INSTITUTE FILES BRIEF IN CASE CHALLENGING PROVISIONS IN CALIFORNIA'S PRIVACY LAW REGULATING SHARING OF INFORMATION WITH AFFILIATES

[17894] August 13, 2004 TO: COMPLIANCE ADVISORY COMMITTEE No. 78-04 OPERATIONS MEMBERS No. 29-04 PRIMARY CONTACTS - MEMBER COMPLEX No. 77-04 PRIVACY ISSUES WORKING GROUP No. 4-04 SEC RULES MEMBERS No. 112-04 SMALL FUNDS MEMBERS No. 85-04 TECHNOLOGY ADVISORY COMMITTEE No. 23-04 RE: INSTITUTE FILES BRIEF IN CASE CHALLENGING PROVISIONS IN CALIFORNIA’S PRIVACY LAW REGULATING SHARING OF INFORMATION WITH AFFILIATES On August 9th, the Institute filed an amicus brief in a case on appeal to the U.S. Circuit Court for the Ninth Circuit. Our brief was filed to impress upon the court Congress’ intent to have a national standard governing a financial institution’s sharing of information with its affiliates, rather than disparate state standards. The case challenges the provisions in California’s new privacy law that attempt to regulate the sharing of information among affiliates.1 Joining the Institute on the brief were the Securities Industry Association, the Investment Counsel Association of America, the American Counsel of Life Insurers, the American Insurance Association, and the National Business Coalition on E-Commerce and Privacy. The brief was filed in support of the Plaintiffs’/Appellants’ who are seeking to have the affiliate-sharing provisions in California’s new privacy law stricken as contrary to federal law.2 This case presents the issue of whether provisions in the Fair Credit Reporting Act (FCRA), as amended by the Fair and Accurate Credit Transactions Act of 2003 (FACTA) preempt the authority of state and local governments to regulate the sharing of information among affiliates. A lower court decision held that FCRA does not preempt the affiliate-sharing 1 A copy of this brief is available on the Institute’s website at: http://www.ici.org/issues/prv/arc- leg/04_privacy_brief.pdf. 2 Generally speaking, unless otherwise exempt, the law requires consumers be provided a notice and opt-out prior to a financial institution sharing information with an affiliate and a notice and opt-in prior to sharing information with a non-affiliate. See Institute Memorandum to Compliance Advisory Committee No. 67-03, Operations Members No. 25-03, Primary Contacts – Member Complex No. 68-03, Privacy Issues Working Group No. 3-03, SEC Rules Members No. 113-03, Small Funds Members No. 43-03, and Technology Advisory Committee No. 10-03 [No. 16477], dated Aug. 28, 2003. 2 provisions in California’s new privacy law because, in the view of the court, FCRA only preempts the sharing of “consumer report” information, not all other information.3 The amicus brief filed by the Institute supports the Plaintiffs’/Appellants’ arguments that Congress intended for FCRA to preempt states from regulating the sharing of any information among affiliates, not just consumer report information. In particular, the Institute’s brief argues that: • The plain language of FCRA preempts the California law; • The Congressional history of the preemptive provision in FCRA demonstrates that Congress intended to broadly preempt state privacy laws that would attempt to regulate the sharing of information among affiliates; and • FACTA’s 2003 amendments to FCRA, and the Congressional record concerning such amendments, amply demonstrate that Congress intended to preempt state laws governing the sharing of information among affiliates, including California’s law, which had been enacted shortly before Congress adopted FACTA. In addition to the Institute’s brief, amicus briefs have also been filed by federal regulators (i.e., the Office of Thrift Supervision, the Office of the Comptroller of the Currency, the Federal Deposit Insurance Corporation, the Board of Governors of the Federal Reserve System, the National Credit Union Administration, and the Federal Trade Commission); The Clearing House Association, representing commercial banks in the United States; and Citizens for a Sound Economy, which is a think tank dedicated to free markets and limited government, whose current chairman is Dick Armey, former Republican House Majority Leader. Each of these briefs supports the Plaintiffs’/Appellants’ view that the affiliate sharing provisions in the California law are preempted by FCRA. Oral arguments are expected to be held in November and it is anticipated that the Ninth Circuit court will issue its decision 4-6 months after oral arguments. Tamara K. Salmon Senior Associate Counsel 3 See American Bankers Association et al. v. Bill Lockyer, in his official capacity as Attorney General of California, et al., No. CIV. S 04-0778 MCE KJM (E.D. Cal. June 30, 2004). A copy of the court’s opinion is available through the Office of the California Attorney General at: http://caag.state.ca.us/newsalerts/2004/04-069.pdf. As discussed in the court’s opinion, “consumer report” information includes any communication by a consumer reporting agency of information bearing on specified characteristics used or expected to be used or collected in whole or in part as a factor in determining a consumer’s eligibility for credit, insurance, employment, or other permissible purposes under FCRA. This holding was directly contrary to a holding issued the previous year by the U.S. District Court for the Northern District of California, which held that the preemptive provision in FCRA applied to all information shared with an affiliate, not just consumer report information. See Bank of America et al. v. City of Daly City, California, Nos. C 02-4343 CW, C 02-4943 CW (N.D. Cal. July 29, 2003). See also Institute Memorandum to Compliance Advisory Committee No. 57-03, Operations Members No. 20-03, Primary Contacts – Member Complex No. 60-03, Privacy Issues Working Group No. 2-03, SEC Rules Members No. 100-03, Small Funds Members No. 39-03, and Technology Advisory Committee No. 8-03 [No. 16383], dated July 30, 2003, which summarized the court’s decision. A copy of the decision was attached to the memorandum.