Federal Register: October 30, 2007 (Volume 72, Number 209)
DOCID: fr30oc07-14 FR Doc E7-21348
FEDERAL TRADE COMMISSION
Veterans Affairs Department
CFR Citation: 16 CFR Parts 680 and 698
RIN ID: RIN 3084-AA94
DOCUMENT ID: [Regulation No. 411006]
NOTICE: Part II
DOCUMENT ACTION: Final rule.
Affiliate Marketing Rule
DATES: This rule is effective on January 1, 2008. The mandatory compliance date for this rule is October 1, 2008.
The Federal Trade Commission (FTC or Commission) is publishing a final rule to implement the affiliate marketing provisions in section 214 of the Fair and Accurate Credit Transactions Act of 2003, which amends the Fair Credit Reporting Act. The final rule generally prohibits a person from using information received from an affiliate to make a solicitation for marketing purposes to a consumer, unless the consumer is given notice and a reasonable opportunity and a reasonable and simple method to opt out of the making of such solicitations. The FACT Act requires certain other federal agencies to publish similar rules, and mandates that the FTC and other agencies consult and cooperate so that their regulations implementing this provision are consistent and comparable with one another.
Federal Trade Commission,
The Fair Credit Reporting Act
The Fair Credit Reporting Act (FCRA or Act), which was enacted in
1970, sets standards for the collection, communication, and use of
information bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal
characteristics, or mode of living. 15 U.S.C. 16811681x. In 1996, the Consumer Credit Reporting Reform Act extensively amended the FCRA. Pub. L. 104208, 110 Stat. 3009.
The FCRA, as amended, provides that a person may communicate to an
affiliate or a nonaffiliated third party information solely as to
transactions or experiences between the consumer and the person without
becoming a consumer reporting agency.\1\ In addition, the communication
of such transaction or experience information among affiliates will not
result in any affiliate becoming a consumer reporting agency. See FCRA Sec. Sec. 603(d)(2)(A)(i) and (ii).
\1\ The FCRA creates substantial obligations for a person that meets the definition of a ``consumer reporting agency'' in section 603(f) of the statute.
Section 603(d)(2)(A)(iii) of the FCRA provides that a person may communicate ``other'' informationthat is, information that is not transaction or experience informationamong its affiliates without becoming a consumer reporting agency if it is clearly and conspicuously disclosed to the consumer that such information may be communicated among affiliates and the consumer is given an opportunity, before the information is communicated, to ``opt out'' or direct that the information not be communicated among such affiliates, and the consumer has not opted out.
The Fair and Accurate Credit Transactions Act of 2003
The President signed into law the Fair and Accurate Credit Transactions Act of 2003 (FACT Act) on December 4, 2003. Pub. L. 108 159, 117 Stat. 1952. In general, the FACT Act amends the FCRA to enhance the ability of consumers to combat identity theft, increase the accuracy of consumer reports, restrict the use of medical information in credit eligibility determinations, and allow consumers to exercise greater control regarding the type and number of solicitations they receive.
Section 214 of the FACT Act added a new section 624 to the FCRA. This provision gives consumers the right to restrict a person from using certain information obtained from an affiliate to make solicitations to that consumer. Section 624 generally provides that if a person receives certain consumer eligibility information from an affiliate, the person may not use that information to make solicitations to the consumer about its products or services, unless the consumer is given notice and an opportunity and a simple method to opt out of such use of the information, and the consumer does not opt out. The statute also provides that section 624 does not apply, for example, to a person using eligibility information: (1) to make solicitations to a consumer with whom the person has a preexisting business relationship; (2) to perform services for another affiliate subject to certain conditions; (3) in response to a communication initiated by the consumer; or (4) to make a solicitation that has been authorized or requested by the consumer. Unlike the FCRA affiliate sharing optout and the GrammLeachBliley Act, 15 U.S.C. 6801 et seq., (GLBA) nonaffiliate sharing optout, which apply indefinitely, section 624 provides that a consumer's affiliate marketing optout election must be effective for a period of at least five years. Upon expiration of the optout period, the consumer must be given a renewal notice and an opportunity to renew the optout before information received from an affiliate may be used to make solicitations to the consumer.
Section 624 governs the use of information by an affiliate, not the sharing of information among affiliates, and thus is distinct from the affiliate sharing optout under section 603(d)(2)(A)(iii) of the FCRA. Nevertheless, the affiliate marketing and affiliate sharing optouts and the information subject to the two optouts overlap to some extent. As noted above, the FCRA allows transaction or experience information to be shared among affiliates without giving the consumer notice and an opportunity to opt out, but provides that ``other'' information, such as information from credit reports and credit applications, may not be shared among affiliates without giving the consumer notice and an opportunity to opt out. The new affiliate marketing optout applies to both transaction or experience information and ``other'' information. Thus, certain information will be subject to two optouts, a sharing optout and a marketing use optout.
Section 214(b) of the FACT Act requires the FTC, the Federal
banking agencies,\2\ the Securities and Exchange Commission (SEC), and
the National Credit Union Administration (NCUA) to prescribe
regulations, in consultation and coordination with each other, to
implement the FCRA's affiliate marketing optout provisions. In
adopting its regulation, the Commission must ensure that the affiliate
marketing notification methods provide a simple means for consumers to
make choices under section 624, consider the affiliate sharing
notification practices employed on the date of enactment by persons
subject to section 624, and ensure that notices may be coordinated and consolidated with other notices required by law.
\2\ The Federal banking agencies are the Board of Governors of the Federal Reserve System (Board), the Office of the Comptroller of the Currency (OCC), the Federal Deposit Insurance Corporation (FDIC), and the Office of Thrift Supervision (OTS).
II. The Proposed Regulation
The Commission published its notice of proposed rulemaking in the
Federal Register on June 15, 2004 (69 FR 33324) to implement section 214 of the FACT Act.\3\
\3\ On July 15, 2004, the Federal banking agencies and the NCUA published their proposed affiliate marketing rule in the Federal Register (69 FR 42502). The SEC published its proposed affiliate marketing rule in the Federal Register on July 14, 2004 (69 FR 42301).
The proposal defined the key terms ``preexisting business relationship'' and ``solicitation'' essentially as defined in the statute. The Commission did not propose to include additional circumstances within the meaning of ``preexisting business relationship'' or other types of communications within the meaning of ``solicitation.''
To address the scope of the affiliate marketing optout, the
proposal defined ``eligibility information'' to mean any information
the communication of which would be a ``consumer report'' if the
statutory exclusions from the definition of ``consumer report'' in
section 603(d)(2)(A) of the FCRA for transaction or experience
information and for ``other'' information that is subject to the
affiliatesharing optout did not apply. The Commission substituted the
term ``eligibility information'' for the more complicated statutory
language regarding the communication of information that would be a
consumer report, but for clauses (i), (ii), and (iii) of section
603(d)(2)(A) of the FCRA.\4\ In addition, the proposal incorporated
each of the scope limitations contained in the statute, such as the preexisting business relationship exception.
\4\ Under section 603(d)(1) of the FCRA, a ``consumer report'' means any written, oral, or other communication of any information by a consumer reporting agency bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living which is used or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing the consumer's eligibility for credit or insurance to be used primarily for personal, family, or household purposes, employment purposes, or any other purpose authorized in section 604 of the FCRA. 15 U.S.C. 1681a(d).
Section 624 does not state which affiliate must give the consumer the affiliate marketing optout notice. The proposal provided that the person communicating information about a consumer to its affiliate would be responsible for satisfying the notice requirement, if applicable. A rule of construction provided flexibility to allow the notice to be given by the person that communicates information to its affiliate, by the person's agent, or through a joint notice with one or more other affiliates. The Commission designed this approach to provide flexibility and to facilitate the use of a single coordinated notice, while taking into account existing affiliate sharing notification practices. At the same time, the approach sought to ensure that the notice would be effective because it generally would be provided by or on behalf of an entity from which the consumer would expect to receive important notices, and would not be provided along with solicitations.
The proposal also provided guidance on the contents of the optout notice, what constitutes a reasonable opportunity to opt out, reasonable and simple methods of opting out, and the delivery of opt out notices. Finally, the proposal provided guidance on the effect of the limited duration of the optout and the requirement to provide an extension notice upon expiration of the optout period.
III. Overview of Comments Received
The Commission received 49 comments. In addition, the Commission considered the comments submitted to the Federal banking agencies, the NCUA, and the SEC. Many commenters sent copies of the same letter to more than one agency. The Commission received comments from a variety of banks, thrifts, credit unions, credit card companies, mortgage lenders, other nonbank creditors, and industry trade associations. The Commission also received comments from consumer groups, the National Association of Attorneys General (``NAAG''), and individual consumers.
Most industry commenters objected to several key aspects of the proposal. The most significant areas of concern raised by industry commenters related to which affiliate would be responsible for providing the notice, the scope of certain exceptions to the notice and optout requirement, and the content or the inclusion of definitions for terms such as ``clear and conspicuous'' and ``preexisting business relationship.'' Consumer groups and NAAG generally supported the proposal, although these commenters believed that the proposal could be strengthened in certain respects. A more detailed discussion of the comments is contained in the SectionbySection Analysis below. IV. SectionbySection Analysis
Section 680.1 Purpose and Scope
Section 680.1 of the proposal set forth the purpose and scope of the regulation. The Commission received few comments on this section. Section 680.1(b) of the final rule identifies the persons covered by this part of the Commission's rule.
Section 680.2 Examples
Proposed Sec. 680.2 described the scope and effect of the examples included in the proposed rule. Most commenters supported the proposed use of nonexclusive examples to illustrate the operation of the rule. One commenter, concerned that the use of examples would increase the risk of litigation, urged the Commission to delete all examples.
The Commission does not believe the use of illustrative examples will materially increase the risk of litigation, but rather will provide useful guidance for compliance purposes, which may alleviate litigation risks for institutions.
As Sec. 680.2 states, examples in a paragraph illustrate only the issue described in the paragraph and do not illustrate any other issue that may arise in the part. Similarly, the examples do not illustrate any issues that may arise under other laws or regulations.
Section 680.3 Definitions
Section 680.3 of the proposal contained definitions for the following terms: ``Act,'' ``affiliate'' (as well as the related terms ``company'' and ``control''); ``clear and conspicuous''; ``consumer''; ``eligibility information''; ``person''; ``preexisting business relationship''; ``solicitation''; and, ``you.''
Those definitions that elicited comment are discussed below. Affiliate, Common Ownership or Common Corporate Control, and Company
The proposed rule included definitions for ``affiliate'' as well as for the related terms ``control'' and ``company.'' For the reasons discussed below, the final rule substituted ``common ownership or common corporate control'' as a substitute for the definition of ``control,'' and renumbered it as Sec. 680.3(d). The term ``company'' is renumbered as Sec. 680.3(e).
Several FCRA provisions apply to information sharing with persons
``related by common ownership or affiliated by corporate control,''
``related by common ownership or affiliated by common corporate
control,'' or ``affiliated by common ownership or common corporate
control.'' E.g., FCRA, sections 603(d)(2), 615(b)(2), and 625(b)(2).
Each of these provisions was enacted as part of the 1996 amendments to
the FCRA. Similarly, section 2 of the FACT Act defines the term
``affiliate'' to mean ``persons that are related by common ownership or affiliated by
corporate control.'' In contrast, the GLBA defines ``affiliate'' to mean ``any company that controls, is controlled by, or is under common control with another company.'' See 15 U.S.C. 6809(6).
In the proposal, the Commission sought to harmonize the various FCRA and FACT Act formulations by defining ``affiliate'' to mean ``any person that is related by common ownership or common corporate control with another person.'' Industry commenters generally supported the Commission's goal of harmonizing the various FCRA definitions of ``affiliate'' for consistency. Many of these commenters, however, believed that the most effective way to do this was for the Commission to incorporate into the FCRA the definition of ``affiliate'' used in the GLBA privacy regulations. In addition, a few industry commenters urged the Commission to incorporate into the definition of ``affiliate'' certain concepts from California's Financial Information Privacy Act so as to exempt certain classes of corporate affiliates from the restrictions on affiliate sharing or marketing.\5\ \5\ These commenters noted that the California law places no restriction on information sharing among affiliates if they: (1) are regulated by the same or similar functional regulators; (2) are involved in the same broad line of business, such as banking, insurance, or securities; and (3) share a common brand identity.
The Commission does not believe there is a substantive difference between the FACT Act definition of ``affiliate'' and the definition of ``affiliate'' in section 509 of the GLBA. The Commission is not aware of any circumstances in which two entities would be affiliates for purposes of the FCRA but not for purposes of the GLBA privacy rule, or vice versa. Also, even though affiliated entities have had to comply with different FCRA and GLBA formulations of the ``affiliate'' definition since 1999, commenters did not identify any specific compliance difficulties or uncertainty resulting from the fact that the two statutes use somewhat different wording to describe what constitutes an affiliate.
Consistent with the definition of ``affiliate'' adopted by the Federal banking agencies in the final medical information rules, the Commission declines to incorporate into the definition of ``affiliate'' exceptions for entities regulated by the same or similar functional regulators, entities in the same line of business, or entities that share a common brand or identity. See 70 FR 7066470665 (Nov. 22, 2005). These exceptions were incorporated into the California Financial Information Privacy Act in August 2003.\6\ Congress, however, did not incorporate these exceptions from California law into the definition of ``affiliate'' when it enacted the FACT Act at the end of 2003. Accordingly, the Commission believes that the approach adopted here best effectuates the intent of Congress.
\6\ See Cal. Financial Code Sec. 4053(c).
Under the GLBA privacy rule, the definition of ``control'' determines whether two or more entities meet the definition of ``affiliate.''\7\ The Commission included the same definition of ``control'' in the proposal and received no comments on the proposed definition. The Commission interprets the phrase ``related by common ownership or common corporate control'' used in the FACT Act to have the same meaning as ``control'' in the GLBA privacy rule. For example, if an individual owns 25 percent of two companies, the companies would be affiliates under both the GLBA and FCRA definitions. However, the individual would not be considered an affiliate of the companies because the definition of ``affiliate'' is limited to companies. \7\ See 16 C.F.R. 313.3(g).
The proposal also defined the term ``company'' to mean any corporation, limited liability company, business trust, general or limited partnership, association, or similar organization. The proposed definition of ``company'' excluded some entities that are ``persons'' under the FCRA, including estates, cooperatives, and governments or governmental subdivisions or agencies, as well as individuals. Clear and Conspicuous
Proposed Sec. 680.3(c) defined the term ``clear and conspicuous'' to mean reasonably understandable and designed to call attention to the nature and significance of the information presented. Under this definition, institutions would retain flexibility in determining how best to meet the clear and conspicuous standard. The supplementary information to the proposal provided guidance regarding a number of practices that institutions might wish to consider in making their notices clear and conspicuous. These practices were derived largely from guidance included in the GLBA privacy rule.
Industry commenters urged the Commission not to define ``clear and conspicuous'' in the final rule. The principal objection these commenters raised was that this definition would significantly increase the risk of litigation and civil liability. Although these commenters recognized that the proposed definition was derived from the GLBA privacy regulations, they noted that compliance with the GLBA privacy regulations is enforced exclusively through administrative action, not through private litigation. These commenters also stated that the Federal Reserve Board had withdrawn a similar proposal to define ``clear and conspicuous'' for purposes of Regulations B, E, M, Z, and DD, in part because of concerns about civil liability. Some industry commenters believed that it was not necessary to define the term in order for consumers to receive clear and conspicuous disclosures based on industry's experience in providing clear and conspicuous affiliate sharing optout notices. Consumer groups believed that incorporation of the standard and examples from the GLBA privacy regulations was not adequate because they did not believe that the existing standard has proven sufficient to ensure effective privacy notices.
Except for certain nonsubstantive changes made for purposes of clarity, the definition of ``clear and conspicuous'' is the same as in the proposal and is substantively the same as the definition used in the GLBA privacy rule. The Commission believes that the clear and conspicuous standard for the affiliate marketing optout notices should be substantially similar to the standard that applies to GLBA privacy notices because the affiliate marketing optout notice may be provided on or with the GLBA privacy notice.
In defining ``clear and conspicuous,'' the Commission believes it is more appropriate to focus on the affiliate marketing optout notices that are the subject of this rulemaking, rather than adopting a generally applicable definition governing all consumer disclosures under the FCRA. This approach gives the Commission the flexibility to refine or clarify the clear and conspicuous requirement for different disclosures, if necessary.
The statute directs the Commission to provide specific guidance regarding how to comply with the clear and conspicuous standard. See 15 U.S.C. 1681s3(a)(2)(B). For that reason, the Commission does not agree with commenters that requested the elimination of the definition of ``clear and conspicuous'' and related guidance. Rather, the Commission believes it is necessary to define ``clear and conspicuous'' in the final rule and provide specific guidance for how to satisfy that standard in connection with this notice.
Accordingly, the final rule contains two types of specific guidance on satisfying the requirement to provide a clear and conspicuous opt out notice. First, as in the proposal, the supplementary information to the final rule describes certain techniques that may be used to make notices clear and conspicuous. These techniques are described below. Second, the Commission has adopted model forms that may, but are not required to, be used to facilitate compliance with the affiliate marketing notice requirements. The requirement for clear and conspicuous notices would be satisfied by the appropriate use of one of the model forms.
As noted in the supplementary information to the proposal, institutions may wish to consider a number of methods to make their notices clear and conspicuous. The various methods described below for making a notice clear and conspicuous are suggestions that institutions may wish to consider in designing their notices. Use of any of these methods alone or in combination is voluntary. Institutions are not required to use any particular method or combination of methods to make their disclosures clear and conspicuous. Rather, the particular facts and circumstances will determine whether a disclosure is clear and conspicuous.
A notice or disclosure may be made reasonably understandable through various methods that include: using clear and concise sentences, paragraphs, and sections; using short explanatory sentences; using bullet lists; using definite, concrete, everyday words; using active voice; avoiding multiple negatives; avoiding legal and highly technical business terminology; and avoiding explanations that are imprecise and are readily subject to different interpretations. In addition, a notice or disclosure may be designed to call attention to the nature and significance of the information in it through various methods that include: using a plainlanguage heading; using a typeface and type size that are easy to read; using wide margins and ample line spacing; and using boldface or italics for key words. Further, institutions that provide the notice on a Web page may use text or visual cues to encourage scrolling down the page, if necessary, to view the entire notice and may take steps to ensure that other elements on the Web site (such as text, graphics, hyperlinks, or sound) do not distract attention from the notice. When a notice or disclosure is combined with other information, methods for designing the notice or disclosure to call attention to the nature and significance of the information in it may include using distinctive type sizes, styles, fonts, paragraphs, headings, graphic devices, and appropriate groupings of information. However, there is no need to use distinctive features, such as distinctive type sizes, styles, or fonts, to differentiate an affiliate marketing optout notice from other components of a required disclosure, for example, where a GLBA privacy notice combines several optout disclosures in a single notice. Moreover, nothing in the clear and conspicuous standard requires segregation of the affiliate marketing optout notice when it is combined with a GLBA privacy notice or other required disclosures.
The Commission recognizes that it will not be feasible or appropriate to incorporate all of the methods described above all the time. The Commission recommends, but does not require, that institutions consider the methods described above in designing their optout notices. The Commission also encourages the use of consumer or other readability testing to devise notices that are understandable to consumers.
Finally, although the Commission understands the concerns of some industry commenters about the potential for civil liability, the Commission believes that these concerns are mitigated by the safe harbors afforded by the model forms in Appendix C to Part 698. The Commission notes that the affiliate sharing optout notice under section 603(d)(2)(A)(iii) of the FCRA, which may be enforced through private rights of action, must be included in the GLBA privacy notice. Therefore, the affiliate sharing optout notice generally is disclosed in a manner consistent with the clear and conspicuous standard set forth in the GLBA privacy regulations. Commenters did not identify any litigation that has resulted from the requirement to provide a clear and conspicuous affiliate sharing optout notice. The Commission believes that compliance with the examples and use of the model forms, although optional, should minimize the risk of litigation.
Proposed Sec. 680.21(b) defined the term ``concise'' to mean a
reasonably brief expression or statement. The proposal also provided
that a notice required by this part may be concise even if it is
combined with other disclosures required or authorized by federal or
state law. Such disclosures include, but are not limited to, a GLBA privacy notice, an affiliate sharing notice under section
603(d)(2)(A)(iii) of the FCRA, and other consumer disclosures. Finally, the proposal clarified that the requirement for a concise notice would be satisfied by the appropriate use of one of the model forms contained in proposed Appendix A to the Commission's rule, although use of the model forms is not required. The Commission received no comments on the proposed definition of ``concise.'' The final rule renumbers the definition of ``concise'' as Sec. 680.3(f). The reference to the model forms has been moved to Appendix C to Part 698, but otherwise the definition is adopted as proposed.
Proposed paragraph (e) defined the term ``consumer'' to mean an individual. This definition is identical to the definition of ``consumer'' in section 603(c) of the FCRA.
Several commenters asked the Commission to narrow the proposed definition to apply only to individuals who obtain financial products or services primarily for personal, family, or household purposes, in part to achieve consistency with the definition of ``consumer'' in the GLBA. The FCRA's definition of ``consumer,'' however, differs from, and is broader than, the definition of that term in the GLBA. The Commission believes that the use of distinct definitions of ``consumer'' in the two statutes reflects differences in the scope and objectives of each statute. For purposes of this definition, an individual acting through a legal representative would qualify as a consumer. The final rule renumbers ``consumer'' as Sec. 680.3(g) but otherwise adopts it without change.
Proposed Sec. 680.3(g) defined the term ``eligibility information'' to mean any information the communication of which would be a consumer report if the exclusions from the definition of ``consumer report'' in section 603(d)(2)(A) of the FCRA did not apply. As proposed, eligibility information would include a person's own transaction or experience information, such as information about a consumer's account history with that person, and ``other'' information under section 603(d)(2)(A)(iii), such as information from consumer reports or applications.
Most commenters generally supported the proposed definition of
``eligibility information'' as an appropriate means of simplifying the
statutory terminology without changing the scope of the information
covered by the rule. A number of commenters requested that the
Commission clarify that certain types of information do not constitute eligibility information, such as name,
address, telephone number, Social Security number, and other identifying information. One commenter requested the exclusion of publicly available information from the definition. Another commenter requested additional clarification regarding the term ``transaction or experience information.'' A few commenters suggested that the Commission include examples of what is and is not included within ``eligibility information.'' Finally, one commenter urged the Commission to revise the definition to restate much of the statutory definition of ``consumer report'' to eliminate the need for cross references.
The final rule renumbers the definition of ``eligibility information'' as 680.3(h). The Commission has revised the definition to clarify that the term ``eligibility information'' does not include aggregate or blind data that does not contain personal identifiers. Examples of personal identifiers include account numbers, names, or addresses, as indicated in the definition, as well as Social Security numbers, driver's license numbers, telephone numbers, or other types of information that, depending on the circumstances or when used in combination, could identify the individual.
The Commission also believes that further clarification of, or exclusions from, the term ``eligibility information,'' such as the categorical exclusion of names, addresses, telephone numbers, other identifying information, or publicly available information, would directly implicate the definitions of ``consumer report'' and ``consumer reporting agency'' in sections 603(d) and (f), respectively, of the FCRA. The Commission decided not to define the terms ``consumer report'' and ``consumer reporting agency'' in this rulemaking and not to interpret the meaning of terms used in those definitions, such as ``transaction or experience'' information. The Commission also notes that financial institutions have relied on these statutory definitions for many years.
Proposed paragraph (h) defined the term ``person'' to mean any individual, partnership, corporation, trust, estate, cooperative, association, government or governmental subdivision or agency, or other entity. This definition is identical to the definition of ``person'' in section 603(b) of the FCRA.
One commenter requested clarification of how the proposed definition of ``person'' would affect other provisions of the affiliate marketing rule. Specifically, this commenter asked how the supplementary information's discussion of agents might affect the scope provisions of the rule.
The supplementary information to the proposal stated that a person may act through an agent, including but not limited to a licensed agent (in the case of an insurance company) or a trustee. The supplementary information also provided that actions taken by an agent on behalf of a person that are within the scope of the agency relationship would be treated as actions of that person. The Commission included these statements to address comprehensively the status of agents and to eliminate the need to refer specifically to licensed agents in the proposed definition of ``preexisting business relationship.'' As discussed below, many commenters believed that licensed agents should be expressly included in the definition of ``preexisting business relationship.'' The Commission has revised the final rule in response to those comments. By specifically addressing licensed agents, the final rule does not alter the general principles of principalagent relationships that apply to all agents, not just licensed agents. The Commission will treat actions taken by an agent on behalf of a person that are within the scope of the agency relationship as actions of that person, regardless of whether the agent is a licensed agent or not. The final rule renumbers the definition of ``person'' as Sec. 680.3(i). PreExisting Business Relationship
Proposed Sec. 680.3(i) defined the term ``preexisting business relationship'' to mean a relationship between a person and a consumer based on the following: (1) a financial contract between the person and the consumer that is in force; (2) the purchase, rental, or lease by the consumer of that person's goods or services, or a financial transaction (including holding an active account or a policy in force or having another continuing relationship) between the consumer and that person, during the 18month period immediately preceding the date on which a solicitation covered by this part is sent to the consumer; or (3) an inquiry or application by the consumer regarding a product or service offered by that person during the threemonth period immediately preceding the date on which a solicitation covered by this part is sent to the consumer.
The proposed definition generally tracked the statutory definition contained in section 624 of the FCRA, with certain revisions for clarity. Although the statute gave the Commission the authority to identify by regulation other circumstances that qualify as a pre existing business relationship, the Commission did not propose to exercise this authority. In the final rule, the definition of ``pre existing business relationship'' has been renumbered as Sec. 680.3(j).
Industry commenters suggested certain revisions to the proposed definition of ``preexisting business relationship.'' Many industry commenters asked the Commission to include in the definition statutory language relating to ``a person's licensed agent.'' A number of these commenters noted that this concept was particularly important to the insurance industry where independent, licensed agents frequently act as the main point of contact between the consumer and the insurance company.
In the final rule, the phrase ``or a person's licensed agent'' has been added to the definition of ``preexisting business relationship'' to track the statutory language. For example, assume that a person is a licensed agent for the affiliated ABC life, auto, and homeowners' insurance companies. A consumer purchases an ABC auto insurance policy through the licensed agent. The licensed agent may use eligibility information about the consumer obtained in connection with the ABC auto policy it sold to the consumer to market ABC life and homeowner's insurance policies to the consumer for the duration of the preexisting business relationship without offering the consumer the opportunity to opt out of that use.
Regarding the first basis for a preexisting business relationship (a financial contract in force), several industry commenters asked the Commission to clarify that a financial contract includes any inforce contract that relates to a financial product or service covered by title V of the GLBA. One commenter objected to the requirement that the contract be in force on the date of the solicitation. This commenter believed that the Commission should interpret the statute to permit the exception to apply if a contract is in force at the time the affiliate uses the information, rather than when the solicitation is sent, noting that there may be a delay between the use and the solicitation.
The Commission has adopted the first prong of the definition of
``preexisting business relationship'' as proposed. Although a
comprehensive definition of the term ``financial contract'' has not
been included in the final rule, the Commission construes the statutory
term ``financial contract'' at least to include a contract that relates to a
consumer's purchase or lease of a financial product or service that a financial holding company could offer under section 4(k) of the Bank Holding Company Act of 1956 (12 U.S.C. 1843(k)). In addition, a financial contract which is in force will, in virtually all instances, qualify as a ``financial transaction,'' as that term is used in the second prong of the definition of ``preexisting business
relationship.'' The Commission does not agree with the suggestion that the financial contract should be in force on the date of use rather than on the date the solicitation is sent. The approach taken in the proposed and final rule is consistent with the approach used in the other two prongs of the statutory definition.
Industry commenters also suggested certain clarifications to the second basis for a preexisting business relationshipa purchase, rental, or lease by the consumer of the person's goods or services, or a financial transaction between the consumer and the person during the preceding 18 months. Several industry commenters noted that, notwithstanding the example in the proposal regarding a lapsed insurance policy, it was not clear from what point in time the 18month period begins to run in the case of many purchase, rental, lease, or financial transactions. These commenters asked the Commission to clarify that the 18month period begins to run at the time all contractual responsibilities of either party under the purchase, rental, lease, or financial transaction expire. In addition, some commenters indicated that the term ``active account'' should be clarified to mean any account with outstanding contractual responsibilities on either side of an account relationship, regardless of whether specific transactions do or do not occur on that account.
The Commission has adopted the second prong of the definition of ``preexisting business relationship'' as proposed. The Commission declines to interpret the term ``active account'' as requested by some commenters. The Commission notes that section 603(r)(4) of the FCRA defines the term ``account'' to have the same meaning as in section 903 of the Electronic Fund Transfer Act (EFTA). Under the EFTA, the term ``account'' means a demand deposit, savings deposit, or other asset account established primarily for personal, family, or household purposes. Some commenters, however, apparently believed that the term ``active account'' included extensions of credit. Credit extensions presumably would qualify as ``another continuing relationship,'' as used in the definition of ``preexisting business relationship.''
More generally, however, even though a ``financial transaction'' would include in virtually all cases a financial contract which is in force, as noted above, the Commission does not believe it is appropriate to state that the 18month period begins to run when all outstanding contractual responsibilities of both parties expire, regardless of whether specific transactions occur. Such a clarification would not appropriately address circumstances such as chargeoffs, bankruptcies, early terminations, or extended periods of credit inactivity that could trigger commencement of the 18month period. In addition, some contract provisions, such as arbitration clauses and choice of law provisions, may continue to have legal effect after all contractual performance has ended. The Commission does not believe that the continued effectiveness of such provisions should delay commencement of the 18month period.
Nevertheless, the Commission believes that a few examples may provide useful guidance to facilitate compliance. For example, in the case of a closedend mortgage or auto loan, the 18month period generally would begin to run when the consumer pays off the outstanding balance on the loan. In a lease or rental transaction, the 18month period generally would begin to run when the lease or rental agreement expires or is terminated by mutual agreement. In the case of general purpose credit cards that are issued with an expiration date, the 18 month period generally would begin to run when the consumer pays off the outstanding balance on the card and the card is either cancelled or expires without being renewed.
Commenters also made certain suggestions regarding the third basis for a preexisting business relationshipan inquiry or application by the consumer regarding a product or service offered by the person during the preceding three months. Consumer groups urged the Commission to clarify that an inquiry must be made of the specific affiliate, rather than a general inquiry about a product or service. Industry commenters expressed concern about certain statements in the supplementary information that explained the meaning of an inquiry.
The Commission does not agree that an inquiry must be made of a specific affiliate. Many affiliated institutions use a central call center to handle consumer inquiries. The clarification urged by consumer groups could preclude the establishment of a preexisting business relationship based on a consumer's call to a central call center about a specific product or service offered by an affiliate.
In the supplementary information to the proposal, the Commission
noted that certain elements of the definition of ``preexisting
business relationship'' were substantially similar to the definition of
``established business relationship'' under the amended Telemarketing
Sales Rule (TSR) (16 CFR 310.2(n)). The TSR definition was informed by
Congress' intent that the ``established business relationship''
exemption to the ``do not call'' provisions of the Telephone Consumer
Protection Act (47 U.S.C. 227 et seq.) should be grounded on the
reasonable expectations of the consumer.\8\ The Commission observed
that Congress' incorporation of similar language in the definition of
``preexisting business relationship''\9\ suggested that it would be
appropriate to consider the reasonable expectations of the consumer in
determining the scope of this exception. Thus, the Commission explained
that, for purposes of this regulation, an inquiry would include any
affirmative request by a consumer for information after which the
consumer would reasonably expect to receive information from the
affiliate about its products or services.\10\ Moreover, a consumer
would not reasonably expect to receive information from the affiliate
if the consumer did not request information or did not provide contact information to the affiliate.
\8\ H.R. Rep. No. 102317, at 1415 (1991). See also 68 FR 4580, 459194 (Jan. 29, 2003).
\9\ 149 Cong. Rec. S13,980 (daily ed. Nov. 5, 2003) (statement of Senator Feinstein) (noting that the ``preexisting business relationship'' definition ``is the same definition developed by the Federal Trade Commission in creating a national `Do Not Call' registry for telemarketers.'')
\10\See 68 FR at 4594.
Industry commenters objected to the discussion in the supplementary
information. Some of these commenters believed that looking to the
reasonable expectations of the consumer would narrow the scope of the
exception and impose on institutions a subjective standard that
depended upon the consumer's state of mind. These commenters also
maintained that the availability of the exception should not depend
upon the consumer both requesting information and providing contact
information to the affiliate. Some commenters noted that either
requesting information or providing contact information should suffice
to establish an expectation of receiving solicitations. Other commenters noted that consumers would not provide
contact information if they believed that the affiliate would already have the consumer's contact information or would obtain it from the consumer's financial institution. Some commenters believed that the consumer should not have to make an affirmative request for information in order to have an inquiry. Commenters also expressed concern that the discussion in the supplementary information would require consumers to use specific words to trigger the exception.
The Commission has adopted the third prong of the definition of ``preexisting business relationship'' as proposed. The Commission continues to believe that it is appropriate to consider what the consumer says in determining whether the consumer has made an inquiry about a product or service. It may not be necessary, however, for the consumer to provide contact information in all cases. As discussed below, the Commission has revised the examples of inquiries to illustrate different circumstances.
Consumer groups and NAAG urged the Commission not to expand the definition of ``preexisting business relationship'' to include any additional types of relationships. Industry commenters suggested a number of additional bases for establishing a preexisting business relationship. Several industry commenters believed that the term ``pre existing business relationship'' should be defined to include relationships arising out of the ownership of servicing rights, a participation interest in lending transactions, and similar relationships. These commenters provided no further explanation for why such an expansion was necessary. One commenter urged the Commission to expand the definition of ``preexisting business relationship'' to apply to affiliates that share a common trade name, share the same employees or representatives, operate out of the same physical location or locations, and offer similar products.
In addition, a number of industry commenters requested clarification of the term ``preexisting business relationship'' as applied to manufacturers that make sales through dealers. These commenters explained that automobile manufacturers do not sell vehicles directly to consumers, but through franchised dealers. Vehicle financing may be arranged through a manufacturer's captive finance company or independent sources of financing. These commenters noted that manufacturers often provide consumers with information about warranty coverage, recall notices, and other product information. According to these commenters, manufacturers also send solicitations to consumers about their products and services, drawing in part on transaction or experience information from the captive finance company. These commenters asked the Commission to clarify that the relationship between a manufacturer and a consumer qualifies as a preexisting business relationship based on the purchase, rental, or lease of the manufacturer's goods, or, alternatively, to exercise its authority to add this relationship as an additional basis for a preexisting business relationship. One commenter asked the Commission to clarify that a preexisting business relationship could be established even if the person provides a product or service to the consumer without charging a fee.
The Commission does not believe it is necessary to add any additional bases for a preexisting business relationship. The Commission acknowledges that a preexisting business relationship exists where a person owns the servicing rights to a consumer's loan and such person collects payments from, or otherwise deals directly with, the consumer. In the Commission's view, however, that situation qualifies as a financial transaction and thus falls within the second prong of the definition of ``preexisting business relationship.'' The Commission has included an example, discussed below, to illustrate how the ownership of servicing rights can create a preexisting business relationship.
A preexisting business relationship does not arise solely from a participation interest in a lending transaction because such an interest does not result in a financial contract or a financial transaction between the consumer and the participating party. The Commission declines to add a specific provision for franchised dealers. The statute contains no special provision addressing franchised dealers, as it does for licensed agents. Moreover, a franchised dealer and a manufacturer generally are not affiliates and thus are subject to the GLBA privacy rule relating to information sharing with non affiliated third parties. The Commission also finds no basis for including within the meaning of ``preexisting business relationship'' any affiliate that shares a common trade name or representatives, or that operates from the same location or offers similar products. Finally, the Commission declines to add a provision that would create a preexisting business relationship when a consumer obtains a product or service without charge from a person. Such a provision would be overly broad, is not necessary given the breadth of the statutory definition of ``preexisting business relationship,'' and could result in circumvention of the notice requirement.
Proposed Sec. 680.20(d)(1) provided four examples of the pre existing business relationship exception. In the final rule, these examples have been renumbered as Sec. 680.3(j)(2)(i)(iv), and revised to illustrate the definition of ``preexisting business relationship,'' rather than the corresponding exception.
The two examples relating to the first and second prongs of the definition of ``preexisting business relationship'' have been revised in Sec. 680.3(j)(2)(i) and (ii) to focus on a loan account creditor as the person with the preexisting business relationship, but are otherwise substantively similar to the proposal. One commenter recommended expanding the example now contained in Sec. 680.3(j)(2)(i) to refer to the licensed agent that wrote the policy or services the relationship. The Commission believes that adding the term ``licensed agent'' to the definition is sufficient and sees no reason to further complicate this example to illustrate how the definition applies to licensed agents.
Section 680.3(j)(2)(iii) is new and illustrates when a preexisting
business relationship is created in the context of a mortgage loan.
This example specifically addresses circumstances where either the loan
or ownership of the servicing rights to the loan is sold to a third
party. As this example illustrates, sale of the entire loan by the
original lender terminates the financial transaction between the
consumer and that lender and creates a new financial transaction
between the consumer and the purchaser of the loan. However, the
original lender's sale of a fractional interest in the loan to an
investor does not create a new financial transaction between the
consumer and the investor. When the original lender sells a fractional
interest in the consumer's loan to an investor but also retains an
ownership interest in the loan, however, the original lender continues
to have a preexisting business relationship with the consumer because
the consumer obtained a loan from the lender and the lender continues
to own an interest in the loan. In addition, the ownership of servicing
rights coupled with direct dealings with the consumer results in a
financial transaction between the consumer and the owner of the
servicing rights, thereby creating a preexisting business relationship
between the consumer and the owner of the servicing rights. The
Commission notes that a financial institution that owns servicing rights generally has a customer
relationship with the consumer and an obligation to provide a GLBA privacy notice to the consumer.
The example in proposed Sec. 680.20(d)(1)(iii) regarding applications and inquiries elicited comment. Some industry commenters urged the Commission to revise this example so that it does not depend upon the consumer's expectations or the consumer providing contact information. These commenters noted, for example, that the contact information would be selfevident if the consumer makes an email request or provides a return address on an envelope. These commenters also believed that in the case of a telephone call initiated by a consumer, a captured telephone number should be sufficient to create an inquiry if the consumer requests information about products or services.
In the final rule, the Commission has crafted three separate examples from proposed Sec. 680.20(d)(1)(iii). Section 680.3(j)(2)(iv) provides an example where a consumer applies for a product or service, but does not obtain the product or service for which she applied. Contact information is not mentioned in this example because the consumer presumably would have supplied it on the application.
Section 680.3(j)(2)(v) provides an example where a consumer makes a telephone inquiry about a product or service offered by a depository institution and provides contact information to the institution, but does not obtain a product or service from or enter into a financial transaction with the institution. The Commission does not believe that an institution's capture of a consumer's telephone number during a telephone conversation with the consumer about the institution's products or services is sufficient to create an inquiry. In that circumstance, to ensure that an inquiry has been made, the institution should ask the consumer to provide his or her contact information, or confirm with the consumer that the consumer has a preexisting business relationship with an affiliate.
Section 680.3(j)(2)(vi) provides an example where the consumer makes an email inquiry about a product or service offered by a creditor, but does not separately provide contact information. In that case, the consumer provides the creditor with contact information in the form of the consumer's email address. In addition, email communications, unlike telephone communications, do not provide institutions with the same opportunity to ask for the consumer's contact information.
Industry commenters recommended deleting the example in proposed Sec. 680.20(d)(1)(iv) illustrating a call center scenario where a consumer would not reasonably expect to receive information from an affiliate. In the final rule, the Commission has included a positive example of an inquiry made by a consumer through a call center in Sec. 680.3(j)(2)(vii), while retaining the negative example from the proposal in Sec. 680.3(j)(3)(i). In addition, the Commission has included in Sec. 680.3(j)(3)(ii) an example of a consumer call to ask about retail locations and hours, which does not create a preexisting business relationship. This example is substantively similar to the example from proposed Sec. 680.20(d)(2)(iii).
A new example in Sec. 680.3(j)(3)(iii) illustrates a case where a consumer responds to an advertisement that offers a free promotional item, but the advertisement does not indicate that an affiliate's products or services will be marketed to consumers who respond to the advertisement. The example illustrates that the consumer's response does not create a preexisting business relationship because the consumer has not made an inquiry about a product or service, but has merely responded to an offer for a free promotional item. Similarly, if a consumer is directed by a company with which the consumer has a pre existing business relationship to contact the company's affiliate to receive a promotional item but the company does not mention the affiliate's products or services, the consumer's contact with the affiliate about the promotional item does not create a preexisting business relationship between the consumer and the affiliate. Solicitation
Proposed Sec. 680.3(j) defined the term ``solicitation'' to mean
marketing initiated by a person to a particular consumer that is based
on eligibility information communicated to that person by its affiliate
and is intended to encourage the consumer to purchase a product or service. The proposed definition further clarified that a
communication, such as a telemarketing solicitation, direct mail, or e mail, would be a solicitation if it is directed to a specific consumer based on eligibility information. The proposed definition did not, however, include communications that were directed at the general public without regard to eligibility information, even if those communications were intended to encourage consumers to purchase products and services from the person initiating the communications.
Congress gave the Commission the authority to determine by regulation that other communications do not constitute a solicitation. The Commission does not propose to exercise this authority. The Commission solicited comment on whether, and to what extent, various tools used in Internet marketing, such as popup ads, may constitute solicitations as opposed to communications directed at the general public, and whether further guidance was needed to address Internet marketing.
Most commenters believed that the proposed definition tracked the statutory definition contained in section 624 of the FCRA. A number of industry commenters, however, believed that the proposed definition misstated the types of marketing that would not qualify as a solicitation. Specifically, the first sentence of proposed Sec. 680.3(j)(2) provided that ``[a] solicitation does not include communications that are directed at the general public and distributed without the use of eligibility information communicated by an affiliate.'' These commenters believed that a solicitation should not include either marketing directed at the general public or marketing distributed without the use of eligibility information communicated by an affiliate. Several industry commenters also requested that the Commission include the phrase ``of a product or service'' in the introductory language for consistency with the statutory definition. Some industry commenters sought clarification that certain types of communications would not constitute solicitations, for example, marketing announcements delivered via prerecorded call center messages, automated teller machine screens, or Internet sites, or product information provided at or through educational seminars, customer appreciation events, or newsletters.
NAAG urged the Commission to clarify the portion of the definition that refers to ``a particular consumer.'' NAAG believed that mass mailings of the same or similar marketing materials to a large group of consumers could fall within the definition of ``solicitation,'' so long as the marketing is based on eligibility information received from an affiliate. NAAG expressed concern that some might construe the term ``particular'' to narrow the meaning of a ``solicitation.''
With regard to Internet marketing, industry commenters urged the
Commission not to address such practices in this rulemaking. These [[Page 61432]]
commenters believed that the definition of ``solicitation'' should provide specific guidance that ``popup'' ads and other forms of Internet marketing generally were directed to the general public and not based on eligibility information received from an affiliate, or that such marketing would fall within an exception. NAAG believed that such advertisements should be treated as solicitations if they were based on any eligibility information received from an affiliate. Consumer groups believed that if an affiliate's popup ads and other Internet marketing were the result of specific actions by the consumer or information collected based upon a consumer's experience on the Internet, then such marketing should be considered solicitations. These commenters also believed that popup ads and other Internet marketing targeted to all customers of a company should be treated as solicitations if based on the consumer's experience on the Internet.
Section 680.3(k) of the final rule contains the definition of ``solicitation.'' The definition has been revised to track the statutory language more closely. The phrase ``of a product or service'' has been added to the definition, as requested by some commenters. To ensure consistency with the definition of ``preexisting business relationship,'' the phrase ``or obtain'' has been retained so that the definition of ``solicitation'' will include marketing for the rental or lease of goods or services, financial transactions, and financial contracts. The Commission has also deleted as unnecessary the reference to communications ``distributed without the use of eligibility information communicated by an affiliate.'' Marketing that is undertaken without the use of eligibility information received from an affiliate is not covered by the affiliate marketing rule. Moreover, there is no restriction on using eligibility information received from an affiliate in marketing directed at the general public, such as radio, television, or billboard advertisements. The phrase ``to a particular consumer'' has been retained because it is part of the statutory definition. The Commission does not believe that the phrase ``to a particular consumer'' excludes largescale marketing campaigns from the definition of ``solicitation'' because, within such campaigns, eligibility information received from an affiliate may be used to target individual consumers.
The definition of ``solicitation'' does not distinguish between different mediums. A determination of whether a marketing communication constitutes a solicitation depends upon the facts and circumstances. The Commission has decided not to make those determinations in this rulemaking. Thus, the Commission is not adopting special rules or guidance regarding Internetbased marketing; whether Internetbased marketing is a solicitation in a particular case will be determined according to the same criteria that apply to other means of marketing. The Commission also declines to exclude categorically from the definition of ``solicitation'' marketing messages on voice response units, ATM screens, or other forms of media. Marketing delivered via such media may be solicitations if such marketing is targeted to a particular consumer based on eligibility information received from an affiliate. For example, a marketing message on an ATM screen would be a solicitation if it is targeted to a particular consumer based on eligibility information received from an affiliate, but would not be a solicitation if it is delivered to all consumers that use the ATM.
Similarly, the Commission declines to exclude educational seminars, customer appreciation events, focus group invitations, and similar forms of communication from the definition of ``solicitation.'' The Commission believes that such activities must be evaluated according to the facts and circumstances and some of those activities may be coupled with, or a prelude to, a solicitation. For example, an invitation to a financial educational seminar where the invitees are selected based on eligibility information received from an affiliate may be a solicitation if the seminar is used to solicit the consumer to purchase investment products or services.
The term ``you'' is defined as persons described in Sec. 680.1(a) and the definition has been renumbered as Sec. 680.3(l).
Section 680.21 Affiliate Marketing Optout and Exceptions
The Commission proposed to establish certain rules relating to the requirement to provide the consumer with notice and a reasonable opportunity and a simple method to opt out of a person's use of eligibility information that it obtained from an affiliate for the purpose of making or sending solicitations to the consumer. The Commission noted that the statute is ambiguous because it does not specify which affiliate must provide the optout notice to the consumer. The Commission addressed this ambiguity by proposing to place certain responsibilities on the ``communicating affiliate'' and other responsibilities on the ``receiving affiliate.''
Proposed Sec. 680.20(a) set forth the duties of a communicating affiliate. That section required the communicating affiliate to provide a notice to the consumer before a receiving affiliate could use eligibility information to make or send solicitations to the consumer. Under the proposal, the optout notice would state that eligibility information may be communicated to and used by the receiving affiliate to make or send solicitations to the consumer regarding the affiliate's products and services, and would give the consumer a reasonable opportunity and a simple method to opt out.
Proposed Sec. 680.20(a) also contained two rules of construction relating to the communicating affiliate's duty to provide the notice. The first rule of construction would have allowed the notice to be provided either in the name of a person with which the consumer currently does or previously has done business or in one or more common corporate names shared by members of an affiliated group of companies that includes the common corporate name used by that person. The rule of construction also would have provided alternatives regarding the manner in which the notice could be given, such as by
FOR FURTHER INFORMATION CONTACT
Loretta Garrison and Anthony Rodriguez, Attorneys, Federal Trade Commission, (202) 3262252, Division of Privacy and Identity Protection, Federal Trade Commission, 601 New Jersey Avenue, NW, Washington, DC 20580.