Consumer privacy provisions may surprise businesses

With the passage of the Gramm-Leach-Bliley Act of 1999, Congress created sweeping reforms in the financial services area. While most notably the Act lifts the long-standing Glass-Steagall restrictions against affiliations between commercial banks, investment banks and insurance companies, the Act also provides new requirements relating to consumer privacy.

Many business owners who may not consider themselves affected by financial modernization laws may be surprised to find out that the privacy provisions of the Act do apply to their businesses and that they may be in violation of these provisions.

Privacy provisions

The Act prohibits financial institutions from disclosing to nonaffiliated third parties any nonpublic personal information about customers or consumers unless and until the financial institution develops a consumer privacy policy and provides notice of that policy to customers and consumers.

After notice is delivered, the party receiving notice must be afforded an opportunity to opt out or disallow the financial institution from disclosing information. Most important for businesses affected by the Act will be development and implementation of a privacy policy before July 1, 2001.

As is often the case in complex new legislation, understanding the defined terms of the Act and exploring its exceptions may prove difficult and time-consuming.

Coverage

The Act's privacy provisions apply to all businesses (regardless of form) which engage in financial activities.

All activities which the Federal Reserve Board previously determined to be closely related to banking are now considered financial activities and businesses performing such services will be subject to the privacy provisions of the Act. These activities include:

Credit extension, loan service and all activities relating thereto, including real and personal property appraisal, commercial real estate equity financing arrangements, check-guaranty services, collection agency services and maintaining information relating to credit histories of consumers for sale to lenders considering applications for credit;

Certain non-operating leasing services;

Performance of trust company functions;

Financial and investment advice, including tax preparations or tax planning, mergers and acquisitions;

Providing employment histories to third parties for use in making credit decisions; and

Offering notary public services, selling postage stamps and postage-paid envelopes, providing vehicle registration services and selling public transportation tickets and tokens.

FTC definitions

The Federal Trade Commission has provided additional assistance to determine which types of businesses the Act covers. These businesses include retailers that issue their own credit cards, personal or real property appraisal businesses, mortgage brokers, career counselors specializing in counseling individuals working or seeking employment in financial organizations, check-printing companies, businesses that wire money on a regular basis to and from consumers, check cashing businesses, certain travel agencies and businesses providing real estate settlement services.

The Act also provides that the Federal Reserve Board, together with the Department of Treasury, has the power to determine additional activities that are financial in nature or incidental or complementary to financial activities. Accordingly, businesses need to be aware of the future characterization of non-traditional banking and lending activities that could bring those businesses within the purview of the privacy provisions of the Act.

State's role

Privacy compliance will also be affected by actions undertaken by individual states. The Act allows a state to supplement its provisions by passing stricter requirements.

In Missouri, for example, the Senate recently introduced a bill to require licensed insurance companies to provide privacy statements to customers and consumers.

Whether the state of Missouri will introduce further legislation to expand the Act is unknown.

As a result of the Act, its potential for continuing expansion, and the interest of states in protecting the privacy rights of their citizens, it is important for businesses to educate themselves on the privacy provisions of the Act and determine whether these restrictions are applicable to their business services.

If so, they will need to implement a strategy to comply with these provisions, including developing a privacy policy that can be delivered to all its customers and consumers.

Many affected businesses find it helpful to select a privacy compliance officer and to join one of the new privacy compliance networking organizations, as well as to consult an attorney regarding compliance with this new and evolving area of government regulation.

(Joyce Dixon and Adam Kirshenbaum are attorneys with Blackwell Sanders Peper Martin.)