INSTITUTE COMMENT LETTER ON THE SEC'S PROPOSED RULE TO REQUIRE PROPER DISPOSAL OF CONSUMER RECORDS

[18126] October 22, 2004 TO: CLOSED-END INVESTMENT COMPANY MEMBERS No. 68-04 COMPLIANCE ADVISORY COMMITTEE No. 100-04 INVESTMENT ADVISER MEMBERS No. 21-04 PRIVACY ISSUES WORKING GROUP No. 7-04 SEC RULES MEMBERS No. 153-04 SMALL FUNDS MEMBERS No. 114-04 TRANSFER AGENT ADVISORY COMMITTEE No. 78-04 UNIT INVESTMENT TRUST MEMBERS No. 40-04 TECHNOLOGY ADVISORY COMMITTEE No. 29-04 OPERATIONS MEMBERS No. 34-04 RE: INSTITUTE COMMENT LETTER ON THE SEC’S PROPOSED RULE TO REQUIRE PROPER DISPOSAL OF CONSUMER RECORDS As you may recall, last month the SEC published for comment revisions to Section 248.30 of Regulation S-P1 that will require SEC registrants to adopt policies and procedures to safeguard the disposal of certain consumer information (the “safeguard rule”).2 These revisions, which were mandated by the recent enactment of the Fair and Accurate Credit Transactions Act (FACTA), are intended to prevent the unauthorized disclosure of sensitive consumer information and reduce the risk of fraud or related crimes, including identity theft, by ensuring the proper disposal of such information. The Institute has filed the attached comment letter with the Commission on the proposal. 1 Section 248.30 of Regulation S-P requires every registered broker, dealer, investment company, and investment adviser to adopt policies and procedures that address the administrative, technical, and physical safeguards for the protection of customer records and information. 2 See Disposal of Consumer Report Information, SEC Release No. 34-50361 (Sept. 14, 2004), 69 Fed. Reg. 56304 (Sept. 20, 2004) (the “Release”). The Release is available on the SEC’s website at: http://www.sec.gov/rules/proposed/34- 50361.htm. Similar safeguard rules must be adopted by other federal regulators of financial institutions and the Federal Trade Commission. In particular, the Commission has proposed to amend Section 248.30 of Regulation S-P, relating to privacy, to: (1) require the policies and procedures that are currently mandated by that section to be in writing; and (2) add a new subsection (b) to the section to require persons covered by it that dispose of specified information to take reasonable measures to protect against unauthorized access to or use of the discarded information. 2 The Institute’s letter supports the proposal as a reasonable approach to enhancing the privacy protection of consumer information. It recommends, however, that the Commission clarify -- consistent with the Fair Credit Reporting Act, FACTA, and the Commission’s intent as expressed in the Release -- that the proposed revisions relating to the disposal of consumer report information only apply to the disposal of personally identifiable consumer report information. In response to the Commission’s request for comment as to whether it is necessary to add other elements to the proposed revision, the letter states that we do not believe additional elements are necessary. The letter recommends, however, that the adopting release’s discussion of reasonable methods of disposal acknowledge overwriting as a reasonable method of disposal of electronic records. The Institute’s letter does not include any specific comments on the portion of the proposal that would require a firm’s policies and procedures under Section 248.30 to be in writing. Pursuant to FACTA, the proposed rule must be issued by the Commission in final form no later than December 4, 2003. Tamara K. Salmon Senior Associate Counsel Attachment (in .pdf format) Note: Not all recipients receive the attachment. To obtain a copy of the attachment, please visit our members website (http://members.ici.org) and search for memo 18126, or call the ICI Library at (202) 326-8304 and request the attachment for memo 18126.