record of purchases made with the affinity partner. 18 In connection with the issuance of any other financial product or service 19 on behalf of an affinity partner, a bank may disclose the customer s contact details only. Also, the disclosure may not be done in a way that reveals any additional customer information. The affinity partner must be contractually obligated to keep customer information confidential and to use the information only to verify membership, verify contact information, or offer the affinity partner s own products or services. If the affinity partner sends an message to the customer, the message must identify the sender and provide a cost-free means for the recipient to elect not to receive further messages. Note that if the bank s privacy notice includes an opt-out provision for non-affiliated third party sharing (pursuant to a joint marketing agreement), it may be prudent to include a separate opt-out notice for sharing with an affinity partner because a general opt-out would also be effective as to sharing with an affinity partner. As noted, a credit card issued in the name of another entity is treated differently under SB1 depending largely on whether the entity is a retailer, referred to as a company primarily engaged in retail sales. The distinction would be justified under the assumption that retail cards are only used for transactions made at the retailer, because the law should not interfere with a bank s ability to service the retailer s accounts. However, the necessary to effect provision clearly contemplates cards that can be used widely. Cards 16 Section 4052(h)(1)(C). 17 Section (e). 18 Section Section (b).

6 issued in the name of non-retailers, for example an airline, would fall under the more restrictive affinity card provision even though those cards may also be used widely. The final credit card provision, the broadest, is available for information sharing pursuant to servicing a private label credit card program. This exception applies to an entity with whom a financial institution operates a program, and is a blanket exception from SB1. 20 None of the terms, retailer, affinity, and private label is defined. Thus, it is not entirely clear when an entity should be treated as a retailer (not subject to consumer election) or under the more restrictive affinity card provision (subject to opt-out and information limits). For example, is a New York Yankees card an affinity card or a retailer card (because the organization sells baseball merchandise)? The private label provision would appear to apply to financial institutions only, but this is only a reasonable inference, since the section refers to another entity rather than a financial institution. Joint marketing agreements A key issue that CBA has refused over the years to compromise on is that the bill must maintain equal treatment of affiliate sharing and sharing with non-affiliated joint marketing partners. The industry had fought for the same result in GLBA to ensure that smaller banks, which typically do not have affiliate relationships, are able to provide a broad array of financial products and services through marketing agreements with third party providers. The final version of SB1 makes what is known under GLBA as joint marketing agreements subject to optout rather than opt-in (that is, it is treated generally the same as affiliate sharing). 21 Once again, only the disclosure of information to third parties for marketing purposes is subject to opt-out. Broad exemptions are available for disclosures for operational and administrative purposes. A bank may share customer information with a nonaffiliated financial institution pursuant to an agreement to offer financial products or services jointly. The agreement must require the receiving institution to maintain the confidentiality of the information and prohibit it from disclosing or using the information other than in the course of providing the jointly offered product or service. Agreements entered into prior to January 1, 2004 are not subject to the notice and opt-out requirement until January 1, Details of notice requirement SB1 does not distinguish between an initial and annual notice. Also, unlike GLBA, it does not provide guidance on the timing of providing a notice when a customer relationship is established,. The general rule is that information may not be shared until 45 days after an annual notice and opportunity to opt-out have been provided. 22 Annual means at least once in any period of 12 consecutive months during which the customer relationship exists Section 4056(b)(1). 21 Section 4053(b)(2). 22 Section 4053(d)(3). 23 Section 4053(d)(5).

7 A form opt-out notice is provided that, if used, creates a conclusive presumption of compliance (see form attached to this Bulletin). Notices that are not in the form provided must be submitted to the state Office of Privacy Protection (OPP) within 30 days after its first use. A rebuttable presumption of compliance applies if a non-statutory form is submitted to the bank s regulator for approval, and the approved form is filed with the OPP. 24 A non-statutory notice must be no more than one page and meet all of the following requirements: Title and headers: the notice must use the title: IMPORTANT PRIVACY CHOICES FOR CONSUMERS and the headers (as applicable), Restrict Information Sharing With Companies We Own Or Control (Affiliates) and Restrict Information Sharing With Other Companies We Do Business With To Provide Financial Products And Services. Clear and conspicuous/format. The titles and headers must be clearly and conspicuously displayed, and no text in the notice may be smaller than 10-point type. The notice must have wide margins and ample line spacing and use boldface or italics for key words. Separate document. The notice must be provided as a separate document, meaning that it may not be incorporated into another document. Opt-out opportunity. The opportunity to opt-out must be stated separately (presumably meaning it cannot be imbedded in a paragraph) and may be exercised by checking a box. Prominence. The notice is designed to call attention to [its] nature and significance. Clarity. The notice uses clear and concise sentences, paragraphs, and sections; uses short explanatory sentences (an average of words) or bullet lists, and avoids multiple negatives, legal terminology, and highly technical terminology, and explanations that are imprecise and readily subject to different interpretations. Flesch score. The notice must achieve a minimum Flesch reading ease score of 50, not including the required title and header(s). As defined in Title 10, Section (a)(7) of the California Code of Regulations, the Flesch Reading Ease Score rates text on a 100-point scale, as follows: (1.015 x ASL) - (84.6 x ASW), where: ASL = average sentence length (the number of words divided by the number of sentences), and ASW = average number of syllables per word (the number of syllables divided by the number of words). The higher the score, the more readable is the text. The language used where the customer makes the election whether to opt-out may not score lower than the corresponding language used in the text of the notice describing the options. Examples may be provided as long as the clarity and readability standards are met. Delivering the notice. The SB1 opt-out notice may be delivered in a number of ways, though no specific mention of personal delivery, such as at the bank upon account opening, is made. It could be delivered by mail alone. If delivered with the GLBA notice, the envelope must either include only additional privacy information and nothing else, or the two notices may be part of an envelope containing a bill, statement of account, or application requested by the consumer. This option would appear to be the most feasible. If the SB1 notice is delivered with any other mailing, it must be the first page of the mailing, and the envelope 24 Section 4053(d)(2)(B).

8 may not include the GLBA notice. Additionally, except where the SB1 notice is delivered with a bill, statement, or application, on the outside of the envelope must be clearly printed in 16-point boldface type: IMPORTANT PRIVACY CHOICES. A privacy notice may be delivered electronically if it complies with applicable provisions of the Electronic Signatures in Global and National Commerce Act (ESIGN Act), complies with the requirements applicable to paper notices (except providing a return envelope), and the notice is delivered in a form the consumer may keep. A consumer may reply electronically, and may not be required to reply in another manner. GLBA does not explicitly refer to the ESIGN Act, which sets forth detailed standards regarding consent, prior notice about the right to receive a paper record, the right to withdraw consent, and other requirements. Also, SB1 does not include the detailed guidance contained in GLBA regulations setting forth the conditions in which an initial notice and annual notice may be provided electronically. SB1 states that an electronic notice must be delivered, and that it is insufficient that it is only made available to the consumer. This would suggest that the notice may not be incorporated into an on-line application process by appearing on a web page or made available as a link, but must be delivered by some time during or after the transaction. It also casts doubt on the ability to notify a customer by of the availability of a new privacy notice that is posted on a web site. Opportunity to opt-out. A consumer must be given a reasonable opportunity after receiving a notice to optout, but no set period of time is provided. A consumer may opt-out at any time, and the bank must comply within 45 days after receipt of the consumer s election. The election is in effect until otherwise stated by the consumer. A self-addressed return envelope must be included with the notice. If the bank has more than $25 million in assets, it must either provide a first class business reply return envelope or a self-addressed envelope along with two alternative cost-free means for opting out, such as use of a toll-free telephone number, a toll-free fax number, or an address. General exceptions The general exemptions available in SB1 largely track those available under GLBA, and include new ones. Exemptions are available: for transactional and servicing purposes in connection with securitizations and secondary market sales upon consumer consent or request to safeguarding information/protecting the bank relating to representatives of the consumer relating to rating agencies, auditors, etc. pursuant to the Right to Financial Privacy Act and other laws governing access by public entities in connection with sales and mergers to comply with legal process and other laws, including specifically the USA PATRIOT Act pursuant to the Fair Credit Reporting Act to report elder abuse

9 to identify or locate missing children, witnesses, criminals and fugitives, parties to lawsuits, parents delinquent in child support payments, organ and bone marrow donors, pension fund beneficiaries, and missing heirs. to complete a real estate appraisal relating to insurance and securities Other services. A new exception is available for a disclosure as necessary for an affiliate or a nonaffiliated third party to perform business or professional services, such as printing, mailing services, data processing or analysis, or customer surveys, on behalf of the financial institution. The conditions are that the services could lawfully be performed by the bank, a confidentiality agreement is in place limiting disclosure and use of the information, and the bank does not receive any compensation from the other entity in connection with the release of the information. Enforcement The state Attorney General and a financial institution s functional regulator are exclusively granted authority to enforce SB1. 25 A person who negligently discloses customer information, or intentionally obtains, discloses, or uses nonpublic personal information is liable for a civil penalty of $2500 irrespective of the amount of damages suffered by an affected consumer. A cap of $500,000 applies to a negligent disclosure of information of more than one individual, but there is no cap applicable to any intentional violation. If a violation results in the identity theft of a consumer, as defined by Section of the Penal Code, the applicable penalties are doubled. Again, an action by a private party under B&P Section is not necessarily foreclosed. Other provisions Insurance. A general exception 26 is available for a disclosure that is required, or is a usual, appropriate, or acceptable method for insurance underwriting, or the placement of insurance products with insurance companies, at the request of the consumer, for reinsurance, stop loss insurance, or excess loss insurance purposes, or for any of the following purposes as they relate to a consumer's insurance: account administration reporting, investigating, or preventing fraud or material misrepresentation processing premium payments processing insurance claims administering insurance benefits, including utilization review activities participating in research projects as otherwise required or specifically permitted by federal or state law The special rules governing wholly-owned affiliates marketing same-brand products also applies to insurance and management entities of a single insurance holding company system, where the system consists of one or more reciprocal insurance exchanges and has a single corporation or its wholly-owned subsidiaries providing management services to the exchanges Section Section 4052(h)(3). 27 Section 4053(c).

10 Licensed insurance and securities professionals 28 are permitted to share customer information with each other through a written agreement relating to insurance or securities transactions that includes restrictions on the use of customer information in a manner consistent with the contract and SB1, and an explicit provision that the transactions specified in the agreement fall within the scope of activities permitted by the licenses of the parties. SB1 does not limit the ability of insurance producers and brokers to respond to requests for price quotes as long as any disclosure of customer information is made in the ordinary course of business in order to obtain those quotes. 29 A disclosure by an insurer or its affiliates to an exclusive agent (both employees and contractors) is permitted as long as the agent does not disclose customer information to any party except as permitted by SB1. The rules governing shared databases apply to disclosures between an insurer (or its affiliate) and its exclusive agents; that is, mere access to a shared information system is not a disclosure, and customer information is not shared if a consumer has prohibited it. 30 Notice to same household/joint notice. As under GLBA, if joint accountholders reside at the same address, only one privacy notice is required. 31 A notice may be delivered jointly with an affiliate or other financial institution as long as it accurately discloses the practices of the entities. 32 Non-discrimination. A bank may not discriminate against or deny an otherwise qualified consumer a financial product or a financial service based on a consumer s opt-out decision or decision not to opt-in. However, a bank is not liable if the inability to disclose information prevents the product or service from being provided. The bill does not prohibit the offer of incentives or discounts in exchange for a specific response to a notice. 33 Third party receivers of information. Anyone who receives nonpublic personal information from a bank, whether an affiliate or non-affiliated third party, is under a legal obligation not to disclose the information to any other entity unless the disclosure would be lawful if made directly by the disclosing bank. An entity that receives nonpublic personal information pursuant to a general exception may not use or disclose the information except in the ordinary course of business to carry out the activity covered by the exception. A copy of SB1 may be obtained from the website: (type in SB1 and choose chaptered version. SB1 is effective July 1, These are persons holding a producer s license, surplus lines license, life and disability analyst license, stated and federal investment advisors, and securities dealers licensed with the National Association of Securities Dealers. See Financial Code Section Section (b). 30 Section (c). 31 Section 4054(b). 32 Section 4053(d)(7). 33 Section 4053(a)(1).

11