ICI Comments on Proper Disposal of Consumer Information (pdf)

October 20, 2004 Mr. Jonathan G. Katz Secretary U.S. Securities and Exchange Commission 450 Fifth Street, NW Washington, DC 20549-0609 Re: Disposal of Consumer Report Information; File No. S7-33-04____________________ Dear Mr. Katz: The Investment Company Institute1 appreciates the opportunity to express its support for the Securities and Exchange Commission’s proposal to require SEC-registered investment companies (“funds”), investment advisers, and others to adopt policies and procedures to safeguard the disposal of consumer report information.2 The proposal is a reasonable approach to enhancing the protection of consumer privacy. The Institute and its members have long recognized the importance of protecting the privacy of investors’ personal financial information.3 Investors must have confidence that the funds and investment advisers to whom they entrust their personal financial information will protect the sanctity and integrity of such information. The Commission’s proposal will provide greater protection against the unauthorized disclosure of sensitive information, thereby reducing the risk of fraud or related crimes, such as identity theft. We support adoption of the proposal. According to the Release, in order to be consistent with the requirements of the Fair Credit Reporting Act (FCRA) and the Fair and Accurate Credit Transactions Act (FACTA), the proposed rule’s requirements would not apply to consumer report information that does not identify any particular individual.4 We support this limitation 1 The Investment Company Institute is the national association of the American investment company industry. More information about the Institute is available at the end of this letter. 2 See Disposal of Consumer Report Information, SEC Release Nos. 34-50361, IA-2293, IC-26596 (Sept. 14, 2004), 69 Fed. Reg. 56304 (Sept. 20, 2004) (the “Release”). The proposal would amend Section 248.30 of Regulation S-P, which requires registered funds, investment advisers, and broker-dealers to adopt policies and procedures that address safeguards for the protection of customer records and information. 3 See, e.g., Letter from Craig S. Tyle, General Counsel, ICI, to Mr. Jonathan G. Katz, Secretary, Securities and Exchange Commission, dated March 31, 2000. 4 See Release at p. 53605. and concur that including such information within the rule is unnecessary to protect investors. We note, however, that the proposed rule’s definition of “consumer report information,” does not include this distinction. To address this and ensure that the proposed rule’s definition is consistent with federal law and the Commission’s intent, we recommend that the definition of “consumer report information” be revised to limit the term to “any personally identifiable record about an individual . . ..” In response to the Commission’s request for comment as to whether it is necessary to add other elements to the proposed rule, such as an information security governance framework, we do not believe additional elements are necessary. 5 We support the flexible standard the Commission proposes for the disposal of information, under which covered entities must “take reasonable measures to protect against unauthorized access to or use of the information in connection with its disposal.” This standard will allow entities subject to the rule to take into account their particular circumstances and will avoid excessive disruption of their existing effective practices. At the same time, we welcome the guidance provided in the Release concerning what might be considered “reasonable” disposal methods. The Commission’s non-exclusive examples should facilitate compliance efforts. We recommend that the Commission’s adopting release reiterate this guidance. We further recommend that the adopting release include overwriting existing data as an additional example of a reasonable disposal method in the case of electronic media. The Institute appreciates the opportunity to submit comments in support of the Commission’s proposed amendments. If you have any questions concerning these comments or would like additional information, please contact the undersigned by phone at 202-326-5825. Sincerely, Tamara K. Salmon Senior Associate Counsel 5 Indeed, pursuant to Rule 38a-1 under the Investment Company Act of 1940, boards of directors of registered funds already are required to approve policies and procedures reasonably designed to prevent violations of the federal securities laws, including those relating to Regulation S-P. About the Investment Company Institute The Investment Company Institute’s membership includes 8,727 open-end investment companies ("mutual funds"), 631 closed-end investment companies, 135 exchange-traded funds and 5 sponsors of unit investment trusts. Its mutual fund members manage assets of about $7.377 trillion. These assets account for more than 95% of assets of all U.S. mutual funds. Individual owners represented by ICI member firms number 86.6 million as of mid 2003, representing 50.6 million households.