ICI Comments on SEC's Proposed Regulation S-AM (pdf)

August 13, 2004 Mr. Jonathan G. Katz Secretary U.S. Securities and Exchange Commission 450 Fifth Street, NW Washington, DC 20549-0609 Re: Limitations on Affiliate Marketing Proposed Reg. S-AM; File No. S7-29-04 Dear Mr. Katz: The Investment Company Institute1 appreciates the opportunity to comment on the Securities and Exchange Commission’s proposal to adopt Regulation S-AM to implement the affiliate marketing provisions in Section 624 of the Fair Credit Reporting Act (FCRA), which was added to the FCRA by the Fair and Accurate Credit Transactions Act of 2003 (FACTA). Section 624 requires the Commission and other federal agencies to adopt rules prohibiting affiliates of financial institutions from sending marketing solicitations to consumers based on certain information provided to the affiliate by the financial institution unless the consumer is first provided notice of such sharing and the ability to block such marketing solicitations.2 In enacting Section 624, Congress set a national standard that permits consumers to control an affiliate’s use of information about them for marketing purposes. In the Institute’s view, this approach appropriately balances two important consumer interests: giving consumers control over the use of certain information for marketing solicitations and ensuring that they efficiently receive financial products and services. For this reason, we supported the 1 The Investment Company Institute is the national association of the American investment company industry. Its membership includes 8,672 open-end investment companies ("mutual funds"), 605 closed-end investment companies, 108 exchange-traded funds and 6 sponsors of unit investment trusts. Its mutual fund members have assets of about $7.149 trillion. These assets account for more than 95% of assets of all U.S. mutual funds. Individual owners represented by ICI member firms number 86.6 million as of mid 2003, representing 50.6 million households. 2 See Proposed Rule: Limitations on Affiliate Marketing (Regulation S-AM) SEC Release Nos. 34-49985, IC-26494, IA-2259 (July 8, 2004), 69 Fed. Reg. 42302 (July 14, 2004) (the “Release”). As used in this letter, the term “financial institution” refers to the entity sharing eligibility information with an affiliate; the term “affiliate” refers to the entity receiving eligibility information from an affiliated financial institution. Although proposed Reg. S-AM does not use the term “financial institution,” the provisions of the rule would extend to the following institutions to the extent they share information with an affiliate in order for the affiliate to market to such institution’s consumers: any broker or dealer, any investment company, and any investment adviser or transfer agent registered with the SEC. Mr. Jonathan G. Katz August 13, 2004 Page 2 of 9 addition of Section 624 to the FCRA and we support the adoption of the Commission’s proposed implementing regulation. This letter provides our views on certain issues on which the Release requests comment and makes certain technical recommendations. In summary, we support the Commission’s proposal to place the responsibility for providing the requisite notice and opt-out right to consumers on the financial institution that shares consumer information with an affiliate, rather than on the affiliate. We recommend that: • The Commission’s adopting release clarify the Commission’s intent to construe the meaning of the term “affiliate” under Reg. S-AM consistently with this term under Reg. S-P;3 • The Commission clarify that proposed Reg. S-AM governs the use of eligibility information for marketing solicitation purposes and that its application is not dependent upon the medium used to make such solicitation; • The constructive sharing of eligibility information that is lawful under the FCRA not be deemed to trigger the requirements of proposed Reg. S-AM; • Proposed Reg. S-AM be revised to permit the use of oral notices and opt-outs; and • The Commission provide a transition period for mandatory compliance with Reg. S-AM that will allow firms to coordinate the delivery of any notices required by Reg. S-AM with the 2005 annual privacy notices required under Reg. S-P. Each of these recommendations is discussed in more detail below. I. OVERVIEW – RESPONSIBILITY FOR PROVIDING NOTICE AND OPT-OUT ELECTIONS Section 624 of the FCRA seeks to protect consumers of a financial institution from receiving certain targeted marketing solicitations from an affiliate of that financial institution. It seeks to accomplish this by prohibiting an affiliate of a financial institution from using information it receives on the consumer for marketing purposes unless the consumer has first been provided notice of the sharing and the ability to block the affiliate’s use of the information for this purpose. As discussed in the Release, Section 624 does not specify which entity – the financial institution or its affiliate – has the responsibility for providing the requisite notice and opt out to the consumer. As proposed by the Commission, Reg. S-AM would place this responsibility on the financial institution sharing the information, not on the affiliate receiving the information. The Release seeks comment on this approach. The Institute concurs that this responsibility should be placed on the financial institution sharing the information. As the Release indicates, inasmuch as the consumer receiving the notice and opt-out is a consumer of the financial institution and not the affiliate, the consumer 3 Reg. S-P, which was adopted by the Commission under the Gramm-Leach-Bliley Act, governs a financial institution’s ability to disclose nonpublic personal financial information about the financial institution’s consumers to affiliates and non-affiliated third parties. Mr. Jonathan G. Katz August 13, 2004 Page 3 of 9 may not expect to receive important notices regarding the consumer’s opt-out rights from an entity with which the consumer has not transacted business. As such, the consumer may unknowingly waive her right to opt out by discarding information she receives from the affiliate as junk mail. Also, placing the responsibility on the financial institution would enable the financial institution to coordinate the Reg. S-AM notice with its Reg. S-P notice if it so desires, thereby facilitating the use of a single notice for these purposes, which could have several benefits.4 For these reasons, we support the approach the Commission has proposed. II. DEFINITIONS A. “Affiliate” As noted in the Release, while there is no definition of “affiliate” in the FCRA, there are various provisions in the FCRA that refer to persons “related by common ownership or affiliated by common control.” 5 Accordingly, the Commission has proposed to define the term “affiliate” for purposes of Reg. S-AM as “any person that is related by common ownership or common corporate control” with the financial institution sharing the eligibility information. As noted in the Release, this definition is not entirely identical to the definition of “affiliate” in the GLB Act. As with Reg. S-P, however, a person related to a financial institution through common control would be considered an affiliate.6 The Institute is pleased that the Commission has proposed to define the term “affiliate” in a manner that will enable a financial institution that accords affiliate status to an entity under Reg. S-P to accord similar status to the same entity under Reg. S-AM.7 Like many types of financial institutions, the Institute’s members are subject to both sets of requirements. Consistency between the definitions used in Reg. S-AM and Reg. S-P should facilitate compliance efforts and may reduce potential confusion on the part of consumers. Such consistency should also extend to Commission or staff interpretations relating to the definitions used in the proposed Regulation. For example, if an investment company would not be required to obtain a Commission order under Section 2(a)(9) of the Investment Company Act adjudicating the control relationship in order to treat a person as an affiliate (i.e., as controlling the fund) for purposes of Reg. S-P, the Commission should not require such an order under 4 For example, financial institutions may be able to provide required privacy information to consumers in an integrated manner, which may enhance consumers’ understanding of their privacy rights. In addition, combined notices may be more efficient in some instances. The Release seeks comment on whether financial institutions would plan to consolidate any notices required under the proposed Regulation with the privacy notices required under Reg. S-P. We anticipate that many will, and we therefore support Reg. S-AM accommodating such consolidation. 5 Release at fn. 25. 6 In recognition of other types of control relationships, the Institute recommends that the proposed definition not require the common control to be “common corporate control.” 7 Further ensuring consistency between Reg. S-P and proposed Reg. S-AM for this purpose, the proposed definition of the term “control” in Reg. S-AM is substantially similar to the definition of this term in Reg. S-P. Mr. Jonathan G. Katz August 13, 2004 Page 4 of 9 proposed Reg. S-AM. We recommend that the adopting release clarify the Commission’s intent to provide for consistent interpretations in this regard. Mr. Jonathan G. Katz August 13, 2004 Page 5 of 9 B. “Eligibility Information” The Commission has proposed to define the term “eligibility information” as used in the Regulation by reference to the definition of “consumer report” in Section 603(d)(2)(A) of the FCRA. The Release explains in greater detail the resulting definition for purposes of the Regulation.8 In lieu of defining this term by reference to a Federal statute, we recommend that a specific definition be set forth in Reg. S-AM. This approach would avoid the need for financial institutions to refer to a separate source in order to glean all of the proposed Regulation’s requirements. We further recommend that the Commission add examples in its adopting release to illustrate the types of information that would, and would not, constitute “eligibility information.” C. “Marketing Solicitation” 1. Internet Marketing; Pop-Up Advertisements As proposed, Reg. S-AM would include a definition of “marketing solicitation” that is intended to distinguish a solicitation targeted towards a specific consumer based on that consumer’s eligibility information (which is covered by the Regulation) from a solicitation that is directed at the general public (which is not covered by the Regulation). The Commission seeks comment on whether, and to what extent, various tools used in Internet marketing, such as pop-up ads, could constitute marketing solicitations as opposed to communications directed to the general public. The Release also invites commenters to discuss whether the Commission should provide persons subject to the proposed Regulation with further guidance to address Internet marketing. The Institute recommends that the Commission clarify two points in this area, as discussed below. As noted in the Release, Section 624 of the FCRA was intended to provide consumers the right to restrict an affiliate from using eligibility information received from a financial institution to make marketing solicitations to the consumer. The medium used to deliver the marketing solicitation is wholly irrelevant under the FCRA and the implementing rules. Instead, the application of proposed Reg. S-AM in a given situation would turn on whether the consumer who is to receive a marketing solicitation from the affiliate was identified by the affiliate based upon eligibility information received by the affiliate from the financial institution. If the answer is “yes” and there is not an exception that applies, the Regulation would prohibit such marketing solicitation unless the consumer was first provided a notice and the opportunity 8 According to the Release, in accordance with this definition, eligibility information would mean: . . . any information bearing on a consumer’s credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living, which is used or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing the consumer’s eligibility for credit or insurance to be used primarily for personal, family, or household purposes, employment purposes, or any other purpose authorized by Section 604 of FCRA. Release at p. 4. Mr. Jonathan G. Katz August 13, 2004 Page 6 of 9 to opt out of such solicitation. We recommend that the adopting release clarify that this is the case regardless of the medium used to make the marketing solicitation. We further recommend that the adopting release clarify that the Regulation would not apply to marketing solicitations that are targeted to segments of a financial institution’s customers. For example, assume a financial institution that is a broker-dealer offers a password protected website to its customers with a brokerage account with assets in excess of $100,000, which website provides them a level of service beyond that provided to other customers of the broker-dealer. If an investment adviser affiliate of the broker-dealer requests that the broker- dealer include an advertisement for the affiliate’s services on this password-protected website, which is only available to select customers of the broker-dealer, such advertisements would not trigger the notice and opt-out requirements of the proposed Regulation because the advertisement does not arise from the affiliate’s use of any customer-specific eligibility information provided to the affiliate by the financial institution. In other words, Section 624 of the FCRA is not triggered because no eligibility information has been transferred by the financial institution to the affiliate.9 2. Constructive Sharing The Release requests comment on whether to expand the reach of Section 624 of the FCRA through the implementing regulations to reach “constructive sharing” arrangements.10 As discussed in the Release, constructive sharing could occur when a financial institution agrees to send a marketing solicitation on behalf of the affiliate to consumers of the financial institution that meet certain criteria specified by the affiliate. As noted above, Section 624 of the FCRA is intended to provide consumers the right to restrict an affiliate from sending marketing solicitations to consumers based on eligibility information the affiliate received from a financial institution.11 As such, the provisions of Section 624 are only triggered when an affiliate of a financial institution uses eligibility information it received from the financial institution to 9 Similarly, if an affiliate of a financial institution is permitted to advertise in a newsletter that is sent by the financial institution to select customers, such advertisement would not trigger the notice and opt-out requirements under proposed Reg. S-AM because the affiliate did not make marketing solicitations based on any eligibility information it received from individually identified recipients of the newsletter. 10 While seeking comment on this type of constructive sharing, the Release acknowledges that, as proposed, the Regulation would not prohibit a financial institution from including the affiliate’s marketing materials in mailings to the financial institution’s consumers without regard to such consumers’ eligibility information. 11 The Institute notes that one of the examples set forth in the proposed Regulation relating to “avoiding duplicative notices” appears to be inconsistent with the Regulation’s provisions. In particular, proposed Subparagraph 247.20(a)(2)(ii) states, in relevant part: “If Affiliate A communicates eligibility information about a consumer to Affiliate B, and Affiliate B communicates the same information to Affiliate C, Affiliate B does not have to give an opt- out notice to the consumer when it provides the eligibility information to Affiliate C . . .” (Emphasis added.) We note that, under the proposed Regulation, the mere transfer of information to any affiliate of a financial institution would not trigger the notice and opt-out requirements. Instead, these requirements would only be triggered if an affiliate receiving the eligibility information uses it to send a marketing solicitation to the consumer. To avoid any confusion, we recommend that the Commission revise Subparagraph 247.20(a)(2)(ii) to make it consistent with the operative provisions of Reg. S-AM. Mr. Jonathan G. Katz August 13, 2004 Page 7 of 9 market to a consumer of the financial institution. It would, therefore, appear to be inconsistent with Congressional intent for the proposed Regulation to expand the prohibitions of Section 624 such that the Regulation would impede a financial institution from itself using the eligibility information it possesses on its own consumers to send an affiliate’s marketing solicitation.12 Indeed, Section 624 of the FCRA expressly states that its prohibitions “shall not apply to a person . . . using information for marketing purposes to a consumer with whom the person has a pre-existing business relationship.”13 Accordingly, extending proposed Reg. S-AM to constructive sharing arrangements would be inconsistent with both the language of Section 624 and with Congressional intent and it would, in effect, limit the marketing solicitations a financial institution may send to its own customers. We therefore oppose expanding proposed Reg. S-AM in this manner.14 III. ORAL NOTICES AND OPT-OUTS The Release seeks comment on whether oral notices and opt-outs should be permitted under proposed Reg. S-AM. The Institute supports allowing the use of oral notices and opt outs because they would facilitate the ability of consumers of financial institutions to exercise their rights under the Regulation. For example, if oral notices and opt-outs were permitted, a consumer who transacts business with a mutual fund complex by phone would be able to exercise her rights under the Regulation by phone immediately without having to follow-up such conversation with a written or electronic election. We believe this would provide a convenient option for consumers who transact business by phone. Moreover, a consumer who effects transactions with a financial institution by phone may pay less attention to information such as envelope stuffers – including privacy notices – received in the mail from the financial institution because such consumer may assume that all fundamentals of the transaction were already handled by phone. Accordingly, we strongly support permitting the use of oral notices because should notices would both facilitate the consumer’s ability to transact, to the greatest extent practicable, the totality of his or her business with the financial institution by phone and reduce the likelihood of such consumer disregarding privacy notices received in the mail after conducting business with the financial institution by phone.15 The Release seeks comment on how an oral notice could satisfy the statutory “clear and conspicuous” standard. In our view, it may actually be easier to comply with a “clear and 12 While the Release expresses concerns that eligibility information may be revealed when the consumer responds, this ignores the fact that affiliates are permitted under the FCRA to share information at any time. Also, the consumer’s voluntary response would appear to trigger other exceptions under Section 214 of the FACTA (e.g., responding to communications initiated by a consumer to receive further information). 13 Section 624(a)(4)(A) of the FCRA (emphasis added). 14 The Institute additionally notes that, if the Commission were to prohibit constructive sharing under proposed Reg. S-AM, this would result in the anomalous situation of a financial institution being permitted to send to selected consumers marketing materials of non-affiliated third parties under Reg. S-P but prohibited from sending to the same consumers marketing materials of affiliates under Reg. S-AM. 15 We recommend that such provisions and examples be added in Sections 247.22(b), 247.23(a), and 247.24(b) of the proposed Regulation. Mr. Jonathan G. Katz August 13, 2004 Page 8 of 9 conspicuous” standard in an oral notice than in a written notice. This is because (1) the information required to be communicated is likely neither lengthy nor complicated (as demonstrated by Model Form A-1 in Appendix A to the Release) and (2) oral notices avoid concerns present with written or electronic notices such as the use of headings, the size and style of type, the use of margins and spacing, the use of boldfaced or italicized type, etc. Also, inasmuch as an oral notice would likely be “delivered” in a conversation between a representative of the financial institution and the consumer, some consumers may even be more likely to pay attention to such disclosure than to disclosure received by mail or electronically. Thus, meeting the “clear and conspicuous” disclosure requirement is likely to be straightforward in most circumstances. Accordingly, so long as the oral communication with the consumer includes the proposed Regulation’s required content elements (as set forth in proposed Section 247.21) and provides a reasonable opportunity for the consumer to opt-out or to renew an existing opt-out previously exercised, and so long as the financial institution can document its compliance with these requirements, oral notices would appear to comply with the proposed Regulation. As such, we believe financial institutions should have the opportunity to provide oral notices and we recommend that the proposed Regulation be revised to accommodate such notices. IV. COMPLIANCE DATE The Release seeks comment on the mandatory compliance date for Reg. S-AM, including whether it should be different from the effective date in order to permit a financial institution to incorporate the notice that would be required by Reg. S-AM into the next required annual GLB Act privacy notice. As discussed above, the Institute supports allowing financial institutions to consolidate the notices required under proposed Reg. S-AM with those required under Reg. S-P. Towards this end, we recommend that the Commission establish a mandatory compliance date of December 31, 2005. This would ensure that all financial institutions that are required by Reg. S-AM to deliver a privacy notice are able to take advantage of the potential benefits of either consolidating or coordinating such notice with the annual notice required under Reg. S-P.16 * * * * The Institute appreciates the opportunity to provide these comments. If you have any questions concerning them or would like additional information, please contact the undersigned at (202) 326-5825. Sincerely, 16 Section 248.5 of Reg. S-P requires a financial institution to send out a clear and conspicuous privacy notice to customers no less frequently than annually during the continuation of the customer relationship. As used in this provision, the term “annually” means at least once in any period of 12 consecutive months during which the relationship exists. Mr. Jonathan G. Katz August 13, 2004 Page 9 of 9 Tamara K. Salmon Senior Associate Counsel cc: Penelope W. Saltzman, Branch Chief