APPELLATE COURT UPHOLDS FEDERAL PREEMPTION OF STATE LAW THAT REGULATES THE SHARING OF CERTAIN INFORMATION WITH AFFILIATES

©2005 Investment Company Institute. All rights reserved. Information may be abridged and therefore incomplete. Communications from the Institute do not constitute, and should not be considered a substitute for, legal advice. [18968] June 22, 2005 TO: CHIEF COMPLIANCE OFFICER COMMITTEE No. 49-05 COMPLIANCE ADVISORY COMMITTEE No. 44-05 PRIMARY CONTACTS - MEMBER COMPLEX No. 27-05 PRIVACY ISSUES WORKING GROUP No. 3-05 SMALL FUNDS MEMBERS No. 59-05 TECHNOLOGY ADVISORY COMMITTEE No. 13-05 RE: APPELLATE COURT UPHOLDS FEDERAL PREEMPTION OF STATE LAW THAT REGULATES THE SHARING OF CERTAIN INFORMATION WITH AFFILIATES Last August, the Institute filed an amicus brief in a case on appeal to the U.S. Circuit Court for the Ninth Circuit.1 The case challenged the provisions in California’s privacy law enacted in 2003 that regulates the sharing of information among affiliates. The Institute’s brief supported the Plaintiffs/Appellants who sought to have the affiliate-sharing provisions of California’s law stricken as contrary to federal law. THE COURT’S HOLDING On June 20, 2005, the Circuit Court issued its decision in this case.2 The court held that California’s privacy law, which was enacted as Senate Bill 1 in 2003: . . . is preempted to the extent that it applies to information shared between affiliates concerning consumers’ ‘credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living’ that is used, expected 1 See Institute Memorandum to Compliance Advisory Committee No. 78-04, Operations Members No. 29-04, Primary Contacts – Member Complex No. 77-04, Privacy Issues Working Group No. 4-04, SEC Rules Members No. 112-04, Small Funds Members No. 85-04, and Technology Advisory Committee No. 23-04 [No. 17894], dated August 13, 2004. Joining the Institute on the brief were the Securities Industry Association, the Investment Counsel Association of America, the American Counsel of Life Insurers, the American Insurance Association, and the National Business Coalition on E-Commerce and Privacy. 2 See American Bankers Association et al. v. Gould et al., which is available on the Ninth Circuit Court’s website at: http://www.ca9.uscourts.gov/ca9/newopinions.nsf/E21717B0B7CEFBDA882570260052FCD7/$file/0416334.pdf?op enelement. 2 to be used, or collected for the purpose of establishing eligibility for ‘credit or insurance,’ employment, or other authorized purpose. This definition of “information” in the court’s holding is taken from the definition of “consumer report” in Section 1681a(d) (15 USC 1681a(d)) of the Fair Credit Reporting Act (FCRA).3 BACKGROUND Generally speaking, unless an exemption applies, California’s law requires that a financial institution provide a notice and opt-out to a consumer prior to the financial institution sharing information with an affiliate and a notice and opt-in prior to sharing information with a non-affiliate.4 Section 1681t of the FCRA, as amended by the Fair and Accurate Credit Transactions Act of 2003 (FACTA) expressly prohibits any State, however, from imposing any requirement or prohibition “with respect to the exchange of information among persons affiliated by common ownership or common corporate control . . .” (Emphasis added.) The issue before the Ninth Circuit Court was whether Section 1681t of the FCRA preempts the provisions in the California law regulating the sharing of information among affiliates. When this issue was considered by the U.S. District Court for the Eastern District of California, that court held that the FCRA did not preempt the affiliate-sharing provisions in California’s new privacy law because the FCRA only preempts the sharing of information communicated by a consumer reporting agency in a consumer report as defined in the FCRA. 5 On appeal, however, the Ninth Circuit construed the affiliate-sharing preemption clause in Section 1681t of the FCRA . . . to preempt all state ‘requirement[s]’ and ‘prohibition[s]’ on the communication of ‘information’ between affiliated parties. 3 As used in Section 1681a(d), the term “other authorized purpose” refers to any permissible use of information under Section 1681b of the FCRA. Pursuant to Section 1681b(a)(3)(F) of the FCRA, the information described above may be provided to any person that the sharer of the information has reason to believe has a legitimate business need for the information either in connection with a business transaction that is initiated by the consumer or to review an account to determine whether the consumer continues to meet the terms of the account. 4 See Institute Memorandum to Compliance Advisory Committee No. 67-03, Operations Members No. 25-03, Primary Contacts – Member Complex No. 68-03, Privacy Issues Working Group No. 3-03, SEC Rules Members No. 113-03, Small Funds Members No. 43-03, and Technology Advisory Committee No. 10-03 [No. 16477], dated Aug. 28, 2003. 5 See American Bankers Association et al. v. Bill Lockyer, in his official capacity as Attorney General of California, et al., No. CIV. S 04-0778 MCE KJM (E.D. Cal. June 30, 2004). A copy of the court’s opinion is available through the Office of the California Attorney General at: http://caag.state.ca.us/newsalerts/2004/04-069.pdf. This holding was directly contrary to a holding issued the previous year by the U.S. District Court for the Northern District of California, which held that the preemptive provision in FCRA applied to all information shared with an affiliate, not just consumer report information. See Bank of America et al. v. City of Daly City, California, Nos. C 02-4343 CW, C 02- 4943 CW (N.D. Cal. July 29, 2003). See also Institute Memorandum to Compliance Advisory Committee No. 57-03, Operations Members No. 20-03, Primary Contacts – Member Complex No. 60-03, Privacy Issues Working Group No. 2-03, SEC Rules Members No. 100-03, Small Funds Members No. 39-03, and Technology Advisory Committee No. 8- 03 [No. 16383], dated July 30, 2003, which summarized the Northern District Court’s decision. A copy of the decision was attached to the memorandum. 3 However, as used in the affiliate-sharing preemption clause and elsewhere in the FCRA, ‘information’ has a restricted meaning. It does not include all information. Rather, it includes only the sort of information described in the definition of ‘consumer report’ in Section 1681a(d)(1). (Emphasis added.) Importantly, the court did not hold that, for the preemptive clause of the FCRA to apply, the shared information must be communicated by a consumer reporting agency in a consumer report. Based on the Ninth Circuit’s holding, the case has been remanded to the lower court, the District Court for the Eastern District of California, for that court to determine whether any portion of the affiliate-sharing provisions of Senate Bill 1 survive preemption and, if so, whether those provisions are severable from the portion that does not. The Circuit Court expressed no opinion on those issues. Tamara K. Salmon Senior Associate Counsel