1 See Memorandum to SEC Rules Members No. 70-99, dated November 19, 1999 (summarizing the provisions of the Act
most directly impacting investment companies and investment advisers).
2 Financial institutions must disclose their privacy policies with respect to protecting the confidentiality and security of their
customers’ “non-public personal information” and sharing that information with affiliates and others.
[11417]
November 22, 1999
TO: SEC RULES COMMITTEE No. 99-99
RE: FORMATION OF WORKING GROUP ON SEC PRIVACY RULES
______________________________________________________________________________
President Clinton recently signed into law the “Gramm-Leach-Bliley Act” which, among other
things, repeals various restrictions on affiliations among commercial banks, securities firms, and
insurance companies.1 Title V, Subtitle A of the Act establishes new obligations for all companies that
engage in financial activities with respect to protecting the privacy of their customers, whether or not
those companies are affiliated with banks. A copy of Subtitle A of Title V is attached.
The Act requires the SEC to adopt privacy rules in two instances. First, under section 501(b) of
the Act, the SEC must “establish appropriate standards” relating to administrative, technical and physical
safeguards to protect the security and confidentiality of customer records and information and to protect
against unauthorized access to or use of such records or information. Second, section 504 contains a
more general rulemaking mandate that requires the SEC, in consultation with the Federal Trade
Commission and representatives of state insurance authorities, to promulgate rules to carry out the
purposes of the privacy provisions of the Act. Among other things, these rules must address the form
and timing of the privacy disclosures required by the Act.2
In both cases, the SEC is tasked with this rulemaking responsibility with respect to the financial
institutions subject to its jurisdiction, including investment companies and investment advisers. The Act
requires that these rules be issued in final form not later than six months after enactment of the Act (i.e.,
by May 12, 2000).
The Institute is considering submitting recommendations to assist the SEC staff in developing
its privacy rule proposals. We are forming a working group of members to help us formulate any such
recommendations (and, subsequently, our comments on the SEC’s privacy rule proposals). If you or a
designated alternate would like to participate in the SEC Privacy Rules Working Group, please
complete and return the attached response form by fax to Laura Whitehead at (202) 326-5841 by
November 29, 1999. We expect to hold a meeting or conference call of the Working Group next
month.
Robert C. Grohowski
Associate Counsel
Attachments