80_FR_36388 80 FR 36267 - Amendment to the Privacy of Consumer Financial Information Rule Under the Gramm-Leach-Bliley Act

80 FR 36267 - Amendment to the Privacy of Consumer Financial Information Rule Under the Gramm-Leach-Bliley Act

FEDERAL TRADE COMMISSION

Federal Register Volume 80, Issue 121 (June 24, 2015)

Page Range36267-36279
FR Document2015-14328

The FTC proposes to amend the Privacy of Consumer Financial Information Rule (Privacy Rule or Rule), which among other things requires that certain motor vehicle dealers provide an annual disclosure of their privacy policies to their customers by hand delivery, mail, electronic delivery, or, alternatively through a Web site, but only with the consent of the consumer. The amendment would allow motor vehicle dealers instead to notify their customers that a privacy policy is available on their Web site, under certain circumstances. The amendment would also revise the scope and definitions in this rule in light of the transfer of part of the Commission's rulemaking authority to the Consumer Financial Protection Bureau (CFPB or the Bureau) in the Dodd-Frank Wall Street Reform and Consumer Protection Act, but retains certain examples for purposes of the FTC's Safeguards Rule.

Federal Register, Volume 80 Issue 121 (Wednesday, June 24, 2015)
[Federal Register Volume 80, Number 121 (Wednesday, June 24, 2015)]
[Proposed Rules]
[Pages 36267-36279]
From the Federal Register Online  [www.thefederalregister.org]
[FR Doc No: 2015-14328]


=======================================================================
-----------------------------------------------------------------------

FEDERAL TRADE COMMISSION

16 CFR Part 313

RIN 3084-AB42


Amendment to the Privacy of Consumer Financial Information Rule 
Under the Gramm-Leach-Bliley Act

AGENCY: Federal Trade Commission (FTC or Commission).

ACTION: Notice of proposed rulemaking; Request for public comment.

-----------------------------------------------------------------------

SUMMARY: The FTC proposes to amend the Privacy of Consumer Financial 
Information Rule (Privacy Rule or Rule), which among other things 
requires that certain motor vehicle dealers provide an annual 
disclosure of their privacy policies to their customers by hand 
delivery, mail, electronic delivery, or, alternatively through a Web 
site, but only with the consent of the consumer. The amendment would 
allow motor vehicle dealers instead to notify their customers that a 
privacy policy is available on their Web site, under certain 
circumstances. The amendment would also revise the scope and 
definitions in this rule in light of the transfer of part of the 
Commission's rulemaking authority to the Consumer Financial Protection 
Bureau (CFPB or the Bureau) in the Dodd-Frank Wall Street Reform and 
Consumer Protection Act, but retains certain examples for purposes of 
the FTC's Safeguards Rule.

DATES: Comments must be received on or before August 31, 2015.

ADDRESSES: Interested parties may file a comment online or on paper, by 
following the instructions in the Request for Comment part of the 
SUPPLEMENTARY INFORMATION section below. Write ``Amendment to the 
Privacy of Consumer Financial Information Rule, 16 CFR part 313, 
Project No. R411016'' on your comment, and file your comment online at 
https://ftcpublic.commentworks.com/ftc/GLBPrivacyamendment, by 
following the instructions on the web-based form. If you prefer to file 
your comment on paper, write ``Amendment to the Privacy of Consumer 
Financial Information Rule, 16 CFR part 313, Project No. R411016'' on 
your comment and on the envelope, and mail your comment to the 
following address: Federal Trade Commission, Office of the Secretary, 
600 Pennsylvania Avenue NW., Suite CC-5610 (Annex E), Washington, DC 
20580, or deliver your comment to the following address: Federal Trade 
Commission, Office of the Secretary, Constitution Center, 400 7th 
Street SW., 5th Floor, Suite 5610 (Annex E), Washington, DC 20024.

FOR FURTHER INFORMATION CONTACT: Steven Toporoff, (202) 326-3135, 
Attorney, Division of Privacy and Identity Protection, Federal Trade 
Commission, 600 Pennsylvania Avenue NW., Washington, DC 20580.

SUPPLEMENTARY INFORMATION: 

I. Summary of the Proposed Rule

    The Gramm-Leach-Bliley Act (GLBA) \1\ mandates that financial 
institutions provide their customers with initial and annual notices 
regarding their privacy policies. If financial institutions share 
certain customer information with particular types of third parties, 
the institutions are also required to provide an opportunity to opt out 
of the sharing. The Commission issued its rule implementing these 
provisions in 2000.\2\ The Dodd-Frank Wall Street Reform and Consumer 
Protection Act transferred GLBA privacy notice rulemaking authority, in 
part, to the Bureau; however, the Commission retains rulemaking 
authority over any financial institution that is a motor vehicle dealer 
predominantly engaged in the sale and servicing of motor vehicles, the 
leasing and servicing of motor vehicles, or both, as described in 
Section 1029 of the Dodd-Frank Act, 12 U.S.C. 5519 (hereafter, motor 
vehicle dealers).
---------------------------------------------------------------------------

    \1\ 15 U.S.C. 6801 et seq.
    \2\ 65 FR 33646 (May 24, 2000).
---------------------------------------------------------------------------

    The Commission proposes to revise its Privacy Rule, 16 CFR part 
313, in two ways. First, in light of the transfer of rulemaking 
authority for certain financial institutions to the Bureau, the 
Commission proposes to revise the explanation of the scope of the Rule 
and to tailor the examples provided in the Rule's Definitions section 
describing entities over which the Commission has retained rulemaking 
authority. The Commission believes that revising these provisions will 
eliminate extraneous information, clarify the Rule's applicability, and 
reduce confusion as to entities covered by the Rule. The Rule also 
retains several examples explaining the types of entities covered by 
the Safeguards Rule, 16 CFR part 314. Second, the Commission proposes 
to provide an alternative means for covered motor vehicle dealers to 
fulfill their obligation under the Privacy Rule to provide notice of 
their privacy policies. Under the proposal, motor vehicle dealers that 
do not engage in certain types of information-sharing activities would 
no longer be required to mail an annual privacy notice if they clearly 
and conspicuously convey, as

[[Page 36268]]

part of another mandated or legally permissible notice or disclosure, 
that their privacy notice is available on their publicly accessible Web 
site. This proposed revision is consistent with changes made in an 
October 28, 2014, rulemaking by the Bureau, which has rulemaking 
authority over depository institutions and many non-depository 
institutions.\3\
---------------------------------------------------------------------------

    \3\ 79 FR 64057 (Oct. 28, 2014).
---------------------------------------------------------------------------

    The Commission believes that the proposed changes are consistent 
with those issued by the Bureau, and will help avoid consumer confusion 
and ensure that the requirements for motor vehicle dealers covered by 
the Rule are consistent with the GLBA's privacy provisions for other 
financial institutions. Such changes may also streamline the flow of 
information to consumers, while easing the burden on motor vehicle 
dealers of providing annual notices. The Commission invites comment on 
the proposed rule revisions generally and on the specific issues 
outlined throughout Section IV. In addition, the Commission requests 
comment on whether, and the extent to which, the FTC's Privacy Rule 
applicable to motor vehicle dealers should be consistent with the rule 
adopted by the Bureau, or if there are elements that should differ.
    The Commission seeks comment on the proposal through August 17, 
2015.

II. Background

A. The Statute and Regulation

    The GLBA was enacted in 1999.\4\ The GLBA, among other things, 
provides a framework for regulating the privacy practices of a broad 
range of entities. The GLBA requires that financial institutions 
provide their customers with initial and annual notices regarding their 
privacy policies, and allow their customers to opt out of sharing their 
information with certain nonaffiliated third parties. Covered entities 
include, for example, payday lenders, mortgage brokers, check cashers, 
debt collectors, real estate appraisers, certain motor vehicle dealers 
and remittance transfer providers.
---------------------------------------------------------------------------

    \4\ Public Law 106-102, 113 Stat. 1338 (1999).
---------------------------------------------------------------------------

    Rulemaking authority to implement the GLBA's privacy provisions was 
initially spread among many agencies. The Federal Reserve Board 
(Board), the Office of Comptroller of the Currency (OCC), the Federal 
Deposit Insurance Corporation (FDIC), and the Office of Thrift 
Supervision (OTS) jointly adopted final rules to implement the notice 
requirements of the GLBA in 2000.\5\ The Commission, the National 
Credit Union Administration (NCUA), Securities and Exchange Commission 
(SEC), and Commodity Futures Trading Commission (CFTC) were part of the 
same interagency process, but issued their rules separately.\6\ In 
2009, all these agencies issued a joint final rule with a model form 
that financial institutions could use, at their option, to provide the 
required initial and annual privacy disclosures.\7\
---------------------------------------------------------------------------

    \5\ 65 FR 35162 (June 1, 2000).
    \6\ 65 FR 33646 (May 24, 2000) (FTC final rule); 65 FR 31722 
(May 18, 2000) (NCUA final rule); 65 FR 40334 (June 29, 2000) (SEC 
final rule); 66 FR 21252 (Apr. 27, 2001) (CFTC final rule).
    \7\ 74 FR 62890 (Dec. 1, 2009).
---------------------------------------------------------------------------

    In 2011, the Dodd-Frank Act \8\ transferred the GLBA's privacy 
notice rulemaking authority from the Board, NCUA, OCC, OTS, the FDIC, 
and the Commission (in part) to the Bureau. The Bureau then restated 
the implementing regulations in Regulation P, 12 CFR part 1016, in late 
2011 (Regulation P).\9\ However, under the Dodd-Frank Act, the 
Commission retained rulemaking authority for motor vehicle dealers 
described in section 1029 of the Dodd-Frank Act, 12 U.S.C. 5519. Thus, 
in 2012, the Commission issued a notice that it was retaining the 
implementing regulations governing privacy notices for motor vehicles 
dealers, at 16 CFR part 313.\10\
---------------------------------------------------------------------------

    \8\ Public Law 111-203, 124 Stat. 1376 (2010).
    \9\ 76 FR 79025 (Dec. 21, 2011).
    \10\ 77 FR 22200, 22201 (April 13, 2012) (also rescinding those 
regulations for which rulemaking authority was transferred to the 
Bureau under the Dodd-Frank Act).
---------------------------------------------------------------------------

    Despite the transfer of general rulemaking authority for the 
Privacy Rule to the CFPB, the Commission and other agencies retained 
their existing enforcement authority under the GLBA.\11\ In addition, 
the SEC and CFTC retained rulemaking authority with respect to 
securities and futures-related companies, respectively.\12\ 
Accordingly, as part of this rulemaking process, the Commission has 
consulted and coordinated, or offered to consult, with those agencies 
who have rulemaking and/or enforcement authority under the GLBA, 
including the Bureau, SEC, CFTC and the National Association of 
Insurance Commissioners (NAIC).\13\
---------------------------------------------------------------------------

    \11\ 15 U.S.C. 6805(a).
    \12\ 15 U.S.C. 6804, 6809; 12 U.S.C. 1843(k)(4); 12 CFR 
1016.1(b).
    \13\ See 15 U.S.C. 6804(a)(2).
---------------------------------------------------------------------------

B. The Privacy Notice Requirements

    As noted, the GLBA and the FTC Privacy Rule require that certain 
covered motor vehicle dealers provide consumers with notices describing 
their privacy policies. Section 503 of the GLBA and 16 CFR 313.4 
require covered entities to provide an initial notice of these 
policies, and then ``provide a clear and conspicuous notice to 
customers that accurately reflects [their] privacy policies and 
practices not less than annually during the continuation of the 
customer relationship.'' \14\
---------------------------------------------------------------------------

    \14\ 16 CFR 313.5(a)(1) (emphasis added).
---------------------------------------------------------------------------

    Section 502 of the GLBA and 16 CFR 313.6(a)(6) require that initial 
and annual notices inform customers of their right to opt out of the 
sharing of nonpublic personal information with some types of 
nonaffiliated third parties. For example, a customer has the right to 
opt out of allowing a motor vehicle dealer to sell her name and address 
to a nonaffiliated auto insurance company. On the other hand, a motor 
vehicle dealer is not required to allow consumers to opt out of the 
dealer's sharing involving third-party service providers, joint 
marketing arrangements, maintenance and servicing of accounts, 
securitization, law enforcement and compliance, reporting to consumer 
reporting agencies, and certain other activities that are specified in 
the statute and regulation.\15\ If a motor vehicle dealer limits its 
sharing to uses that do not trigger opt-out rights, it may provide an 
annual privacy notice to its customers that does not include 
information regarding opt-out rights.
---------------------------------------------------------------------------

    \15\ 15 U.S.C. 6802(b)(2), 6802(e); 16 CFR 313.13, 313.14, 
313.15.
---------------------------------------------------------------------------

    Motor vehicle dealers also may include in the annual privacy notice 
information about certain consumer opt-out rights related to affiliate 
sharing under the FCRA. First, section 603(d)(2)(A)(iii) of the FCRA 
allows the sharing of a consumer's information among affiliates, but 
only if the consumer is notified of such sharing and is given an 
opportunity to opt out.\16\ Section 503(c)(4) of the GLBA and the 
Privacy Rule generally require motor vehicle dealers to incorporate any 
notifications and opt-out disclosures provided pursuant to section 
603(d)(2)(A)(iii) of the FCRA into their initial and annual privacy 
notices.\17\
---------------------------------------------------------------------------

    \16\ 15 U.S.C. 1681a(d)(2)(A)(iii).
    \17\ 15 U.S.C. 6803(c)(4); 16 CFR 313.6(a)(7).
---------------------------------------------------------------------------

    Second, section 624 of the FCRA and 16 CFR 680 (the Affiliate 
Marketing Rule) provide that an affiliate of a motor vehicle dealer 
that receives certain information \18\ about a consumer from the dealer 
may not use that information for marketing purposes, unless the 
consumer is provided with an opportunity to opt out of that use.\19\

[[Page 36269]]

This requirement governs the use of information by an affiliate, not 
the sharing of information among affiliates, and thus is distinct from 
the affiliate sharing opt-out discussed above. The Affiliate Marketing 
Rule permits (but does not require) motor vehicle dealers to 
incorporate any opt-out disclosures provided under section 624 of the 
FCRA and the Affiliate Marketing Rule into the initial and annual 
privacy notices required by the GLBA.\20\
---------------------------------------------------------------------------

    \18\ The type of information to which section 624 applies is 
information that would be a consumer report but for the exclusions 
provided by section 603(d)(2)(A)(i), (ii), or (iii) of the FCRA.
    \19\ 15 U.S.C. 1681s-3. The FTC's Affiliate Marketing Rule 
applies to motor vehicle dealers. See 77 FR 22200. The FTC also 
enforces the Bureau's Regulation V's Affiliate Marketing Rule, 12 
CFR part 1022, subpart C, for other entities over which it has 
enforcement authority under the FCRA.
    \20\ 16 CFR 680.23(b).
---------------------------------------------------------------------------

    Finally, Sec.  313.6(a)(8) of the Privacy Rule requires that the 
notices also briefly describe how motor vehicle dealers protect the 
nonpublic personal information they collect and maintain.

C. The Bureau Rulemaking

    In December 2011, the Bureau issued a Request for Information 
seeking specific suggestions for streamlining regulations that were 
transferred to the Bureau from other Federal agencies (Streamlining 
RFI), including the annual privacy notice requirement.\21\
---------------------------------------------------------------------------

    \21\ 76 FR 75825, 75828 (Dec. 5, 2011).
---------------------------------------------------------------------------

    The Bureau received numerous comments from industry urging the 
Bureau to eliminate or reduce the annual notice requirement.\22\ 
Industry argued that most customers ignore annual privacy notices; the 
content of the disclosures provides little benefit when customers have 
no right to opt out of information sharing; current distribution of the 
notices imposes significant costs; and other methods of delivery could 
effectively convey the information to customers at a lower cost. 
Industry commenters suggested that the Bureau eliminate or ease the 
annual notice requirement if businesses' privacy policies have not 
changed and they do not share nonpublic personal information beyond the 
exceptions allowed by the GLBA.\23\ Consumer advocacy groups 
highlighted the benefit customers receive from printed annual privacy 
notices, which may remind customers of privacy rights that they may not 
have exercised previously.\24\
---------------------------------------------------------------------------

    \22\ 79 FR 27214 at 27217 (May 14, 2014) (Bureau Notice of 
Proposed Rulemaking).
    \23\ Id.
    \24\ Id.
---------------------------------------------------------------------------

    In November of 2013, the Bureau published a study assessing the 
effects of certain deposit regulations on financial institutions' 
operations.\25\ This study provided operational insights from seven 
banks about their annual privacy notices. All seven participants 
provided the annual notice as a separate mailing, which resulted in 
higher costs for postage, materials, and labor than if the notice were 
mailed with other material. Some of these participants separately 
mailed their notices to ensure that their disclosures are ``clear and 
conspicuous,'' \26\ even though 2009 guidance from the eight agencies 
promulgating the model privacy form explained that a separate mailing 
is not required.\27\ As a result of its Streamlining RFI, study, and 
its outreach to industry and consumer groups, in May 2014, the Bureau 
issued a proposed rule to amend its Regulation P to allow financial 
institutions to notify consumers that a privacy notice was available 
online, in certain enumerated circumstances. The comment period closed 
on July 14, 2014. As noted above, the Bureau finalized its rulemaking 
in October 2014.\28\
---------------------------------------------------------------------------

    \25\ Consumer Financial Protection Bureau, ``Understanding the 
Effects of Certain Deposit Regulations on Financial Institutions' 
Operations: Findings on Relative Costs for Systems, Personnel, and 
Processes at Seven Institutions'' (Nov. 2013), available at http://files.consumerfinance.gov/f/201311_cfpb_report_findings-relative-costs.pdf. Information collected for the study may be used to assist 
the Bureau in its investigations of ``the effects of a potential or 
existing regulation on the business decisions of providers.'' OMB 
Information Request--Control Number: 3170-0032.
    \26\ 15 U.S.C. 6803 (In its initial and annual privacy notices 
``a financial institution shall provide a clear and conspicuous 
disclosure . . . .''); 12 CFR 1016.3(b)(1) and 16 CFR 313.3(b)(1) 
(both defining ``clear and conspicuous'' as ``reasonably 
understandable and designed to call attention to the nature and 
significance of the information in the notice.'').
    \27\ See 74 FR 62890, 62897-62898.
    \28\ 79 FR 64057 (Oct. 28, 2014).
---------------------------------------------------------------------------

III. The Commission's Proposed Rule Changes

A. Technical Changes To Correspond to Statutory Changes

    The Commission adopted the scope and definitions in the existing 
Privacy Rule at a time when it had rulemaking authority for the Privacy 
Rule over a broader group of non-bank ``financial institutions'' as 
defined by the GLBA. While the Dodd-Frank Act did not change the 
Commission's enforcement authority for the privacy notice obligations 
of the GLBA, the Dodd-Frank Act amended the Commission's rulemaking 
authority under the GLBA such that its Privacy Rule only applies to 
motor vehicle dealers. For other types of financial institutions over 
which the Commission has enforcement authority under the GLBA, the 
Commission now enforces the Bureau's Regulation P. The amendments in 
the Dodd-Frank Act necessitate certain technical revisions to the 
Privacy Rule to ensure that the regulation is consistent with the text 
of the amended GLBA.\29\ Specifically, the Commission proposes to 
modify the Scope and Definitions section of the Privacy Rule to provide 
clearer guidance to financial institutions that are covered motor 
vehicle dealers.
---------------------------------------------------------------------------

    \29\ 15 U.S.C. 6804(1)(C).
---------------------------------------------------------------------------

    Although the Dodd-Frank Act altered the Commission's rulemaking 
authority with respect to the Privacy Rule, it did not alter the 
Commission's rulemaking authority for the GLBA's Standards for 
Safeguarding Customer Information, at 16 CFR part 314 (the Safeguards 
Rule). For the Safeguards Rule, the Commission continues to have 
rulemaking authority over a broad range of non-bank financial 
institutions. The Safeguards Rule, however, incorporates by reference 
the definitions contained in the Privacy Rule, including all of the 
examples of financial institutions listed in the existing Privacy 
Rule.\30\ Accordingly, the Commission proposes to change the Privacy 
Rule definitions to make clear that, for the purpose of the Privacy 
Rule, the only examples applicable in the definitions are those related 
to motor vehicle dealers; for the purpose of the Safeguards Rule, 
however, all existing examples in the Privacy Rule continue to apply.
---------------------------------------------------------------------------

    \30\ 16 CFR 314.2(a).
---------------------------------------------------------------------------

B. Changes to the Annual Privacy Notice

    The Commission also proposes changes to the Privacy Rule provisions 
governing how motor vehicle dealers should deliver annual privacy 
notices. These changes are consistent with changes adopted by the 
Bureau for those financial institutions subject to the Bureau's 
rulemaking authority. Under certain limited circumstances, these 
changes to the Privacy Rule would allow motor vehicle dealers to convey 
clearly and conspicuously--through another mandated or legally 
permissible notice or disclosure--that their privacy notice is 
available on their Web site (hereafter, the alternative delivery 
method).\31\ If, however, a motor vehicle dealer has made changes to 
its privacy practices or shares its customers' nonpublic personal 
information with nonaffiliated third parties, the dealer

[[Page 36270]]

generally could not avail itself of this alternative delivery 
method.\32\
---------------------------------------------------------------------------

    \31\ Because this disclosure must be provided annually, the 
proposal satisfies the statutory requirement that motor vehicle 
dealers provide annual notices about their privacy practices. Beyond 
the requirement to provide the notice annually, the GBLA allows 
agencies to prescribe the method of delivery. See 15 U.S.C. 6803(a) 
(The GLBA allows annual notice to be delivered ``in writing or in 
electronic form or other form permitted by the regulations . . .'').
    \32\ A motor vehicle dealer may use the alternative delivery 
method if such sharing does not trigger GLBA opt-out rights as set 
forth in Parts 313.13, 313.14, and 313.15.
---------------------------------------------------------------------------

    The Commission anticipates that use of the alternative delivery 
method that meets the requirements discussed below could inform 
customers of their motor vehicle dealer's privacy policies effectively 
and at a lower cost than the current widespread method of mailing 
annual privacy notices. The cost savings could benefit both consumers 
and businesses.\33\
---------------------------------------------------------------------------

    \33\ See 79 FR at 27218; 79 FR at 64061.
---------------------------------------------------------------------------

    The Commission has also considered the potential impact of its 
proposed rule change on consumer privacy. The proposal would not affect 
the actual collection or use of consumers' nonpublic personal 
information by motor vehicle dealers, and consumers would continue to 
get the information and opt-out rights they are entitled to under the 
statute. Moreover, the proposal would enable consumers to review a 
motor vehicle dealer's policy at her own convenience any time during 
the year. For example, a motor vehicle dealer choosing to use the 
alternative method would have to post the privacy notice continuously 
on its Web site, thus enabling consumers to access the privacy notice 
throughout the year rather than having to wait for an annual mailing.

IV. Section-by-Section Analysis

Section 313.1(b)--Scope
    Section 313.1(b) outlines the scope of the Privacy Rule. The 
existing Rule describes the types of entities to which the Privacy Rule 
was applicable prior to the enactment of the Dodd-Frank Act. Those 
entities included--but were not limited to--financial institutions such 
as ``payday'' lenders, mortgage brokers, check cashers, and tax 
preparation firms, but did not include entities that were subject to 
the rulemaking authority of another agency.\34\ With the exception of 
motor vehicle dealers, the entities formerly subject to 16 CFR part 313 
are now subject to the Bureau's Regulation P.\35\
---------------------------------------------------------------------------

    \34\ See 15 U.S.C. 6804 (2010).
    \35\ The Commission retains enforcement authority over such 
entities for violations of the Bureau's Regulation P. 15 U.S.C. 
6805(a)(7).
---------------------------------------------------------------------------

    The Commission seeks to revise the Privacy Rule to make clear that 
it applies only to motor vehicle dealers. Accordingly, the Commission 
proposes to revise Sec.  313.1(b) to remove examples of entities to 
which the FTC's Privacy Rule no longer applies. The Commission also 
proposes to remove the reference in the Privacy Rule's scope to ``other 
persons.'' Although the Commission continues to have enforcement 
authority over ``other persons'' covered by the CFPB's rule, the 
Commission no longer has rulemaking authority for the Privacy Rule over 
``other persons.'' In addition, the Commission proposes to eliminate 
from Sec.  313.1(b) the note indicating that: (1) The Privacy Rule does 
not modify, limit, or supersede the standards under the Health 
Insurance Portability and Accountability Act of 1996 (HIPAA), and (2) 
if a financial institution that is an institution of higher education 
is in compliance with the Federal Educational Rights and Privacy Act 
(FERPA) and its implementing regulations, such institution shall be 
deemed in compliance with 16 CFR part 313. The Commission believes it 
unlikely that this note is applicable to motor vehicle dealers but 
requests comment as to whether motor vehicle dealers ever engage in 
practices that require them to comply with HIPAA or FERPA. In addition, 
the Commission invites general comment on the proposed changes to the 
description of the scope of the Privacy Rule.
Section 313.3--Definitions
    The Definitions section of the Privacy Rule includes a number of 
examples designed to provide guidance regarding the scope of terms used 
in the Privacy Rule. The Commission proposes to revise these 
definitions so that they provide accurate guidance regarding the Rule's 
scope. Specifically, the Commission proposes to revise Sec.  313.3 to 
make clear that certain examples in five definitions are not applicable 
to motor vehicle dealers for purposes of the Privacy Rule but continue 
to apply for purposes of the Safeguards Rule. Similarly, the Commission 
proposes to revise the definition of ``you,'' which currently includes 
entities to which the Privacy Rule no longer applies.
    First, for purposes of the Privacy Rule, proposed Sec.  313.3(e)(2) 
no longer includes, as examples of ``consumers,'' those consumers 
seeking financial advisory services \36\ or consumers with which the 
financial institution has a relationship related to a trust.\37\ The 
examples are retained for purposes of the Safeguards Rule, 16 CFR part 
314.
---------------------------------------------------------------------------

    \36\ 16 CFR 313.3(e)(2)(iii).
    \37\ 16 CFR 313.3(e)(2)(vi) and (vii).
---------------------------------------------------------------------------

    Second, for purposes of the Privacy Rule, proposed Sec.  
313.3(i)(2) no longer includes, as examples of a ``continuing 
relationship'' with a customer, a relationship in which the financial 
institution holds an investment product for the consumer; \38\ enters 
into an agreement to arrange or broker a home mortgage loan; \39\ 
provides financial, investment, or economic advisory services to a 
consumer; \40\ provides tax preparation or credit counseling services; 
\41\ provides career counseling for seeking employment with a financial 
institution or a financial, accounting or audit department of a 
company; \42\ purchases an account, on which the consumer has an 
obligation, from another financial institution; \43\ or provides real 
estate settlement services.\44\ The examples are retained for purposes 
of the Safeguards Rule.
---------------------------------------------------------------------------

    \38\ 16 CFR 313.3(i)(2)(i)(D). The Privacy Rule requires motor 
vehicle dealers to provide an annual notice while there is a 
continuing relationship between the dealer and the customer.
    \39\ 16 CFR 313.3(i)(2)(i)(E). This subsection has been revised 
to remove the portion of the example relating to home mortgage loans 
but retains the portion relating to credit to purchase a vehicle.
    \40\ 16 CFR 313.3(i)(2)(i)(G).
    \41\ 16 CFR 313.3(i)(2)(i)(H).
    \42\ 16 CFR 313.3(i)(2)(i)(I).
    \43\ 16 CFR 313.3(i)(2)(i)(J).
    \44\ 16 CFR 313.3(i)(2)(i)(K).
---------------------------------------------------------------------------

    Third, for purposes of the Privacy Rule, proposed Sec.  313.3(i)(2) 
no longer includes, as examples of ``no continuing relationship'' with 
a customer, a relationship in which the financial institution sells 
airline tickets \45\ or sells checks for a personal checking 
account.\46\ The examples are retained for purposes of the Safeguards 
Rule.
---------------------------------------------------------------------------

    \45\ 16 CFR 313.3(i)(2)(ii)(C).
    \46\ 16 CFR 313.3(i)(2)(ii)(E).
---------------------------------------------------------------------------

    Fourth, for purposes of the Privacy Rule, proposed Sec.  
313.3(k)(2) no longer includes, as examples of ``financial 
institutions,'' retailers that extend credit by issuing their own 
credit cards to consumers; career counselors specializing in finance, 
accounting or audit employment; businesses that print and sell checks; 
businesses that regularly wire money to and from consumers; check 
cashing businesses; accountants or other tax preparation services that 
are in the business of completing tax returns; businesses that operate 
travel services in connection with financial services; businesses 
providing real estate settlement services; mortgage brokers, or 
investment advisory companies and credit counseling services.\47\ The 
examples are retained for purposes of the Safeguards Rule.
---------------------------------------------------------------------------

    \47\ 16 CFR 313.3(k)(2)(E)(i), (iv)-(xii).
---------------------------------------------------------------------------

    Fifth, for purposes of the Privacy Rule, proposed Sec.  313.3(k)(5) 
no longer includes as examples of ``entities that are not significantly 
engaged in financial activities,'' retailers that only extend credit 
via occasional ``lay away'' and deferred payment plans; merchants

[[Page 36271]]

that allow individuals to ``run a tab''; or grocery stores that allow 
individuals to cash checks or write checks for a higher amount than a 
purchase and obtain cash back.\48\ The examples are retained for 
purposes of the Safeguards Rule. The Commission invites comment 
regarding whether any of the examples that the Commission proposes to 
eliminate for purposes of the Privacy Rule are applicable to motor 
vehicle dealers. The Commission also seeks comment regarding the 
examples that remain for purposes of the Privacy Rule in the 
definitions of proposed Sec.  313.3 and the applicability of such 
examples to motor vehicle dealers.
---------------------------------------------------------------------------

    \48\ 16 CFR 313.3(k)(4)(iii) and (iv).
---------------------------------------------------------------------------

    The existing Privacy Rule generally defines ``you'' as a financial 
institution over which the Commission has enforcement jurisdiction 
under the GLBA. Because this definition refers to the Commission's 
enforcement authority rather than its rulemaking authority, the 
definition is overbroad in light of the amendments to the GLBA 
discussed above. Therefore, the Commission proposes to revise the 
definition of ``you'' so that for purposes of the Privacy Rule it 
applies to only those entities over which the Commission has rulemaking 
authority. For purposes of the Safeguards Rule, the definition of 
``you'' remains unchanged.
    The Commission requests comment on the proposed changes to the 
definition of ``you.'' The Commission notes that the purpose of the 
changes to the Privacy Rule scope and definitions serve solely to 
conform the Privacy Rule to the revisions in the Dodd-Frank Act as to 
the scope of the Commission's rulemaking authority. These changes do 
not reflect any change in the Commission's authority to enforce the 
Privacy Rule or Regulation P.
Section 313.9--Delivering Privacy and Opt-Out Notices
    Section 313.9(a) of the Rule requires that motor vehicle dealers 
provide initial and annual privacy notices so that each consumer ``can 
reasonably be expected'' to receive actual notice in writing or, if the 
consumer agrees, electronically. Section 313.9(b) provides examples of 
delivery methods that would result in reasonable expectation of actual 
notice, including hand delivery and delivery by mail. The examples also 
include posting on a Web site for customers who: (1) Conduct 
transactions electronically, and (2) acknowledge receipt of the notice 
as a necessary step to obtaining a particular financial product or 
service.\49\ Section 313.9(c) further allows delivery of the annual 
notice through a Web site, but only if a customer uses the dealer's Web 
site to access financial products and services and consents to receive 
notices at the Web site.\50\ Below, the Commission describes proposed 
changes to Sec.  313.9(c) that would allow motor vehicle dealers to 
utilize an alternative delivery method for the annual notices. In some 
circumstances, motor vehicle dealers could substitute their annual 
privacy notices with a clear and conspicuous disclosure--as part of an 
account statement, coupon book, or other legally-required or permitted 
notice or disclosure--stating that their privacy notice is available on 
their Web site and will be mailed to the customer on request. As 
required by the GLBA, this substitute disclosure would have to be 
provided at least annually.
---------------------------------------------------------------------------

    \49\ 16 CFR 313.9(b).
    \50\ 16 CFR 313.9(c).
---------------------------------------------------------------------------

    The Commission seeks information concerning the effect on customer 
privacy rights if motor vehicle dealers were to use the alternative 
delivery method rather than their current delivery methods. Relatedly, 
the Commission requests comment on how often customers currently read 
annual privacy notices under the Privacy Rule and how frequently the 
notices would be read if they were provided pursuant to the proposed 
alternative delivery method. The Commission further requests comment on 
whether the proposed alternative delivery method would be effective in 
reducing the burden on motor vehicle dealers of mailing hard copy 
privacy notices. In particular, the Commission requests information 
regarding how many annual privacy notices motor vehicle dealers 
provide.
    Lastly, the Commission notes that the current Rule prescribes 
certain circumstances under which motor vehicle dealers can provide 
privacy notices electronically or via online posting. For example, the 
Rule allows covered entities to provide notices electronically if the 
consumer agrees or to provide notice online if the consumer is required 
to acknowledge receipt of the notice. See 16 CFR 313.9. The Commission 
invites comment regarding how often privacy notices are delivered 
electronically or posted online under the existing Rule and whether 
companies that currently provide notices electronically will likely 
experience cost savings under the proposed new rule requirements.
9(c)(2) Alternative Method for Providing Certain Annual Notices
9(c)(2)(i)
    Proposed Sec.  313.9(c)(2)(i) describes the circumstances under 
which a motor vehicle dealer may use the alternative delivery method 
summarized above.\51\
---------------------------------------------------------------------------

    \51\ Existing Sec.  313.9(c) would be redesignated as Sec.  
313.9(c)(1) and its subparagraphs redesignated as Sec.  
313.9(c)(1)(i) and (ii), respectively, to accommodate the new 
addition. The Commission is also proposing to add a heading to new 
paragraph (c)(1) for technical reasons.
---------------------------------------------------------------------------

9(c)(2)(i)(A)
    Proposed Sec.  313.9(c)(2)(i)(A) would set forth the first 
condition for using the alternative delivery method: That the motor 
vehicle dealer must not share the customer's information with 
nonaffiliated third parties in a manner that triggers the opt-out 
requirement under the GLBA. Thus, for example, a motor vehicle dealer 
may use the alternative delivery method if it shares the customer's 
information with nonaffiliated third parties as permitted by Sec. Sec.  
313.13 (for joint marketing), 313.14 (for processing and servicing 
transactions), and 313.15 (with consent, or for security purposes, 
fraud prevention, legal purposes or fiduciary purposes). It may not use 
the alternative delivery method, for example, if it shares the 
customer's nonpublic personal information with a nonaffiliated 
insurance company for marketing purposes. The Commission believes the 
alternative delivery method will generally reduce the burden of 
compliance for motor vehicle dealers, while still mandating the use of 
the current delivery method to ensure that customers have direct notice 
of their opt-out rights, where they exist.
    The Commission invites comment on the number of motor vehicle 
dealers that would not be able to take advantage of the alternative 
delivery method because they share data with nonaffiliated third 
parties. The Commission further invites comment on whether customers 
with opt-out rights pursuant to the Privacy Rule should continue to 
receive the annual privacy notice pursuant to the current delivery 
method or if motor vehicle dealers should be able to utilize the 
proposed alternative delivery method for such customers.
9(c)(2)(i)(B)
    Proposed Sec.  313.9(c)(2)(i)(B) would set forth the second 
condition for using the alternative delivery method for the annual 
privacy notice: That the motor vehicle dealer not include on its annual 
notice an opt-out under section

[[Page 36272]]

603(d)(2)(A)(iii) of the FCRA.\52\ As discussed above, FCRA section 
603(d)(2)(A)(iii) allows sharing of certain consumer information with 
affiliates, but only if the motor vehicle dealer provides the consumer 
with notice and an opportunity to opt out of the information sharing. 
Although this is a requirement of the FCRA, section 503(b)(4) of the 
GLBA and Sec.  313.6(a)(7) of the Privacy Rule require a motor vehicle 
dealer's privacy notice to include any opt-out rights provided under 
section 603(d)(2)(A)(iii) of the FCRA. Accordingly, to the extent that 
a motor vehicle dealer shares customer information with affiliates for 
marketing purposes, thus triggering the obligation to include an opt-
out pursuant to FCRA section 603(d)(2)(A)(iii), the motor vehicle 
dealer cannot take advantage of the alternative delivery method.\53\ As 
noted above, the Commission believes that directly reminding consumers 
of any opt-out rights at least annually will be important for 
consumers. This is true regardless whether the opt-out right is 
provided under the GLBA or the FCRA.
---------------------------------------------------------------------------

    \52\ 15 U.S.C. 1681a(d)(2)(A)(iii).
    \53\ See 64 FR 35162, 35176 (June 1, 2000).
---------------------------------------------------------------------------

    The Commission invites comment on the extent to which different 
motor vehicle dealers provide a FCRA section 603(d)(2)(A)(iii) opt-out 
and thus would be precluded from using the proposed alternative 
delivery method. The Commission further invites comment as to whether 
customers with opt-out rights under this section of the FCRA benefit 
from receiving the annual privacy notice pursuant to the current 
delivery method or could receive the notice via the proposed 
alternative delivery method.
9(c)(2)(i)(C)
    Proposed Sec.  313.9(c)(2)(i)(C) would contain the third condition 
for using the alternative delivery method, related to the requirements 
of section 624 of the FCRA \54\ and the Affiliate Marketing Rule, 16 
CFR part 680. FCRA section 624, as implemented by the Affiliate 
Marketing Rule, provides that a person may not use certain information 
about a consumer that it receives from an affiliate to market to that 
consumer unless the consumer receives notice and the opportunity to opt 
out of such marketing.\55\
---------------------------------------------------------------------------

    \54\ 15 U.S.C. 1681s-3.
    \55\ 16 CFR 680.21(a).
---------------------------------------------------------------------------

    In contrast to the FCRA section 603(d)(2)(A)(iii) notice and opt-
out right concerning affiliate sharing, which is generally required to 
be included on the GLBA annual privacy notice, the FCRA section 624 
(and Affiliate Marketing Rule) notice and opt-out right concerning 
marketing by affiliates is not required to be included on that notice. 
However, the Affiliate Marketing Rule notice and opt-out right may be 
included on the privacy notice.\56\
---------------------------------------------------------------------------

    \56\ 16 CFR 680.23(b).
---------------------------------------------------------------------------

    The Commission proposes--under Sec.  313.9(c)(2)(i)(C)--that a 
motor vehicle dealer that is required to provide a notice and opt out 
under the Affiliate Marketing Rule may use the alternative delivery 
method, provided that the motor vehicle dealer has previously satisfied 
the Affiliate Marketing Rule requirements or does not use the annual 
privacy notice as the sole means of providing notice to customers of 
that opt-out right.\57\ Alternatively, the motor vehicle dealer could 
continue to use the current delivery method and include the Affiliate 
Marketing opt-out on the annual privacy notice, with no separate notice 
required.
---------------------------------------------------------------------------

    \57\ Certain requirements for the Affiliate Marketing notice and 
opt out differ, depending on whether it is included as part of the 
model privacy notice or issued separately. Where a motor vehicle 
dealer includes the Affiliate Marketing notice and opt-out on the 
model privacy notice, that opt-out must be of indefinite duration. 
See Appendix A to Part 313 at C.2(d)(6). In contrast, where a motor 
vehicle dealer provides the Affiliate Marketing notice and opt-out 
separately, the Affiliate Marketing Rule allows the opt-out to be 
offered for as little as five years, subject to renewal, and the 
disclosure of the duration of the opt-out must be included on the 
notice. See 16 CFR 680.22(b). 16 CFR 680.23(a)(1)(iv). Because 
inclusion of the Affiliate Marketing opt-out on the model privacy 
notice requires a motor vehicle dealer to honor the opt-out 
indefinitely, a motor vehicle dealer that also offers the opt-out 
right separately in order to use the alternative delivery method 
would be able to comply with both the Privacy Rule and the Affiliate 
Marketing Rule by stating in the separate Affiliate Marketing notice 
that the opt-out is of indefinite duration and by honoring such opt-
out requests indefinitely.
---------------------------------------------------------------------------

    The Commission invites comment on the extent to which motor vehicle 
dealers include the Affiliate Marketing Rule opt-out on their Privacy 
Rule privacy notices and thus would be precluded from using the 
proposed alternative delivery method. The Commission further invites 
comment on whether imposing this condition on using the alternative 
delivery method is beneficial to consumers.
9(c)(2)(i)(D)
    Proposed Sec.  313.9(c)(2)(i)(D) would present the fourth condition 
for using the alternative delivery method: That the substantive 
information a motor vehicle dealer is required to convey on its annual 
privacy notice has not changed since the immediately previous privacy 
notice (whether initial, annual, or revised) to the customer.\58\ The 
Commission believes that the current delivery method is likely less 
useful if the customer has already received a privacy notice, and the 
motor vehicle dealer's sharing practices remain generally unchanged 
since that previous notice. Proposed Sec.  313.9(c)(2)(i)(D) lists the 
specific disclosures of the privacy notice that must not change in 
order for a motor vehicle dealer to take advantage of the alternative 
delivery method. They are:
---------------------------------------------------------------------------

    \58\ Note that information disclosed pursuant to Sec.  
313.6(a)(6) and (a)(7) is not included in proposed Sec.  
313.9(c)(2)(i)(D) because if those situations apply, a motor vehicle 
dealer could not use the alternative delivery method under proposed 
Sec.  313.9(c)(2)(i)(A) and (B), as discussed above.
---------------------------------------------------------------------------

     The categories of nonpublic personal information that the 
motor vehicle dealer collects (Sec.  313.6(a)(1) and (a)(4));
     the categories of nonpublic personal information that the 
motor vehicle dealer discloses (Sec.  313.6(a)(2));
     the categories of affiliates and nonaffiliated third 
parties to whom the motor vehicle dealer discloses nonpublic personal 
information, other than to parties that administer or enforce 
transactions, service or process financial products, or maintain or 
service accounts, under Sec.  313.14 and to parties for security, fraud 
prevention, legal purposes, or similar purposes under Sec.  313.15 
(Sec.  313.6(a)(3));
     if the motor vehicle dealer discloses nonpublic personal 
information to a nonaffiliated third party for joint marketing as set 
forth under Sec.  313.13, a separate statement of the categories of 
information disclosed and the categories of third parties to whom the 
disclosures were made (Sec.  313.6(a)(5));
     the motor vehicle dealer's policies and practices with 
respect to protecting the confidentiality and security of nonpublic 
personal information (Sec.  313.6(a)(8)); and
     the description of the purpose for sharing with service 
providers and other entities that conduct fraud prevention, security, 
or similar services (Sec.  313.6(a)(9)).
    The Commission emphasizes that a motor vehicle dealer would be 
precluded from using the alternative delivery method only if it made 
substantive changes to the information disclosed on the previous 
written notice sent to the consumer. Stylistic changes in the wording 
of the notice that do not denote a change in practices would not 
prevent a motor vehicle dealer from using the alternative delivery 
method. Nor would the proposed section prohibit a motor vehicle dealer 
from using the alternative delivery method if the dealer eliminated 
categories of information it disclosed or categories of

[[Page 36273]]

third parties to whom it disclosed information. Any other substantive 
change to its information sharing practices would preclude use of the 
alternative delivery method; however, the motor vehicle dealer could 
use the alternative delivery method to meet its next annual privacy 
notice requirement if it first sent a revised privacy notice pursuant 
to the standard delivery requirements.
    The Commission invites comment about the effect on customers of 
conditioning availability of the alternative delivery method on there 
being no change from the previous year's notice. The Commission further 
invites comment on how often motor vehicle dealers change their privacy 
notice such that they would be precluded from using the proposed 
alternative delivery method. Lastly, the Commission invites comment on 
the extent to which a motor vehicle dealer's changing its data security 
policy should preclude it, like financial institutions covered by 
Regulation P, from using the proposed alternative delivery method.
9(c)(2)(i)(E)
    The last condition for use of the alternative delivery method, 
which would be set forth in proposed Sec.  313.9(c)(2)(i)(E), requires 
that the motor vehicle dealer use the model privacy form for its annual 
privacy notice. Currently, the Privacy Rule does not require use of the 
model notice because the statute under which it was promulgated only 
required that regulators give financial institutions the option to use 
such a model notice.\59\
---------------------------------------------------------------------------

    \59\ 15 U.S.C. 6803.
---------------------------------------------------------------------------

    However, the Commission proposes to permit use of the alternative 
delivery method only if a motor vehicle dealer uses the model privacy 
form for its annual privacy notice. This approach would likely 
incentivize use of the model notice, which consumer research has shown 
to be effective in communicating information.\60\ The Commission does 
not believe that the one-time burden of creating a model notice will 
place an undue burden on motor vehicles dealers, who will likely be 
able to save costs by not sending annual privacy notices.
---------------------------------------------------------------------------

    \60\ 74 FR 62890, 62891 (Dec. 1, 2009).
---------------------------------------------------------------------------

    The Commission notes that the model form accommodates information 
that may be required by state or international law, as applicable, in a 
box called ``Other important information.'' \61\ Accordingly, the 
Commission expects that a motor vehicle dealer that has additional 
privacy disclosure obligations pursuant to state or international law 
would still be able to use the model form in order to take advantage of 
the proposed alternative delivery method. The Commission invites 
comment on related state or international law requirements and their 
interaction with the model privacy notice, as well as the proposed 
condition on the alternative delivery method in general.
---------------------------------------------------------------------------

    \61\ Appendix A to Part 313 at C(3)(c).
---------------------------------------------------------------------------

    The Commission contemplates that adoption of the model privacy form 
may require changes to the wording and layout of the privacy notice, 
but not to the information conveyed. Thus, adoption of the model notice 
would not constitute a change to the prior year's notice that would 
preclude use of the alternative delivery method under proposed Sec.  
313.9(c)(2)(i)(D).\62\ The Commission solicits comment on this issue. 
The Commission further invites comment on the extent to which motor 
vehicle dealers currently use the model privacy notice, and if they do 
not, whether they would choose to adopt it in order to take advantage 
of the proposed alternative delivery method. Lastly, the Commission 
invites comment on the benefit to customers of receiving the model 
privacy notice rather than a privacy notice in a non-standard format.
---------------------------------------------------------------------------

    \62\ In a somewhat analogous situation, the agencies that 
promulgated the model privacy notice explained: ``Adoption of the 
model form, with no change in policies or practices, would not 
constitute a revised notice [for purposes of the rule section on 
revised privacy notices], although institutions may elect to 
consider the format change as revision, at their option.'' 74 FR 
62890, 62907 n. 196.
---------------------------------------------------------------------------

    Finally, the Commission generally invites comment on the conditions 
in proposed Sec.  313.9(c)(2)(i)(A) through (E) and whether any of 
those conditions should not be required or whether other conditions 
should be added.
9(c)(2)(ii)
    Proposed Sec.  313.9(c)(2)(ii) sets forth the mechanics of the 
alternative delivery method for annual notices.
9(c)(2)(ii)(A)
    Proposed Sec.  313.9(c)(2)(ii)(A) would set forth the first 
component of the alternative delivery method: that a motor vehicle 
dealer inform the customer of the availability of the annual privacy 
notice on its Web site. Under this proposed subsection, a motor vehicle 
dealer must clearly and conspicuously convey, not less than annually--
on an account statement, coupon book, or notice or disclosure the 
institution is required or expressly permitted to use under any other 
provision of law--three pieces of information: (1) That its privacy 
notice has not changed, (2) that the notice is available on its Web 
site, and (3) that a hard copy of the notice will be mailed to 
customers if they call to request one.
    Proposed Sec.  313.9(c)(2)(ii)(A) states that this notice must be 
``clear and conspicuous,'' which is defined as meaning ``reasonably 
understandable'' and ``designed to call attention to the nature and 
significance of the information.'' \63\ The Commission believes that 
the existing examples in Sec.  313.3(b)(2)(i) and (ii) for the 
``reasonably understandable'' and ``designed to call attention'' 
requirements likely would provide sufficient guidance on ways to make 
the notice clear and conspicuous. For example, the Rule states that, if 
the notice is combined with other information, it must contain 
``distinctive type size, style, and graphic devices, such as shading or 
sidebars.'' \64\
---------------------------------------------------------------------------

    \63\ 16 CFR 313.3(b)(1).
    \64\ 16 CFR 313.3(b)(2)(ii)(E).
---------------------------------------------------------------------------

    Although the Commission proposes to require that motor vehicle 
dealers convey this ``notice of availability'' not less than annually, 
they may elect to convey it more often (e.g., quarterly or monthly). 
The Commission invites comment on whether the approach used for notice 
of availability for motor vehicle dealers should differ from that for 
the financial institutions covered by Regulation P. In particular, the 
Commission is interested in comment on: (1) Whether the proposed 
example notice of availability would make the alternative delivery 
method more feasible for motor vehicle dealers to implement, (2) 
whether the illustrative elements not specifically required by the Rule 
should be so required, and (3) whether the proposed language would be 
effective in informing customers of the availability of the privacy 
notice.
    As noted, proposed Sec.  313.9(c)(2)(ii)(A) would require the 
notice of availability to be conveyed on an account statement, coupon 
book, or notice or disclosure the motor vehicle dealer is required or 
expressly and specifically permitted to issue under any other provision 
of law. An account statement would include periodic statements or 
billing statements. A coupon book refers to a book of payment coupons 
typically included with an installment loan. The Commission believes 
customers are likely to read account statements or coupon books that 
directly concern the status of their account.
    A ``notice or disclosure the institution is required or expressly 
and specifically permitted to issue under any other provision of law'' 
would include

[[Page 36274]]

disclosures that are expressly and specifically permitted by law, even 
if not required. This language builds on the language used in the 
Affiliate Marketing Rule, which provides that ``a notice required by 
this subpart may be coordinated and consolidated with any other notice 
or disclosure required to be issued under any other provision of law. . 
. .'' \65\ The Commission notes that a notice of availability would not 
satisfy the proposed rule requirement if included on advertising 
materials that were neither required nor specifically permitted by law. 
The Commission invites comment on the benefits and costs of requiring 
the notice of availability to be included on an account statement, 
coupon book, or document required or expressly and specifically 
permitted under any other provision of law. The Commission further 
requests comment as to the best documents on which to place the notice 
of availability, particularly in light of what consumers are likely to 
read.
---------------------------------------------------------------------------

    \65\ 16 CFR 680.23(b).
---------------------------------------------------------------------------

    The Commission further notes that where two or more motor vehicle 
dealers provide a joint privacy notice pursuant to Sec.  313.9(f), the 
proposal would require each motor vehicle dealer to separately provide 
the notice of availability. The Commission invites comment on how often 
motor vehicle dealers jointly provide privacy notices and whether the 
proposed alternative delivery method would be feasible for such jointly 
issued notices.
    Proposed Sec.  313.9(c)(2)(ii)(A) also would require the 
institution to state on the notice of availability that its privacy 
policy has not changed, which, as discussed in detail below, is a 
condition that a dealer must satisfy in order to be able to use the 
alternative delivery method. This proposed requirement can help 
customers assess whether they are interested in reading the policy. 
This statement would always be accurate if the alternative delivery 
method is used correctly, since a motor vehicle dealer could not use 
the alternative delivery method if its annual privacy notice had 
changed.
    The proposal would further require that the statement include a 
specific web address that takes customers directly to the page where 
the privacy notice is available. The section also would require that 
the web address conveyed on the notice of availability provide the 
customer with direct access to the page that contains the privacy 
notice, so that the customer need not click on any additional links.
    Next, proposed Sec.  313.9(c)(2)(ii)(A) would require that the 
notice of availability include a telephone number that a customer can 
call to request a hard copy of the annual privacy notice. This number 
need not be a dedicated number established for this purpose alone. This 
requirement is intended to assist customers who do not have internet 
access or would prefer to receive a hard copy of the privacy notice. 
The Commission encourages motor vehicle dealers that already maintain a 
toll-free number to use that number in the statement required by Sec.  
313.9(c)(2)(ii)(A), to simplify the process for a customer to call and 
request a mailed copy of the privacy notice.
    As an alternative, the Commission invites comment on whether the 
approach used for notice of availability for motor vehicle dealers 
should differ from that for the financial institutions covered by 
Regulation P. Specifically, the Commission seeks comment on the 
advantages and disadvantages of requiring motor vehicle dealers to 
provide a dedicated telephone number for privacy notice requests so 
that customers can easily request a hard copy of the notice without 
navigating a complicated automated telephone menu. The Commission also 
invites comment on whether it should require a dedicated toll-free 
number for this purpose.
9(c)(2)(ii)(B)
    Proposed Sec.  313.9(c)(2)(ii)(B) would set forth the second 
component of the alternative delivery method: that the motor vehicle 
dealer post its current privacy notice continuously and in a clear and 
conspicuous manner on a page of the institution's Web site on which the 
only content is the privacy notice. The Commission believes that, were 
the notice included on a page with other content, such as other 
disclosures or promotions for products, that content could detract from 
the prominence of the notice and make it less likely that a customer 
would actually read it.\66\ The Commission believes that this 
requirement is feasible for most motor vehicle dealers, and for a motor 
vehicle dealer that does not currently post its annual notice on its 
Web site, creating a specific page for this purpose is a one-time 
process that could be implemented without significant cost.
---------------------------------------------------------------------------

    \66\ Information that is not content, such as navigational menus 
to other pages on the Web site, could appear on the same page as the 
privacy notice. Moreover, other pages on the dealer's Web site could 
link to the page containing the privacy notice, but the customer 
would still have to be provided a specific web address that takes 
the customer directly to the page where the privacy notice is 
available to satisfy the requirement to post the notice on the motor 
vehicle dealer's Web site in proposed Sec.  313.9(c)(2)(ii)(B). 
Finally, with regard to the proposed requirement that the notice be 
posted in a ``clear and conspicuous'' manner, the Commission notes 
that existing Sec.  313.3(b)(2)(iii) gives examples of what clear 
and conspicuous means for a privacy notice posted on a Web site. One 
example is a Web page that uses text or visual cues to encourage 
scrolling down the page if necessary to view the entire notice, and 
as long as the page does not include text, graphics, hyperlinks, or 
sound that may distract from the notice.
---------------------------------------------------------------------------

    This section would further require that the Web page that contains 
the privacy notice be accessible to the customer without requiring the 
customer to provide any information such as a login name or password or 
agree to any conditions to access the page. This provision is intended 
to make accessing the privacy notice on an institution's Web site as 
simple and straightforward as possible.
    The Commission invites comment regarding the prevalence of motor 
vehicle dealers that currently maintain Web sites, whether they 
currently post the Privacy Rule notice on those Web sites, and if they 
do not, how costly it would be to do so. The Commission additionally 
seeks comment on whether motor vehicle dealers provide different 
privacy notices for different groups of customers, such that posting 
multiple privacy notices on the dealer's Web site may create confusion 
as to which is the relevant privacy notice that is applicable to a 
particular customer. The Commission seeks comment on the relative 
benefit or harm to customers of accessing the privacy notice on a motor 
vehicle dealer's Web site as proposed. Lastly, the Commission invites 
comment as to whether motor vehicle dealers should be required to 
provide specific reminder information to a consumer about that 
consumer's previously established preferences--for example, whether the 
consumer has already opted out--via a login and password-protected 
section of the Web site.
9(c)(2)(ii)(C)
    Proposed Sec.  313.9(c)(2)(ii)(C) would set forth the third 
component of the alternative delivery method: That the motor vehicle 
dealer mail its current privacy notice to those customers who request 
it by telephone within ten calendar days of such request. The 
Commission proposes this requirement to assist customers without 
internet access and customers with internet access who would prefer to 
receive a hard copy of the notice. This requirement makes clear that a 
motor vehicle dealer may not, for example, wait to mail the privacy 
notice with another document, such as a quarterly

[[Page 36275]]

statement. Motor vehicle dealers may not charge the customer for 
delivering the annual notice, given that delivery of the annual notice 
is required by statute and regulation.
    The Commission invites comment on the cost associated with mailing 
privacy notices on request, and whether mailing of the privacy notice 
within ten calendar days of a request is feasible for motor vehicle 
dealers. The Commission further requests comment on whether requiring 
mailing within ten calendar days is sufficient to ensure that customers 
receive privacy notices in a timely manner.
9(c)(2)(iii)
    Proposed Sec.  313.9(c)(2)(iii) would provide an example of a 
notice of availability that satisfies Sec.  313.9(c)(2)(ii)(A). The 
Commission intends this example to provide clear guidance on 
permissible content for the notice of availability to facilitate 
compliance. The content of the example notice of availability in 
proposed Sec.  313.9(c)(2)(iii) draws from language in the existing 
model privacy notice in Part 313, App. A, which was previously subject 
to consumer testing.\67\ The proposed example would include the heading 
``Privacy Notice'' in boldface (or otherwise emphasized) on the notice 
of availability. The proposed example further would state that Federal 
law requires the motor vehicle dealer to tell customers how it 
collects, shares, and protects their personal information; this 
language mirrors the ``Why'' box on the model privacy notices.\68\ The 
remaining portion of the proposed example would inform customers that 
the motor vehicle dealer's privacy notice has not changed, the address 
of the Web site at which customers can access the privacy notice, and 
the telephone number to call to request a free copy of the notice. The 
Commission notes that the proposed example contains certain elements 
that would satisfy proposed Sec.  313.9(c)(2), but other language and 
formatting techniques could also satisfy that section. These elements 
include titling the notice of availability ``Privacy Notice,'' 
including a statement that ``Federal law requires the motor vehicle 
dealer to tell customers how it collects, shares, and protects their 
personal information,'' and stating that getting a copy of the notice 
is ``free'' to the consumer.
---------------------------------------------------------------------------

    \67\ See Appendix A to 16 CFR part 313, at A.
    \68\ Id.
---------------------------------------------------------------------------

    The Commission invites comment on whether the proposed example 
notice of availability for motor vehicle dealers should differ from 
that for financial institutions covered by Regulation P. In particular, 
the Commission is interested in comment on: (1) Whether the proposed 
example notice of availability would make the alternative delivery 
method more feasible for motor vehicle dealers to implement, (2) 
whether the elements not specifically required by the rule should be so 
required, and (3) whether the proposed language would be effective in 
informing customers of the availability of the privacy notice.

V. Regulatory Flexibility Act

    The Regulatory Flexibility Act (RFA), as amended by the Small 
Business Regulatory Enforcement Fairness Act of 1996, requires each 
agency to consider the potential impact of its regulations on small 
entities, including small businesses, small governmental units, and 
small not-for-profit organizations. The RFA generally requires an 
agency to conduct an initial regulatory flexibility analysis (IRFA) and 
a final regulatory flexibility analysis (FRFA) of any rule subject to 
notice-and-comment rulemaking requirements, unless the agency certifies 
that the rule will not have a significant economic impact on a 
substantial number of small entities.\69\
---------------------------------------------------------------------------

    \69\ 5 U.S.C. 603-605.
---------------------------------------------------------------------------

    An IRFA is not required here because the proposal, if adopted, 
would not have a significant economic impact on a substantial number of 
small entities. The Commission does not expect the proposal to impose 
costs on small entities. All methods of compliance under current law 
will remain available to small entities if the proposal is adopted. 
Thus, a small entity that is in compliance with current law need not 
take any different or additional action if the proposal is adopted. In 
addition, as discussed above, the Commission believes that the proposed 
alternative method would allow many motor vehicle dealers to reduce 
their costs.
    Accordingly, the Commission certifies that this proposal, if 
adopted, would not have a significant economic impact on a substantial 
number of small entities.

VI. Paperwork Reduction Act

    Under the Paperwork Reduction Act of 1995 (PRA),\70\ Federal 
agencies are generally required to seek Office of Management and Budget 
(OMB) approval for information collection requirements prior to 
implementation. Under the PRA, the Commission may not conduct or 
sponsor, and, notwithstanding any other provision of law, a person is 
not required to respond to an information collection, unless the 
information collection displays a valid control number assigned by OMB.
---------------------------------------------------------------------------

    \70\ 44 U.S.C. 3501 et seq.
---------------------------------------------------------------------------

    This proposal would amend 16 CFR part 313. The collections of 
information related to the Privacy Rule have been previously reviewed 
and approved by OMB in accordance with the PRA and assigned OMB Control 
Number 3084-0121.\71\
---------------------------------------------------------------------------

    \71\ The FTC has current clearance through October 31, 2017. See 
79 FR 55489 (Sept. 16, 2014).
---------------------------------------------------------------------------

    As explained below, the proposed amendments do not modify or add to 
information collection requirements that were previously approved by 
OMB. Under this proposal, a motor vehicle dealer will be permitted, but 
not required, to use an alternative delivery method for the annual 
privacy notice if:
     It does not share information with nonaffiliated third 
parties other than for purposes covered by the exclusions allowed under 
the Privacy Rule;
     It does not include on its annual privacy notice an opt-
out under section 603(d)(2)(A)(iii) of the FCRA;
     The annual privacy notice is not the only method used to 
satisfy the requirements of section 624 of the FCRA and 16 CFR part 
680, if applicable;
     Certain information it is required to convey on its annual 
privacy notice has not changed since it provided the immediately prior 
privacy notice; and
     It uses the Privacy Rule model privacy form for its annual 
privacy notice.
    Under the proposed alternative delivery method, the motor vehicle 
dealer would have to:
     Convey at least annually on another notice or disclosure 
that its privacy notice is available on its Web site and will be mailed 
upon request to a specified telephone number. Among other things, the 
dealer would have to include a specific web address that takes the 
customer directly to the privacy notice;
     Post its current privacy notice continuously on a page of 
its Web site that contains only the privacy notice, without requiring a 
login or any conditions to access the page; and
     Mail its current privacy notice to customers who request 
it by telephone within ten calendar days of such request.
    Under the existing clearance, the FTC has attributed to itself the 
estimated burden regarding all motor vehicle dealers and then shares 
equally the remaining estimated PRA burden with the Bureau for other 
types of financial institutions for which both agencies have 
enforcement authority regarding the GLBA Privacy Rule.\72\
---------------------------------------------------------------------------

    \72\ 79 FR 55489.

---------------------------------------------------------------------------

[[Page 36276]]

    The Commission does not believe that this proposed rule would 
impose any new or substantively revised collections of information as 
defined by the PRA. Rather, the Commission believes that the proposed 
amendment would have the overall effect of reducing the currently 
cleared estimated burden for the information collections associated 
with the Privacy Rule annual privacy notice.
    By definition, the expected cost savings to motor vehicle dealers 
from the proposed revisions to Sec.  313.9(c) is the expected number of 
annual privacy notices that would be provided through the proposed 
alternative delivery method multiplied by the expected reduction in the 
cost per-notice from using the alternative delivery method. The first 
step in estimating the expected cost savings to motor vehicle dealers 
from proposed Sec.  313.9(c)(2) would be to identify the motor vehicle 
dealers whose current information sharing practices would allow them to 
use the proposed alternative method. The Commission would then need to 
determine their currents costs for providing the annual privacy notices 
and the expected costs of providing these notices under proposed Sec.  
313.9(c)(2).
    In order to reach such an estimate for financial institutions, the 
Commission looked to the Bureau's rulemaking. The Bureau performed a 
number of analyses and outreach activities to approximate the expected 
cost savings for financial institutions. After examining 125 banks 
selected through random sampling, the Bureau found that the overall 
average rate at which banks' information sharing practices would make 
them eligible for using the alternative delivery method if other 
conditions were met is 80%.\73\ The Bureau's results indicated that a 
large majority of smaller banks would likely be able to use the 
proposed alternative delivery method but most of the largest banks 
would not.\74\ For non-depository institutions subject to the 
Commission's enforcement, the Bureau similarly estimated that 80% would 
be able to use the alternate delivery method.\75\ Subject to further 
information through public comment, the Commission preliminarily 
assumes that this 80% is characteristic as well for motor vehicle 
dealers. The Commission requests comment and the submission of 
information relevant to the information sharing practices of motor 
vehicle dealers and the extent to which they may be able to use the 
proposed alternative delivery method.
---------------------------------------------------------------------------

    \73\ 79 FR at 27226.
    \74\ Id. Only 18% of sampled banks with assets over $10 billion 
could clearly use the proposed alternative delivery method, while 
81% of sampled banks with assets of $10 billion or less and 88% of 
sampled banks with assets of $500 million or less could clearly use 
the proposed alternative delivery method. The Bureau also examined 
the privacy policies of 54 credit unions and found 62% of those with 
assets over $500 million could use the alternative delivery method 
and 44% of those with $500 million or less in assets could (though, 
due to inadequate information, the Bureau could not make the 
assessment for 48% of those credit unions with $500 million or less 
in assets). Id.
    \75\ 79 FR at 27229.
---------------------------------------------------------------------------

    The Commission does not have precise data on the number of annual 
privacy notices motor vehicle dealers currently provide to directly 
compute the total number of annual privacy notices that would no longer 
be sent; however, in the Commission's proposal to extend the current 
PRA clearance for the Privacy Rule,\76\ the Commission estimated the 
total costs to motor vehicle dealers to disseminate annual disclosures 
to be about $18.4 million.\77\ Applying the Commission's estimate that 
80% of motor vehicle dealers would be able to utilize the alternative 
delivery method, the estimated reduction in ongoing burden would be 
approximately 638,400 hours annually for roughly 48,000 motor vehicle 
dealers.\78\ The reduction in estimated ongoing costs from the 
reduction in ongoing burden would be approximately $14.7 million 
annually.\79\ The Commission requests comment on this preliminary 
analysis as well as the submission of additional data that could inform 
the Commission's consideration of the cost savings to motor vehicle 
dealers.
---------------------------------------------------------------------------

    \76\ 79 FR 55489 (Sept. 14, 2014).
    \77\ Id. at 55490-91 Table IIB.
    \78\ The 638,400 hours estimate is 80% of the previously 
published estimate of 798,000 hours, cumulatively, for established 
motor vehicle dealers to disseminate annual notices. See id. at 
55490 (Table IIB). The estimated number of motor vehicle dealers 
that would use the alternative delivery method is 80% of the 
previously published estimate of the number of motor vehicle 
dealers, 60,000. See id. at Table IIA notes.
    \79\ This is the product of the above-noted costs to motor 
vehicle dealers to disseminate annual disclosures, $18.4 million, 
multiplied by the assumed 80% reduction for the alternative delivery 
method. Estimates of ongoing savings are gross figures and do not 
take into account any ongoing costs associated with the alternative 
delivery method, which the Commission believes would be minimal. 
They would consist of additional text on a notice or disclosure the 
institution already provides, additional phone calls from consumers 
requesting that the model form be mailed, and the costs of mailing 
the forms prompted by these calls. The Commission currently believes 
that few consumers will request that the form be mailed in order to 
read it or to exercise any voluntary opt-out right, given the 
availability of the notices online. There would be minimal ongoing 
costs associated with the alternative delivery method from 
maintaining a Web page if a motor vehicle dealer already has a Web 
page dedicated to the annual privacy policy.
---------------------------------------------------------------------------

    The Commission believes that the one-time cost for some motor 
vehicle dealers to adopt the alternative delivery method is minimal. 
Motor vehicle dealers that already use the model form and would adopt 
the alternative delivery method would incur minor one-time legal, 
programming and training costs. These dealers would have to communicate 
on a notice or disclosure they already issue under any other provision 
of law that the privacy notice is available. The expense of adding this 
notification would be minor. Staff may need some additional training in 
storing copies of the model form and sending it to customers on 
request. Motor vehicle dealers that do not use the model form would 
incur a one-time cost to create one. However, since the promulgation of 
the model privacy form in 2009, an Online Form Builder has existed that 
any institution can use to readily create a unique, customized privacy 
notice using the model form template.\80\ The Commission assumes that 
motor vehicle dealers that do not currently have Web sites would not 
choose to comply with these requirements in order to use the 
alternative delivery method.
---------------------------------------------------------------------------

    \80\ This Online Form Builder is available at http://www.federalreserve.gov/newsevents/press/bcreg/20100415a.htm.
---------------------------------------------------------------------------

    The Commission has determined that the proposed rule does not 
contain any new or substantively revised information collection 
requirements as defined by the PRA and that the burden estimate for the 
previously-approved information collections should be reduced as 
explained above. The Commission welcomes comments on these 
determinations or any other aspect of the proposal for purposes of the 
PRA. Comments should be submitted as outlined in the ADDRESSES section 
above. All comments will become a matter of public record.

Invitation To Comment

    You can file a comment online or on paper. For the Commission to 
consider your comment, we must receive it on or before August 31, 2015. 
Write ``Amendment to the Privacy of Consumer Financial Information 
Rule, 16 CFR part 313, Project No. R411016'' on your comment. Your 
comment--including your name and your state--will be placed on the 
public record of this proceeding, including, to the extent practicable, 
on the Commission Web site, at http://www.ftc.gov/os/publiccomments.shtm. As a matter of discretion, the Commission tries to 
remove individuals' home contact information from comments before 
placing them on the Commission Web site.

[[Page 36277]]

    Because your comment will be made public, you are solely 
responsible for making sure that your comment doesn't include any 
sensitive personal information, such as Social Security number, date of 
birth, driver's license number or other state identification number or 
foreign country equivalent, passport number, financial account number, 
or credit or debit card number. You are also solely responsible for 
making sure that your comment doesn't include any sensitive health 
information, including medical records or other individually 
identifiable health information. In addition, do not include any 
``[t]rade secret or any commercial or financial information which . . . 
is privileged or confidential,'' as discussed in section 6(f) of the 
FTC Act, 15 U.S.C. 46(f), and FTC Rule 4.10(a)(2), 16 CFR 4.10(a)(2). 
In particular, do not include competitively sensitive information such 
as costs, sales statistics, inventories, formulas, patterns, devices, 
manufacturing processes, or customer names.
    If you want the Commission to give your comment confidential 
treatment, you must file it in paper form, with a request for 
confidential treatment, and you have to follow the procedure explained 
in FTC Rule 4.9(c), 16 CFR 4.9(c).\81\ Your comment will be kept 
confidential only if the FTC General Counsel, in his or her sole 
discretion, grants your request in accordance with the law and the 
public interest.
---------------------------------------------------------------------------

    \81\ In particular, the written request for confidential 
treatment that accompanies the comment must include the factual and 
legal basis for the request, and must identify the specific portions 
of the comment to be withheld from the public record. See FTC Rule 
4.9(c), 16 CFR 4.9(c).
---------------------------------------------------------------------------

    Postal mail addressed to the Commission is subject to delay due to 
heightened security screening. As a result, we encourage you to submit 
your comments online. To make sure that the Commission considers your 
online comment, you must file it at https://ftcpublic.commentworks.com/ftc/GLBPrivacyamendment, by following the instructions on the web-based 
form. If this Notice appears at http://www.regulations.gov/#!home, you 
also may file a comment through that Web site.
    If you file your comment on paper, write ``Amendment to the Privacy 
of Consumer Financial Information Rule, 16 CFR part 313, Project No. 
R411016'' on your comment and on the envelope, and mail your comment to 
the following address: Federal Trade Commission, Office of the 
Secretary, 600 Pennsylvania Avenue NW., Suite CC-5610 (Annex E), 
Washington, DC 20580, or deliver your comment to the following address: 
Federal Trade Commission, Office of the Secretary, Constitution Center, 
400 7th Street SW., 5th Floor, Suite 5610 (Annex E), Washington, DC 
20024. If possible, submit your paper comment to the Commission by 
courier or overnight service.
    Visit the Commission Web site at http://www.ftc.gov to read this 
Notice and the news release describing it. The FTC Act and other laws 
that the Commission administers permit the collection of public 
comments to consider and use in this proceeding as appropriate. The 
Commission will consider all timely and responsive public comments that 
it receives on or before August 31, 2015. For information on the 
Commission's privacy policy, including routine uses permitted by the 
Privacy Act, see http://www.ftc.gov/ftc/privacy.htm.

List of Subjects in 16 CFR Part 313

    Consumer protection, Motor vehicle dealers, Privacy, Reporting and 
recordkeeping requirements, Trade practices.

Authority and Issuance

    For the reasons set forth in the preamble, the Commission proposes 
to amend 16 CFR part 313, as set forth below:

PART 313--PRIVACY OF CONSUMER FINANCIAL INFORMATION

0
1. The authority citation for Part 313 is revised to read as follows:

    Authority:  15 U.S.C. 6801 et seq., 12 U.S.C. 5519.

0
2. In Sec.  313.1, revise paragraph (b) to read as follows:


Sec.  313.1  Purpose and scope.

* * * * *
    (b) Scope. This part applies only to nonpublic personal information 
about individuals who obtain financial products or services primarily 
for personal, family or household purposes from the institutions listed 
below. This part does not apply to information about companies or about 
individuals who obtain financial products or services for business, 
commercial, or agricultural purposes. This part applies to those 
``financial institutions'' over which the Federal Trade Commission 
(``Commission'') has rulemaking authority pursuant to section 
504(a)(1)(C) of the Gramm-Leach-Bliley Act. An entity is a ``financial 
institution'' if its business is engaging in a financial activity as 
described in section 4(k) of the Bank Holding Company Act of 1956, 12 
U.S.C. 1843(k), which incorporates by reference activities enumerated 
by the Federal Reserve Board in 12 CFR 211.5(d) and 12 CFR 225.28. The 
``financial institutions'' subject to the Commission's rulemaking 
authority are any persons described in 12 U.S.C. 5519 that are 
predominantly engaged in the sale and servicing of motor vehicles, the 
leasing and servicing of motor vehicles, or both. They are referred to 
in this part as ``You.''
0
3. In Sec.  313.3, revise paragraphs (e), (i), (k), and (q) to read as 
follows:


Sec.  313.3  Definitions.

* * * * *
    (e)(1) Consumer means an individual who obtains or has obtained a 
financial product or service from you that is to be used primarily for 
personal, family, or household purposes, or that individual's legal 
representative.
    (2) Examples for purposes of 16 CFR part 313 and 314--(i) An 
individual who applies to you for credit for personal, family, or 
household purposes is a consumer of a financial service, regardless of 
whether the credit is extended.
    (ii) An individual who provides nonpublic personal information to 
you in order to obtain a determination about whether he or she may 
qualify for a loan to be used primarily for personal, family, or 
household purposes is a consumer of a financial service, regardless of 
whether the loan is extended.
    (iii) If you hold ownership or servicing rights to an individual's 
loan that is used primarily for personal, family, or household 
purposes, the individual is your consumer, even if you hold those 
rights in conjunction with one or more other institutions. (The 
individual is also a consumer with respect to the other financial 
institutions involved.) An individual who has a loan in which you have 
ownership or servicing rights is your consumer, even if you, or another 
institution with those rights, hire an agent to collect on the loan.
    (iv) An individual who is a consumer of another financial 
institution is not your consumer solely because you act as agent for, 
or provide processing or other services to, that financial institution.
    (v) An individual is not your consumer solely because he or she is 
a participant or a beneficiary of an employee benefit plan that you 
sponsor or for which you act as a trustee or fiduciary.
    (3) Examples for purposes of 16 CFR part 314--(i) An individual who 
provides nonpublic personal information to you in connection with

[[Page 36278]]

obtaining or seeking to obtain financial, investment, or economic 
advisory services is a consumer, regardless of whether you establish a 
continuing advisory relationship.
    (ii) An individual is not your consumer solely because he or she 
has designated you as trustee for a trust.
    (iii) An individual is not your consumer solely because he or she 
is a beneficiary of a trust for which you are a trustee.
* * * * *
    (i)(1) Customer relationship means a continuing relationship 
between a consumer and you under which you provide one or more 
financial products or services to the consumer that are to be used 
primarily for personal, family, or household purposes.
    (2) Examples--(i) Continuing relationship. (A) A consumer has a 
continuing relationship with you, for purposes of 16 CFR part 313 and 
part 314, if the consumer:
    (1) Has a credit or investment account with you;
    (2) Obtains a loan from you;
    (3) Purchases an insurance product from you;
    (4) Enters into an agreement or understanding with you whereby you 
undertake to arrange credit to purchase a vehicle, for the consumer;
    (5) Enters into a lease of personal property on a non-operating 
basis with you; or
    (6) Has a loan for which you own the servicing rights.
    (B) A consumer also has a continuing relationship with you, for 
purposes of 16 CFR part 314, if the consumer:
    (1) Holds an investment product through you, such as when you act 
as a custodian for securities or for assets in an Individual Retirement 
Arrangement;
    (2) Enters into an agreement or understanding with you whereby you 
undertake to arrange or broker a home mortgage loan, for the consumer;
    (3) Obtains financial, investment, or economic advisory services 
from you for a fee;
    (4) Becomes your client for the purpose of obtaining tax 
preparation or credit counseling services from you;
    (5) Obtains career counseling while seeking employment with a 
financial institution or the finance, accounting, or audit department 
of any company (or while employed by such a financial institution or 
department of any company);
    (6) Is obligated on an account that you purchase from another 
financial institution, regardless of whether the account is in default 
when purchased, unless you do not locate the consumer or attempt to 
collect any amount from the consumer on the account; or
    (7) Obtains real estate settlement services from you.
    (ii) No continuing relationship. (A) For purposes of 16 CFR parts 
313 and 314, a consumer does not, however, have a continuing 
relationship with you if:
    (1) The consumer obtains a financial product or service from you 
only in isolated transactions, such as cashing a check with you or 
making a wire transfer through you;
    (2) You sell the consumer's loan and do not retain the rights to 
service that loan; or
    (3) The consumer obtains one-time personal or real property 
appraisal services from you.
    (B) For purposes of 16 CFR part 314, a consumer also does not have 
a continuing relationship with you if:
    (1) The consumer obtains a financial product or service from you 
only in isolated transactions, such as using your ATM to withdraw cash 
from an account at another financial institution or purchasing a money 
order from you;
    (2) You sell the consumer airline tickets, travel insurance, or 
traveler's checks in isolated transactions; or
    (3) The consumer purchases checks for a personal checking account 
from you.
* * * * *
    (k)(1) Financial institution means any institution the business of 
which is engaging in financial activities as described in section 4(k) 
of the Bank Holding Company Act of 1956 (12 U.S.C. 1843(k)). An 
institution that is significantly engaged in financial activities is a 
financial institution.
    (2) Example of financial institution for purposes of 16 CFR part 
313 and 314. An automobile dealership that, as a usual part of its 
business, leases automobiles on a nonoperating basis for longer than 90 
days is a financial institution with respect to its leasing business 
because leasing personal property on a nonoperating basis where the 
initial term of the lease is at least 90 days is a financial activity 
listed in 12 CFR 225.28(b)(3) and referenced in section 4(k)(4)(F) of 
the Bank Holding Company Act.
    (3) Examples of financial institution for purposes of 16 CFR part 
314. (i) A retailer that extends credit by issuing its own credit card 
directly to consumers is a financial institution because extending 
credit is a financial activity listed in 12 CFR 225.28(b)(1) and 
referenced in section 4(k)(4)(F) of the Bank Holding Company Act and 
issuing that extension of credit through a proprietary credit card 
demonstrates that a retailer is significantly engaged in extending 
credit.
    (ii) A personal property or real estate appraiser is a financial 
institution because real and personal property appraisal is a financial 
activity listed in 12 CFR 225.28(b)(2)(i) and referenced in section 
4(k)(4)(F) of the Bank Holding Company Act.
    (iii) A career counselor that specializes in providing career 
counseling services to individuals currently employed by or recently 
displaced from a financial organization, individuals who are seeking 
employment with a financial organization, or individuals who are 
currently employed by or seeking placement with the finance, accounting 
or audit departments of any company is a financial institution because 
such career counseling activities are financial activities listed in 12 
CFR 225.28(b)(9)(iii) and referenced in section 4(k)(4)(F) of the Bank 
Holding Company Act.
    (iv) A business that prints and sells checks for consumers, either 
as its sole business or as one of its product lines, is a financial 
institution because printing and selling checks is a financial activity 
that is listed in 12 CFR 225.28(b)(10)(ii) and referenced in section 
4(k)(4)(F) of the Bank Holding Company Act.
    (v) A business that regularly wires money to and from consumers is 
a financial institution because transferring money is a financial 
activity referenced in section 4(k)(4)(A) of the Bank Holding Company 
Act and regularly providing that service demonstrates that the business 
is significantly engaged in that activity.
    (vi) A check cashing business is a financial institution because 
cashing a check is exchanging money, which is a financial activity 
listed in section 4(k)(4)(A) of the Bank Holding Company Act.
    (vii) An accountant or other tax preparation service that is in the 
business of completing income tax returns is a financial institution 
because tax preparation services is a financial activity listed in 12 
CFR 225.28(b)(6)(vi) and referenced in section 4(k)(4)(G) of the Bank 
Holding Company Act.
    (viii) A business that operates a travel agency in connection with 
financial services is a financial institution because operating a 
travel agency in connection with financial services is a financial 
activity listed in 12 CFR 211.5(d)(15) and referenced in section 
4(k)(4)(G) of the Bank Holding Company Act.

[[Page 36279]]

    (ix) An entity that provides real estate settlement services is a 
financial institution because providing real estate settlement services 
is a financial activity listed in 12 CFR 225.28(b)(2)(viii) and 
referenced in section 4(k)(4)(F) of the Bank Holding Company Act.
    (x) A mortgage broker is a financial institution because brokering 
loans is a financial activity listed in 12 CFR 225.28(b)(1) and 
referenced in section 4(k)(4)(F) of the Bank Holding Company Act.
    (xi) An investment advisory company and a credit counseling service 
are each financial institutions because providing financial and 
investment advisory services are financial activities referenced in 
section 4(k)(4)(C) of the Bank Holding Company Act.
    (4) Financial institution does not include:
    (i) Any person or entity with respect to any financial activity 
that is subject to the jurisdiction of the Commodity Futures Trading 
Commission under the Commodity Exchange Act (7 U.S.C. 1 et seq.);
    (ii) The Federal Agricultural Mortgage Corporation or any entity 
chartered and operating under the Farm Credit Act of 1971 (12 U.S.C. 
2001 et seq.); or
    (iii) Institutions chartered by Congress specifically to engage in 
securitizations, secondary market sales (including sales of servicing 
rights) or similar transactions related to a transaction of a consumer, 
as long as such institutions do not sell or transfer nonpublic personal 
information to a nonaffiliated third party other than as permitted by 
Sec. Sec.  313.14 and 313.15 of this Part.
    (iv) Entities that engage in financial activities but that are not 
significantly engaged in those financial activities.
    (5) Example of entities that are not significantly engaged in 
financial activities for purposes of 16 CFR part 313 and 314. A motor 
vehicle dealer is not a financial institution merely because it accepts 
payment in the form of cash, checks, or credit cards that it did not 
issue.
    (6) Examples of entities that are not significantly engaged in 
financial activities for purposes of 16 CFR part 314. (i) A retailer is 
not a financial institution if its only means of extending credit are 
occasional ``lay away'' and deferred payment plans or accepting payment 
by means of credit cards issued by others.
    (ii) A retailer is not a financial institution merely because it 
accepts payment in the form of cash, checks, or credit cards that it 
did not issue.
    (iii) A merchant is not a financial institution merely because it 
allows an individual to ``run a tab.''
    (iv) A grocery store is not a financial institution merely because 
it allows individuals to whom it sells groceries to cash a check, or 
write a check for a higher amount than the grocery purchase and obtain 
cash in return.
* * * * *
    (q) For purposes of 16 CFR part 313, You includes each ``financial 
institution'' over which the Commission has rulemaking authority 
pursuant to section 504(a)(1)(C) of the Gramm-Leach-Bliley Act. For 
purposes of 16 CFR part 314, You includes each ``financial 
institution'' (but excludes any ``other person'') over which the 
Commission has enforcement jurisdiction pursuant to section 505(a)(7) 
of the Gramm-Leach-Bliley Act.
0
4. In Sec.  313.9, revise paragraph (c) to read as follows:


Sec.  313.9  Delivering privacy and opt out notices.

* * * * *
    (c) Annual notices only. (1) Reasonable expectation. You may 
reasonably expect that a customer will receive actual notice of your 
annual privacy notice if:
    (i) The customer uses your Web site to access financial products 
and services electronically and agrees to receive notices at the Web 
site, and you post your current privacy notice continuously in a clear 
and conspicuous manner on the Web site; or
    (ii) The customer has requested that you refrain from sending any 
information regarding the customer relationship, and your current 
privacy notice remains available to the customer upon request.
    (2) Alternative method for providing certain annual notices. (i) 
Notwithstanding paragraph (a) of this section, you may use the 
alternative method described in paragraph (c)(2)(ii) of this section to 
satisfy the requirement in Sec.  313.5(a)(1) to provide a notice if:
    (A) You do not disclose the customer's nonpublic personal 
information with nonaffiliated third parties other than for purposes 
under Sec. Sec.  313.13, 313.14, and 313.15;
    (B) You do not include on your annual privacy notice pursuant to 
Sec.  313.6(a)(7) an opt out under section 603(d)(2)(A)(iii) of the 
Fair Credit Reporting Act (15 U.S.C. 1681a(d)(2)(A)(iii));
    (C) The requirements of section 624 of the Fair Credit Reporting 
Act (15 U.S.C. 1681s-3) and Part 680 of this chapter, if applicable, 
have been satisfied previously or the annual privacy notice is not the 
only notice provided to satisfy such requirements;
    (D) The information you are required to convey on your annual 
privacy notice pursuant to Sec.  313.6(a)(1) through (5), (8), and (9) 
has not changed since you provided the immediately previous privacy 
notice (whether initial, annual or revised) to the customer, other than 
to eliminate categories of information you disclose or categories of 
third parties to whom you disclose information; and
    (E) You use the model privacy form in the appendix to this part for 
your annual privacy notice.
    (ii) For an annual privacy notice that meets the requirements in 
paragraph (c)(2)(i) of this section, you satisfy the requirement in 
Sec.  313.5(a)(1) to provide a notice if you:
    (A) Convey in a clear and conspicuous manner not less than annually 
on an account statement, coupon book, or a notice or disclosure you are 
required or expressly and specifically permitted to issue under any 
other provision of law that your privacy notice is available on your 
Web site and will be mailed to the customer upon request by telephone. 
The statement must state that your privacy notice has not changed and 
must include a specific Web address that takes the customer directly to 
the page where the privacy notice is posted and a designated telephone 
number for the customer to request that it be mailed;
    (B) Post your current privacy notice continuously in a clear and 
conspicuous manner on a page of your Web site that contains only the 
privacy notice, without requiring the customer to provide any 
information such as a login name or password or agree to any conditions 
to access the page; and
    (C) Mail your current privacy notice to those customers who request 
it by telephone within ten days of the request.
    (iii) An example of a statement that satisfies paragraph 
(c)(2)(ii)(A) of this section is: ``Privacy Notice'' in boldface or 
otherwise emphasized: Privacy Notice--Federal law requires us to tell 
you how we collect, share, and protect your personal information. Our 
privacy policy has not changed and you may review our policy and 
practices with respect to your personal information at [Web address] or 
we will mail you a free copy upon request if you call us at [telephone 
number].
* * * * *

    By direction of the Commission.
Donald S. Clark,
Secretary.
[FR Doc. 2015-14328 Filed 6-23-15; 8:45 am]
 BILLING CODE 6750-01-P



                                                                         Federal Register / Vol. 80, No. 121 / Wednesday, June 24, 2015 / Proposed Rules                                           36267

                                                Paragraph 5000      Class D Airspace.                   FEDERAL TRADE COMMISSION                               Street SW., 5th Floor, Suite 5610
                                                *      *     *       *      *                                                                                  (Annex E), Washington, DC 20024.
                                                                                                        16 CFR Part 313                                        FOR FURTHER INFORMATION CONTACT:
                                                AGL OH D Columbus, Ohio State
                                                University Airport, OH [Amended]                        RIN 3084–AB42                                          Steven Toporoff, (202) 326–3135,
                                                                                                                                                               Attorney, Division of Privacy and
                                                Columbus, Ohio State University Airport, OH                                                                    Identity Protection, Federal Trade
                                                  (Lat. 40°04′47″ N., long. 83°04′23″ W.)               Amendment to the Privacy of
                                                                                                        Consumer Financial Information Rule                    Commission, 600 Pennsylvania Avenue
                                                  That airspace extending upward from the                                                                      NW., Washington, DC 20580.
                                                                                                        Under the Gramm-Leach-Bliley Act
                                                surface to and including 3,400 feet MSL
                                                                                                                                                               SUPPLEMENTARY INFORMATION:
                                                within a 4-mile radius of Ohio State                    AGENCY: Federal Trade Commission
                                                University Airport, excluding that airspace             (FTC or Commission).                                   I. Summary of the Proposed Rule
                                                within the Port Columbus International
                                                                                                        ACTION: Notice of proposed rulemaking;                    The Gramm-Leach-Bliley Act
                                                Airport, OH, Class C airspace area. This Class
                                                                                                        Request for public comment.                            (GLBA) 1 mandates that financial
                                                D airspace area is effective during the
                                                specific dates and times established in
                                                                                                                                                               institutions provide their customers
                                                                                                        SUMMARY:   The FTC proposes to amend                   with initial and annual notices
                                                advance by a Notice to Airmen. The effective
                                                                                                        the Privacy of Consumer Financial                      regarding their privacy policies. If
                                                dates and times will thereafter be
                                                continuously published in the Airport/
                                                                                                        Information Rule (Privacy Rule or Rule),               financial institutions share certain
                                                Facility Directory.                                     which among other things requires that                 customer information with particular
                                                                                                        certain motor vehicle dealers provide an               types of third parties, the institutions
                                                Paragraph 6004 Class E Airspace Areas                   annual disclosure of their privacy                     are also required to provide an
                                                Designated as a Surface Area.                           policies to their customers by hand                    opportunity to opt out of the sharing.
                                                *      *     *       *      *                           delivery, mail, electronic delivery, or,               The Commission issued its rule
                                                AGL OH E4 Columbus, Ohio State                          alternatively through a Web site, but                  implementing these provisions in 2000.2
                                                University Airport, OH [Removed]                        only with the consent of the consumer.                 The Dodd-Frank Wall Street Reform and
                                                                                                        The amendment would allow motor                        Consumer Protection Act transferred
                                                Paragraph 6005 Class E Airspace Areas                   vehicle dealers instead to notify their                GLBA privacy notice rulemaking
                                                Extending Upward from 700 Feet or More                  customers that a privacy policy is                     authority, in part, to the Bureau;
                                                Above the Surface of the Earth.
                                                                                                        available on their Web site, under                     however, the Commission retains
                                                *      *     *       *      *                           certain circumstances. The amendment                   rulemaking authority over any financial
                                                AGL OH E5        Columbus, OH [Amended]                 would also revise the scope and                        institution that is a motor vehicle dealer
                                                Columbus, Port Columbus International
                                                                                                        definitions in this rule in light of the               predominantly engaged in the sale and
                                                     Airport, OH                                        transfer of part of the Commission’s                   servicing of motor vehicles, the leasing
                                                  (Lat. 39°59′49″ N., long. 82°53′32″ W.)               rulemaking authority to the Consumer                   and servicing of motor vehicles, or both,
                                                Columbus, Rickenbacker International                    Financial Protection Bureau (CFPB or                   as described in Section 1029 of the
                                                     Airport, OH                                        the Bureau) in the Dodd-Frank Wall                     Dodd-Frank Act, 12 U.S.C. 5519
                                                  (Lat. 39°48′50″ N., long. 82°55′40″ W.)               Street Reform and Consumer Protection                  (hereafter, motor vehicle dealers).
                                                Columbus, Ohio State University Airport, OH             Act, but retains certain examples for                     The Commission proposes to revise
                                                  (Lat. 40°04′47″ N., long. 83°04′23″ W.)               purposes of the FTC’s Safeguards Rule.                 its Privacy Rule, 16 CFR part 313, in two
                                                Columbus, Bolton Field Airport, OH                      DATES: Comments must be received on                    ways. First, in light of the transfer of
                                                  (Lat. 39°54′04″ N., long. 83°08′13″ W.)               or before August 31, 2015.                             rulemaking authority for certain
                                                Columbus, Darby Dan Airport, OH                                                                                financial institutions to the Bureau, the
                                                                                                        ADDRESSES: Interested parties may file a
                                                  (Lat. 39°56′31″ N., long. 83°12′18″ W.)                                                                      Commission proposes to revise the
                                                Lancaster, Fairfield County Airport, OH                 comment online or on paper, by                         explanation of the scope of the Rule and
                                                  (Lat. 39°45′20″ N., long. 82°39′26″ W.)               following the instructions in the                      to tailor the examples provided in the
                                                  That airspace extending upward from 700               Request for Comment part of the                        Rule’s Definitions section describing
                                                feet above the surface within a 7-mile radius           SUPPLEMENTARY INFORMATION section                      entities over which the Commission has
                                                of Port Columbus International Airport, and             below. Write ‘‘Amendment to the                        retained rulemaking authority. The
                                                within 3.3 miles either side of the 094°                Privacy of Consumer Financial                          Commission believes that revising these
                                                bearing from Port Columbus International                Information Rule, 16 CFR part 313,                     provisions will eliminate extraneous
                                                Airport extending from the 7-mile radius to             Project No. R411016’’ on your comment,                 information, clarify the Rule’s
                                                12.1 miles east of the airport, and within a            and file your comment online at https://               applicability, and reduce confusion as
                                                7-mile radius of Rickenbacker International             ftcpublic.commentworks.com/ftc/                        to entities covered by the Rule. The Rule
                                                Airport, and within 4 miles either side of the          GLBPrivacyamendment, by following                      also retains several examples explaining
                                                045° bearing from Rickenbacker International            the instructions on the web-based form.                the types of entities covered by the
                                                Airport extending from the 7-mile radius to             If you prefer to file your comment on
                                                12.5 miles northeast of the airport, and
                                                                                                                                                               Safeguards Rule, 16 CFR part 314.
                                                                                                        paper, write ‘‘Amendment to the                        Second, the Commission proposes to
                                                within a 6.5-mile radius of Ohio State                  Privacy of Consumer Financial
                                                University Airport, and within a 7.4-mile                                                                      provide an alternative means for
                                                                                                        Information Rule, 16 CFR part 313,                     covered motor vehicle dealers to fulfill
                                                radius of Bolton Field Airport, and within a
                                                                                                        Project No. R411016’’ on your comment                  their obligation under the Privacy Rule
                                                6.4-mile radius of Fairfield County Airport,
                                                and within a 6.5-mile radius of Darby Dan
                                                                                                        and on the envelope, and mail your                     to provide notice of their privacy
                                                Airport, excluding that airspace within the             comment to the following address:                      policies. Under the proposal, motor
tkelley on DSK3SPTVN1PROD with PROPOSALS




                                                London, OH, Class E airspace area.                      Federal Trade Commission, Office of the                vehicle dealers that do not engage in
                                                                                                        Secretary, 600 Pennsylvania Avenue                     certain types of information-sharing
                                                  Issued in Fort Worth, TX, on June 8, 2015.            NW., Suite CC–5610 (Annex E),                          activities would no longer be required to
                                                Robert W. Beck,                                         Washington, DC 20580, or deliver your                  mail an annual privacy notice if they
                                                Manager, Operations Support Group, ATO                  comment to the following address:                      clearly and conspicuously convey, as
                                                Central Service Center.                                 Federal Trade Commission, Office of the
                                                [FR Doc. 2015–15461 Filed 6–23–15; 8:45 am]             Secretary, Constitution Center, 400 7th                  1 15   U.S.C. 6801 et seq.
                                                BILLING CODE 4910–13–P                                                                                           2 65   FR 33646 (May 24, 2000).



                                           VerDate Sep<11>2014   16:23 Jun 23, 2015   Jkt 235001   PO 00000   Frm 00017   Fmt 4702   Sfmt 4702   E:\FR\FM\24JNP1.SGM     24JNP1


                                                36268                 Federal Register / Vol. 80, No. 121 / Wednesday, June 24, 2015 / Proposed Rules

                                                part of another mandated or legally                     Credit Union Administration (NCUA),                    these policies, and then ‘‘provide a clear
                                                permissible notice or disclosure, that                  Securities and Exchange Commission                     and conspicuous notice to customers
                                                their privacy notice is available on their              (SEC), and Commodity Futures Trading                   that accurately reflects [their] privacy
                                                publicly accessible Web site. This                      Commission (CFTC) were part of the                     policies and practices not less than
                                                proposed revision is consistent with                    same interagency process, but issued                   annually during the continuation of the
                                                changes made in an October 28, 2014,                    their rules separately.6 In 2009, all these            customer relationship.’’ 14
                                                rulemaking by the Bureau, which has                     agencies issued a joint final rule with a                 Section 502 of the GLBA and 16 CFR
                                                rulemaking authority over depository                    model form that financial institutions                 313.6(a)(6) require that initial and
                                                institutions and many non-depository                    could use, at their option, to provide the             annual notices inform customers of their
                                                institutions.3                                          required initial and annual privacy                    right to opt out of the sharing of
                                                   The Commission believes that the                     disclosures.7                                          nonpublic personal information with
                                                proposed changes are consistent with                       In 2011, the Dodd-Frank Act 8                       some types of nonaffiliated third parties.
                                                those issued by the Bureau, and will                    transferred the GLBA’s privacy notice                  For example, a customer has the right to
                                                help avoid consumer confusion and                       rulemaking authority from the Board,                   opt out of allowing a motor vehicle
                                                ensure that the requirements for motor                  NCUA, OCC, OTS, the FDIC, and the                      dealer to sell her name and address to
                                                vehicle dealers covered by the Rule are                 Commission (in part) to the Bureau. The                a nonaffiliated auto insurance company.
                                                consistent with the GLBA’s privacy                      Bureau then restated the implementing                  On the other hand, a motor vehicle
                                                provisions for other financial                          regulations in Regulation P, 12 CFR part               dealer is not required to allow
                                                institutions. Such changes may also                     1016, in late 2011 (Regulation P).9                    consumers to opt out of the dealer’s
                                                streamline the flow of information to                   However, under the Dodd-Frank Act,                     sharing involving third-party service
                                                consumers, while easing the burden on                   the Commission retained rulemaking                     providers, joint marketing arrangements,
                                                motor vehicle dealers of providing                      authority for motor vehicle dealers                    maintenance and servicing of accounts,
                                                annual notices. The Commission invites                  described in section 1029 of the Dodd-                 securitization, law enforcement and
                                                comment on the proposed rule revisions                  Frank Act, 12 U.S.C. 5519. Thus, in                    compliance, reporting to consumer
                                                generally and on the specific issues                    2012, the Commission issued a notice                   reporting agencies, and certain other
                                                outlined throughout Section IV. In                      that it was retaining the implementing                 activities that are specified in the statute
                                                addition, the Commission requests                       regulations governing privacy notices                  and regulation.15 If a motor vehicle
                                                comment on whether, and the extent to                   for motor vehicles dealers, at 16 CFR                  dealer limits its sharing to uses that do
                                                which, the FTC’s Privacy Rule                           part 313.10                                            not trigger opt-out rights, it may provide
                                                applicable to motor vehicle dealers                        Despite the transfer of general                     an annual privacy notice to its
                                                should be consistent with the rule                      rulemaking authority for the Privacy                   customers that does not include
                                                adopted by the Bureau, or if there are                  Rule to the CFPB, the Commission and                   information regarding opt-out rights.
                                                elements that should differ.                            other agencies retained their existing                    Motor vehicle dealers also may
                                                   The Commission seeks comment on                      enforcement authority under the                        include in the annual privacy notice
                                                the proposal through August 17, 2015.                   GLBA.11 In addition, the SEC and CFTC                  information about certain consumer opt-
                                                II. Background                                          retained rulemaking authority with                     out rights related to affiliate sharing
                                                                                                        respect to securities and futures-related              under the FCRA. First, section
                                                A. The Statute and Regulation                           companies, respectively.12 Accordingly,                603(d)(2)(A)(iii) of the FCRA allows the
                                                   The GLBA was enacted in 1999.4 The                   as part of this rulemaking process, the                sharing of a consumer’s information
                                                GLBA, among other things, provides a                    Commission has consulted and                           among affiliates, but only if the
                                                framework for regulating the privacy                    coordinated, or offered to consult, with               consumer is notified of such sharing
                                                practices of a broad range of entities.                 those agencies who have rulemaking                     and is given an opportunity to opt out.16
                                                The GLBA requires that financial                        and/or enforcement authority under the                 Section 503(c)(4) of the GLBA and the
                                                institutions provide their customers                    GLBA, including the Bureau, SEC, CFTC                  Privacy Rule generally require motor
                                                with initial and annual notices                         and the National Association of                        vehicle dealers to incorporate any
                                                regarding their privacy policies, and                   Insurance Commissioners (NAIC).13                      notifications and opt-out disclosures
                                                allow their customers to opt out of                     B. The Privacy Notice Requirements                     provided pursuant to section
                                                sharing their information with certain                                                                         603(d)(2)(A)(iii) of the FCRA into their
                                                nonaffiliated third parties. Covered                      As noted, the GLBA and the FTC
                                                                                                                                                               initial and annual privacy notices.17
                                                entities include, for example, payday                   Privacy Rule require that certain                         Second, section 624 of the FCRA and
                                                lenders, mortgage brokers, check                        covered motor vehicle dealers provide                  16 CFR 680 (the Affiliate Marketing
                                                cashers, debt collectors, real estate                   consumers with notices describing their                Rule) provide that an affiliate of a motor
                                                appraisers, certain motor vehicle dealers               privacy policies. Section 503 of the                   vehicle dealer that receives certain
                                                and remittance transfer providers.                      GLBA and 16 CFR 313.4 require covered                  information 18 about a consumer from
                                                   Rulemaking authority to implement                    entities to provide an initial notice of
                                                                                                                                                               the dealer may not use that information
                                                the GLBA’s privacy provisions was                                                                              for marketing purposes, unless the
                                                                                                          6 65 FR 33646 (May 24, 2000) (FTC final rule); 65
                                                initially spread among many agencies.                                                                          consumer is provided with an
                                                                                                        FR 31722 (May 18, 2000) (NCUA final rule); 65 FR
                                                The Federal Reserve Board (Board), the                  40334 (June 29, 2000) (SEC final rule); 66 FR 21252    opportunity to opt out of that use.19
                                                Office of Comptroller of the Currency                   (Apr. 27, 2001) (CFTC final rule).
                                                (OCC), the Federal Deposit Insurance                      7 74 FR 62890 (Dec. 1, 2009).                          14 16 CFR 313.5(a)(1) (emphasis added).
                                                Corporation (FDIC), and the Office of                     8 Public Law 111–203, 124 Stat. 1376 (2010).           15 15 U.S.C. 6802(b)(2), 6802(e); 16 CFR 313.13,
tkelley on DSK3SPTVN1PROD with PROPOSALS




                                                Thrift Supervision (OTS) jointly                          9 76 FR 79025 (Dec. 21, 2011).                       313.14, 313.15.
                                                                                                          10 77 FR 22200, 22201 (April 13, 2012) (also           16 15 U.S.C. 1681a(d)(2)(A)(iii).
                                                adopted final rules to implement the
                                                                                                        rescinding those regulations for which rulemaking        17 15 U.S.C. 6803(c)(4); 16 CFR 313.6(a)(7).
                                                notice requirements of the GLBA in                      authority was transferred to the Bureau under the        18 The type of information to which section 624
                                                2000.5 The Commission, the National                     Dodd-Frank Act).                                       applies is information that would be a consumer
                                                                                                          11 15 U.S.C. 6805(a).
                                                                                                                                                               report but for the exclusions provided by section
                                                  3 79 FR 64057 (Oct. 28, 2014).                          12 15 U.S.C. 6804, 6809; 12 U.S.C. 1843(k)(4); 12    603(d)(2)(A)(i), (ii), or (iii) of the FCRA.
                                                  4 Public Law 106–102, 113 Stat. 1338 (1999).          CFR 1016.1(b).                                           19 15 U.S.C. 1681s–3. The FTC’s Affiliate
                                                  5 65 FR 35162 (June 1, 2000).                           13 See 15 U.S.C. 6804(a)(2).                         Marketing Rule applies to motor vehicle dealers.



                                           VerDate Sep<11>2014   16:23 Jun 23, 2015   Jkt 235001   PO 00000   Frm 00018   Fmt 4702   Sfmt 4702   E:\FR\FM\24JNP1.SGM     24JNP1


                                                                      Federal Register / Vol. 80, No. 121 / Wednesday, June 24, 2015 / Proposed Rules                                                       36269

                                                This requirement governs the use of                     study provided operational insights                        regulation is consistent with the text of
                                                information by an affiliate, not the                    from seven banks about their annual                        the amended GLBA.29 Specifically, the
                                                sharing of information among affiliates,                privacy notices. All seven participants                    Commission proposes to modify the
                                                and thus is distinct from the affiliate                 provided the annual notice as a separate                   Scope and Definitions section of the
                                                sharing opt-out discussed above. The                    mailing, which resulted in higher costs                    Privacy Rule to provide clearer guidance
                                                Affiliate Marketing Rule permits (but                   for postage, materials, and labor than if                  to financial institutions that are covered
                                                does not require) motor vehicle dealers                 the notice were mailed with other                          motor vehicle dealers.
                                                to incorporate any opt-out disclosures                  material. Some of these participants
                                                provided under section 624 of the FCRA                                                                               Although the Dodd-Frank Act altered
                                                                                                        separately mailed their notices to ensure
                                                and the Affiliate Marketing Rule into the                                                                          the Commission’s rulemaking authority
                                                                                                        that their disclosures are ‘‘clear and
                                                initial and annual privacy notices                      conspicuous,’’ 26 even though 2009                         with respect to the Privacy Rule, it did
                                                required by the GLBA.20                                 guidance from the eight agencies                           not alter the Commission’s rulemaking
                                                  Finally, § 313.6(a)(8) of the Privacy                 promulgating the model privacy form                        authority for the GLBA’s Standards for
                                                Rule requires that the notices also                     explained that a separate mailing is not                   Safeguarding Customer Information, at
                                                briefly describe how motor vehicle                      required.27 As a result of its                             16 CFR part 314 (the Safeguards Rule).
                                                dealers protect the nonpublic personal                  Streamlining RFI, study, and its                           For the Safeguards Rule, the
                                                information they collect and maintain.                  outreach to industry and consumer                          Commission continues to have
                                                                                                        groups, in May 2014, the Bureau issued                     rulemaking authority over a broad range
                                                C. The Bureau Rulemaking
                                                                                                        a proposed rule to amend its Regulation                    of non-bank financial institutions. The
                                                   In December 2011, the Bureau issued                  P to allow financial institutions to notify                Safeguards Rule, however, incorporates
                                                a Request for Information seeking                       consumers that a privacy notice was                        by reference the definitions contained in
                                                specific suggestions for streamlining                   available online, in certain enumerated                    the Privacy Rule, including all of the
                                                regulations that were transferred to the                circumstances. The comment period                          examples of financial institutions listed
                                                Bureau from other Federal agencies                      closed on July 14, 2014. As noted above,                   in the existing Privacy Rule.30
                                                (Streamlining RFI), including the annual                the Bureau finalized its rulemaking in                     Accordingly, the Commission proposes
                                                privacy notice requirement.21                           October 2014.28                                            to change the Privacy Rule definitions to
                                                   The Bureau received numerous
                                                                                                                                                                   make clear that, for the purpose of the
                                                comments from industry urging the                       III. The Commission’s Proposed Rule
                                                                                                        Changes                                                    Privacy Rule, the only examples
                                                Bureau to eliminate or reduce the
                                                                                                                                                                   applicable in the definitions are those
                                                annual notice requirement.22 Industry                   A. Technical Changes To Correspond to                      related to motor vehicle dealers; for the
                                                argued that most customers ignore                       Statutory Changes
                                                annual privacy notices; the content of                                                                             purpose of the Safeguards Rule,
                                                the disclosures provides little benefit                   The Commission adopted the scope                         however, all existing examples in the
                                                when customers have no right to opt out                 and definitions in the existing Privacy                    Privacy Rule continue to apply.
                                                of information sharing; current                         Rule at a time when it had rulemaking                      B. Changes to the Annual Privacy Notice
                                                distribution of the notices imposes                     authority for the Privacy Rule over a
                                                significant costs; and other methods of                 broader group of non-bank ‘‘financial                         The Commission also proposes
                                                delivery could effectively convey the                   institutions’’ as defined by the GLBA.                     changes to the Privacy Rule provisions
                                                information to customers at a lower                     While the Dodd-Frank Act did not                           governing how motor vehicle dealers
                                                cost. Industry commenters suggested                     change the Commission’s enforcement                        should deliver annual privacy notices.
                                                that the Bureau eliminate or ease the                   authority for the privacy notice                           These changes are consistent with
                                                annual notice requirement if businesses’                obligations of the GLBA, the Dodd-                         changes adopted by the Bureau for those
                                                privacy policies have not changed and                   Frank Act amended the Commission’s                         financial institutions subject to the
                                                they do not share nonpublic personal                    rulemaking authority under the GLBA                        Bureau’s rulemaking authority. Under
                                                information beyond the exceptions                       such that its Privacy Rule only applies                    certain limited circumstances, these
                                                allowed by the GLBA.23 Consumer                         to motor vehicle dealers. For other types                  changes to the Privacy Rule would
                                                advocacy groups highlighted the benefit                 of financial institutions over which the                   allow motor vehicle dealers to convey
                                                customers receive from printed annual                   Commission has enforcement authority                       clearly and conspicuously—through
                                                privacy notices, which may remind                       under the GLBA, the Commission now
                                                                                                                                                                   another mandated or legally permissible
                                                customers of privacy rights that they                   enforces the Bureau’s Regulation P. The
                                                                                                                                                                   notice or disclosure—that their privacy
                                                may not have exercised previously.24                    amendments in the Dodd-Frank Act
                                                                                                                                                                   notice is available on their Web site
                                                   In November of 2013, the Bureau                      necessitate certain technical revisions to
                                                                                                        the Privacy Rule to ensure that the                        (hereafter, the alternative delivery
                                                published a study assessing the effects
                                                                                                                                                                   method).31 If, however, a motor vehicle
                                                of certain deposit regulations on
                                                                                                        and Processes at Seven Institutions’’ (Nov. 2013),         dealer has made changes to its privacy
                                                financial institutions’ operations.25 This
                                                                                                        available at http://files.consumerfinance.gov/f/           practices or shares its customers’
                                                                                                        201311_cfpb_report_findings-relative-costs.pdf.            nonpublic personal information with
                                                See 77 FR 22200. The FTC also enforces the              Information collected for the study may be used to
                                                Bureau’s Regulation V’s Affiliate Marketing Rule, 12    assist the Bureau in its investigations of ‘‘the effects
                                                                                                                                                                   nonaffiliated third parties, the dealer
                                                CFR part 1022, subpart C, for other entities over       of a potential or existing regulation on the business
                                                which it has enforcement authority under the            decisions of providers.’’ OMB Information                    29 15U.S.C. 6804(1)(C).
                                                FCRA.                                                   Request—Control Number: 3170–0032.                           30 16
                                                   20 16 CFR 680.23(b).                                                                                                   CFR 314.2(a).
                                                                                                           26 15 U.S.C. 6803 (In its initial and annual privacy      31 Because this disclosure must be provided
tkelley on DSK3SPTVN1PROD with PROPOSALS




                                                   21 76 FR 75825, 75828 (Dec. 5, 2011).
                                                                                                        notices ‘‘a financial institution shall provide a clear    annually, the proposal satisfies the statutory
                                                   22 79 FR 27214 at 27217 (May 14, 2014) (Bureau
                                                                                                        and conspicuous disclosure . . . .’’); 12 CFR              requirement that motor vehicle dealers provide
                                                Notice of Proposed Rulemaking).                         1016.3(b)(1) and 16 CFR 313.3(b)(1) (both defining         annual notices about their privacy practices.
                                                   23 Id.                                               ‘‘clear and conspicuous’’ as ‘‘reasonably                  Beyond the requirement to provide the notice
                                                   24 Id.                                               understandable and designed to call attention to the       annually, the GBLA allows agencies to prescribe the
                                                   25 Consumer Financial Protection Bureau,             nature and significance of the information in the          method of delivery. See 15 U.S.C. 6803(a) (The
                                                ‘‘Understanding the Effects of Certain Deposit          notice.’’).                                                GLBA allows annual notice to be delivered ‘‘in
                                                                                                           27 See 74 FR 62890, 62897–62898.
                                                Regulations on Financial Institutions’ Operations:                                                                 writing or in electronic form or other form
                                                Findings on Relative Costs for Systems, Personnel,         28 79 FR 64057 (Oct. 28, 2014).                         permitted by the regulations . . .’’).



                                           VerDate Sep<11>2014   16:23 Jun 23, 2015   Jkt 235001   PO 00000   Frm 00019   Fmt 4702   Sfmt 4702   E:\FR\FM\24JNP1.SGM         24JNP1


                                                36270                 Federal Register / Vol. 80, No. 121 / Wednesday, June 24, 2015 / Proposed Rules

                                                generally could not avail itself of this                the Privacy Rule’s scope to ‘‘other                      for the consumer; 38 enters into an
                                                alternative delivery method.32                          persons.’’ Although the Commission                       agreement to arrange or broker a home
                                                   The Commission anticipates that use                  continues to have enforcement authority                  mortgage loan; 39 provides financial,
                                                of the alternative delivery method that                 over ‘‘other persons’’ covered by the                    investment, or economic advisory
                                                meets the requirements discussed below                  CFPB’s rule, the Commission no longer                    services to a consumer; 40 provides tax
                                                could inform customers of their motor                   has rulemaking authority for the Privacy                 preparation or credit counseling
                                                vehicle dealer’s privacy policies                       Rule over ‘‘other persons.’’ In addition,                services; 41 provides career counseling
                                                effectively and at a lower cost than the                the Commission proposes to eliminate                     for seeking employment with a financial
                                                current widespread method of mailing                    from § 313.1(b) the note indicating that:                institution or a financial, accounting or
                                                annual privacy notices. The cost savings                (1) The Privacy Rule does not modify,                    audit department of a company; 42
                                                could benefit both consumers and                        limit, or supersede the standards under                  purchases an account, on which the
                                                businesses.33                                           the Health Insurance Portability and                     consumer has an obligation, from
                                                   The Commission has also considered                   Accountability Act of 1996 (HIPAA),                      another financial institution; 43 or
                                                the potential impact of its proposed rule               and (2) if a financial institution that is               provides real estate settlement
                                                change on consumer privacy. The                         an institution of higher education is in                 services.44 The examples are retained
                                                proposal would not affect the actual                    compliance with the Federal                              for purposes of the Safeguards Rule.
                                                collection or use of consumers’                         Educational Rights and Privacy Act                          Third, for purposes of the Privacy
                                                nonpublic personal information by                       (FERPA) and its implementing                             Rule, proposed § 313.3(i)(2) no longer
                                                motor vehicle dealers, and consumers                    regulations, such institution shall be                   includes, as examples of ‘‘no continuing
                                                would continue to get the information                   deemed in compliance with 16 CFR part                    relationship’’ with a customer, a
                                                and opt-out rights they are entitled to                 313. The Commission believes it                          relationship in which the financial
                                                under the statute. Moreover, the                        unlikely that this note is applicable to                 institution sells airline tickets 45 or sells
                                                proposal would enable consumers to                      motor vehicle dealers but requests                       checks for a personal checking
                                                review a motor vehicle dealer’s policy at               comment as to whether motor vehicle                      account.46 The examples are retained
                                                her own convenience any time during                     dealers ever engage in practices that                    for purposes of the Safeguards Rule.
                                                the year. For example, a motor vehicle                  require them to comply with HIPAA or                        Fourth, for purposes of the Privacy
                                                dealer choosing to use the alternative                  FERPA. In addition, the Commission                       Rule, proposed § 313.3(k)(2) no longer
                                                method would have to post the privacy                   invites general comment on the                           includes, as examples of ‘‘financial
                                                notice continuously on its Web site,                    proposed changes to the description of                   institutions,’’ retailers that extend credit
                                                thus enabling consumers to access the                   the scope of the Privacy Rule.                           by issuing their own credit cards to
                                                privacy notice throughout the year                                                                               consumers; career counselors
                                                rather than having to wait for an annual                Section 313.3—Definitions                                specializing in finance, accounting or
                                                mailing.                                                                                                         audit employment; businesses that print
                                                                                                           The Definitions section of the Privacy
                                                                                                                                                                 and sell checks; businesses that
                                                IV. Section-by-Section Analysis                         Rule includes a number of examples
                                                                                                                                                                 regularly wire money to and from
                                                                                                        designed to provide guidance regarding
                                                Section 313.1(b)—Scope                                                                                           consumers; check cashing businesses;
                                                                                                        the scope of terms used in the Privacy
                                                   Section 313.1(b) outlines the scope of                                                                        accountants or other tax preparation
                                                                                                        Rule. The Commission proposes to
                                                the Privacy Rule. The existing Rule                                                                              services that are in the business of
                                                                                                        revise these definitions so that they
                                                describes the types of entities to which                                                                         completing tax returns; businesses that
                                                                                                        provide accurate guidance regarding the
                                                the Privacy Rule was applicable prior to                                                                         operate travel services in connection
                                                                                                        Rule’s scope. Specifically, the
                                                the enactment of the Dodd-Frank Act.                                                                             with financial services; businesses
                                                                                                        Commission proposes to revise § 313.3
                                                Those entities included—but were not                                                                             providing real estate settlement services;
                                                                                                        to make clear that certain examples in                   mortgage brokers, or investment
                                                limited to—financial institutions such                  five definitions are not applicable to
                                                as ‘‘payday’’ lenders, mortgage brokers,                                                                         advisory companies and credit
                                                                                                        motor vehicle dealers for purposes of                    counseling services.47 The examples are
                                                check cashers, and tax preparation                      the Privacy Rule but continue to apply
                                                firms, but did not include entities that                                                                         retained for purposes of the Safeguards
                                                                                                        for purposes of the Safeguards Rule.                     Rule.
                                                were subject to the rulemaking authority                Similarly, the Commission proposes to
                                                of another agency.34 With the exception                                                                             Fifth, for purposes of the Privacy
                                                                                                        revise the definition of ‘‘you,’’ which                  Rule, proposed § 313.3(k)(5) no longer
                                                of motor vehicle dealers, the entities                  currently includes entities to which the
                                                formerly subject to 16 CFR part 313 are                                                                          includes as examples of ‘‘entities that
                                                                                                        Privacy Rule no longer applies.                          are not significantly engaged in
                                                now subject to the Bureau’s Regulation                     First, for purposes of the Privacy Rule,
                                                P.35                                                                                                             financial activities,’’ retailers that only
                                                                                                        proposed § 313.3(e)(2) no longer                         extend credit via occasional ‘‘lay away’’
                                                   The Commission seeks to revise the
                                                                                                        includes, as examples of ‘‘consumers,’’                  and deferred payment plans; merchants
                                                Privacy Rule to make clear that it
                                                                                                        those consumers seeking financial
                                                applies only to motor vehicle dealers.
                                                                                                        advisory services 36 or consumers with                     38 16 CFR 313.3(i)(2)(i)(D). The Privacy Rule
                                                Accordingly, the Commission proposes
                                                to revise § 313.1(b) to remove examples                 which the financial institution has a                    requires motor vehicle dealers to provide an annual
                                                                                                        relationship related to a trust.37 The                   notice while there is a continuing relationship
                                                of entities to which the FTC’s Privacy                                                                           between the dealer and the customer.
                                                Rule no longer applies. The Commission                  examples are retained for purposes of                      39 16 CFR 313.3(i)(2)(i)(E). This subsection has

                                                also proposes to remove the reference in                the Safeguards Rule, 16 CFR part 314.                    been revised to remove the portion of the example
                                                                                                           Second, for purposes of the Privacy                   relating to home mortgage loans but retains the
                                                                                                                                                                 portion relating to credit to purchase a vehicle.
tkelley on DSK3SPTVN1PROD with PROPOSALS




                                                  32 A motor vehicle dealer may use the alternative     Rule, proposed § 313.3(i)(2) no longer
                                                                                                                                                                   40 16 CFR 313.3(i)(2)(i)(G).
                                                delivery method if such sharing does not trigger        includes, as examples of a ‘‘continuing                    41 16 CFR 313.3(i)(2)(i)(H).
                                                GLBA opt-out rights as set forth in Parts 313.13,       relationship’’ with a customer, a                          42 16 CFR 313.3(i)(2)(i)(I).
                                                313.14, and 313.15.                                     relationship in which the financial
                                                  33 See 79 FR at 27218; 79 FR at 64061.                                                                           43 16 CFR 313.3(i)(2)(i)(J).

                                                  34 See 15 U.S.C. 6804 (2010).
                                                                                                        institution holds an investment product                    44 16 CFR 313.3(i)(2)(i)(K).

                                                  35 The Commission retains enforcement authority                                                                  45 16 CFR 313.3(i)(2)(ii)(C).
                                                                                                          36 16   CFR 313.3(e)(2)(iii).                            46 16 CFR 313.3(i)(2)(ii)(E).
                                                over such entities for violations of the Bureau’s
                                                Regulation P. 15 U.S.C. 6805(a)(7).                       37 16   CFR 313.3(e)(2)(vi) and (vii).                   47 16 CFR 313.3(k)(2)(E)(i), (iv)–(xii).




                                           VerDate Sep<11>2014   16:23 Jun 23, 2015   Jkt 235001   PO 00000   Frm 00020    Fmt 4702    Sfmt 4702   E:\FR\FM\24JNP1.SGM   24JNP1


                                                                          Federal Register / Vol. 80, No. 121 / Wednesday, June 24, 2015 / Proposed Rules                                                        36271

                                                that allow individuals to ‘‘run a tab’’; or                  313.9(c) further allows delivery of the                   9(c)(2) Alternative Method for Providing
                                                grocery stores that allow individuals to                     annual notice through a Web site, but                     Certain Annual Notices
                                                cash checks or write checks for a higher                     only if a customer uses the dealer’s Web                  9(c)(2)(i)
                                                amount than a purchase and obtain cash                       site to access financial products and
                                                back.48 The examples are retained for                        services and consents to receive notices                    Proposed § 313.9(c)(2)(i) describes the
                                                purposes of the Safeguards Rule. The                         at the Web site.50 Below, the                             circumstances under which a motor
                                                Commission invites comment regarding                         Commission describes proposed                             vehicle dealer may use the alternative
                                                whether any of the examples that the                         changes to § 313.9(c) that would allow                    delivery method summarized above.51
                                                Commission proposes to eliminate for                         motor vehicle dealers to utilize an                       9(c)(2)(i)(A)
                                                purposes of the Privacy Rule are                             alternative delivery method for the
                                                applicable to motor vehicle dealers. The                                                                                  Proposed § 313.9(c)(2)(i)(A) would set
                                                                                                             annual notices. In some circumstances,
                                                Commission also seeks comment                                                                                          forth the first condition for using the
                                                regarding the examples that remain for                       motor vehicle dealers could substitute
                                                                                                                                                                       alternative delivery method: That the
                                                purposes of the Privacy Rule in the                          their annual privacy notices with a clear
                                                                                                                                                                       motor vehicle dealer must not share the
                                                definitions of proposed § 313.3 and the                      and conspicuous disclosure—as part of                     customer’s information with
                                                applicability of such examples to motor                      an account statement, coupon book, or                     nonaffiliated third parties in a manner
                                                vehicle dealers.                                             other legally-required or permitted                       that triggers the opt-out requirement
                                                   The existing Privacy Rule generally                       notice or disclosure—stating that their                   under the GLBA. Thus, for example, a
                                                defines ‘‘you’’ as a financial institution                   privacy notice is available on their Web                  motor vehicle dealer may use the
                                                over which the Commission has                                site and will be mailed to the customer                   alternative delivery method if it shares
                                                enforcement jurisdiction under the                           on request. As required by the GLBA,                      the customer’s information with
                                                GLBA. Because this definition refers to                      this substitute disclosure would have to                  nonaffiliated third parties as permitted
                                                the Commission’s enforcement authority                       be provided at least annually.                            by §§ 313.13 (for joint marketing),
                                                rather than its rulemaking authority, the                                                                              313.14 (for processing and servicing
                                                                                                                The Commission seeks information
                                                definition is overbroad in light of the                                                                                transactions), and 313.15 (with consent,
                                                                                                             concerning the effect on customer
                                                amendments to the GLBA discussed                                                                                       or for security purposes, fraud
                                                above. Therefore, the Commission                             privacy rights if motor vehicle dealers
                                                                                                             were to use the alternative delivery                      prevention, legal purposes or fiduciary
                                                proposes to revise the definition of                                                                                   purposes). It may not use the alternative
                                                ‘‘you’’ so that for purposes of the                          method rather than their current
                                                                                                             delivery methods. Relatedly, the                          delivery method, for example, if it
                                                Privacy Rule it applies to only those                                                                                  shares the customer’s nonpublic
                                                entities over which the Commission has                       Commission requests comment on how
                                                                                                                                                                       personal information with a
                                                rulemaking authority. For purposes of                        often customers currently read annual
                                                                                                                                                                       nonaffiliated insurance company for
                                                the Safeguards Rule, the definition of                       privacy notices under the Privacy Rule
                                                                                                                                                                       marketing purposes. The Commission
                                                ‘‘you’’ remains unchanged.                                   and how frequently the notices would                      believes the alternative delivery method
                                                   The Commission requests comment                           be read if they were provided pursuant                    will generally reduce the burden of
                                                on the proposed changes to the                               to the proposed alternative delivery                      compliance for motor vehicle dealers,
                                                definition of ‘‘you.’’ The Commission                        method. The Commission further                            while still mandating the use of the
                                                notes that the purpose of the changes to                     requests comment on whether the                           current delivery method to ensure that
                                                the Privacy Rule scope and definitions                       proposed alternative delivery method                      customers have direct notice of their
                                                serve solely to conform the Privacy Rule                     would be effective in reducing the                        opt-out rights, where they exist.
                                                to the revisions in the Dodd-Frank Act                       burden on motor vehicle dealers of                           The Commission invites comment on
                                                as to the scope of the Commission’s                          mailing hard copy privacy notices. In                     the number of motor vehicle dealers that
                                                rulemaking authority. These changes do                       particular, the Commission requests                       would not be able to take advantage of
                                                not reflect any change in the                                information regarding how many annual                     the alternative delivery method because
                                                Commission’s authority to enforce the                        privacy notices motor vehicle dealers                     they share data with nonaffiliated third
                                                Privacy Rule or Regulation P.
                                                                                                             provide.                                                  parties. The Commission further invites
                                                Section 313.9—Delivering Privacy and                            Lastly, the Commission notes that the                  comment on whether customers with
                                                Opt-Out Notices                                              current Rule prescribes certain                           opt-out rights pursuant to the Privacy
                                                   Section 313.9(a) of the Rule requires                     circumstances under which motor                           Rule should continue to receive the
                                                that motor vehicle dealers provide                           vehicle dealers can provide privacy                       annual privacy notice pursuant to the
                                                initial and annual privacy notices so                        notices electronically or via online                      current delivery method or if motor
                                                that each consumer ‘‘can reasonably be                       posting. For example, the Rule allows                     vehicle dealers should be able to utilize
                                                expected’’ to receive actual notice in                                                                                 the proposed alternative delivery
                                                                                                             covered entities to provide notices
                                                writing or, if the consumer agrees,                                                                                    method for such customers.
                                                                                                             electronically if the consumer agrees or
                                                electronically. Section 313.9(b) provides                    to provide notice online if the consumer                  9(c)(2)(i)(B)
                                                examples of delivery methods that                            is required to acknowledge receipt of
                                                would result in reasonable expectation                                                                                    Proposed § 313.9(c)(2)(i)(B) would set
                                                                                                             the notice. See 16 CFR 313.9. The                         forth the second condition for using the
                                                of actual notice, including hand                             Commission invites comment regarding
                                                delivery and delivery by mail. The                                                                                     alternative delivery method for the
                                                                                                             how often privacy notices are delivered                   annual privacy notice: That the motor
                                                examples also include posting on a Web
                                                                                                             electronically or posted online under                     vehicle dealer not include on its annual
tkelley on DSK3SPTVN1PROD with PROPOSALS




                                                site for customers who: (1) Conduct
                                                                                                             the existing Rule and whether                             notice an opt-out under section
                                                transactions electronically, and (2)
                                                acknowledge receipt of the notice as a                       companies that currently provide
                                                necessary step to obtaining a particular                     notices electronically will likely                           51 Existing § 313.9(c) would be redesignated as

                                                financial product or service.49 Section                      experience cost savings under the                         § 313.9(c)(1) and its subparagraphs redesignated as
                                                                                                             proposed new rule requirements.                           § 313.9(c)(1)(i) and (ii), respectively, to
                                                                                                                                                                       accommodate the new addition. The Commission is
                                                  48 16   CFR 313.3(k)(4)(iii) and (iv).                                                                               also proposing to add a heading to new paragraph
                                                  49 16   CFR 313.9(b).                                        50 16         313.9(c).                                 (c)(1) for technical reasons.
                                                                                                                       CFR




                                           VerDate Sep<11>2014      16:23 Jun 23, 2015     Jkt 235001   PO 00000   Frm 00021      Fmt 4702   Sfmt 4702   E:\FR\FM\24JNP1.SGM   24JNP1


                                                36272                 Federal Register / Vol. 80, No. 121 / Wednesday, June 24, 2015 / Proposed Rules

                                                603(d)(2)(A)(iii) of the FCRA.52 As                     Rule) notice and opt-out right                           Commission believes that the current
                                                discussed above, FCRA section                           concerning marketing by affiliates is not                delivery method is likely less useful if
                                                603(d)(2)(A)(iii) allows sharing of                     required to be included on that notice.                  the customer has already received a
                                                certain consumer information with                       However, the Affiliate Marketing Rule                    privacy notice, and the motor vehicle
                                                affiliates, but only if the motor vehicle               notice and opt-out right may be                          dealer’s sharing practices remain
                                                dealer provides the consumer with                       included on the privacy notice.56                        generally unchanged since that previous
                                                notice and an opportunity to opt out of                   The Commission proposes—under                          notice. Proposed § 313.9(c)(2)(i)(D) lists
                                                the information sharing. Although this                  § 313.9(c)(2)(i)(C)—that a motor vehicle                 the specific disclosures of the privacy
                                                is a requirement of the FCRA, section                   dealer that is required to provide a                     notice that must not change in order for
                                                503(b)(4) of the GLBA and § 313.6(a)(7)                 notice and opt out under the Affiliate                   a motor vehicle dealer to take advantage
                                                of the Privacy Rule require a motor                     Marketing Rule may use the alternative                   of the alternative delivery method. They
                                                vehicle dealer’s privacy notice to                      delivery method, provided that the                       are:
                                                include any opt-out rights provided                     motor vehicle dealer has previously                         • The categories of nonpublic
                                                under section 603(d)(2)(A)(iii) of the                  satisfied the Affiliate Marketing Rule                   personal information that the motor
                                                FCRA. Accordingly, to the extent that a                 requirements or does not use the annual                  vehicle dealer collects (§ 313.6(a)(1) and
                                                motor vehicle dealer shares customer                    privacy notice as the sole means of                      (a)(4));
                                                information with affiliates for marketing               providing notice to customers of that                       • the categories of nonpublic personal
                                                purposes, thus triggering the obligation                opt-out right.57 Alternatively, the motor                information that the motor vehicle
                                                to include an opt-out pursuant to FCRA                  vehicle dealer could continue to use the                 dealer discloses (§ 313.6(a)(2));
                                                section 603(d)(2)(A)(iii), the motor                    current delivery method and include the                     • the categories of affiliates and
                                                vehicle dealer cannot take advantage of                 Affiliate Marketing opt-out on the                       nonaffiliated third parties to whom the
                                                the alternative delivery method.53 As                   annual privacy notice, with no separate                  motor vehicle dealer discloses
                                                noted above, the Commission believes                    notice required.                                         nonpublic personal information, other
                                                that directly reminding consumers of                       The Commission invites comment on                     than to parties that administer or
                                                any opt-out rights at least annually will               the extent to which motor vehicle                        enforce transactions, service or process
                                                be important for consumers. This is true                dealers include the Affiliate Marketing                  financial products, or maintain or
                                                regardless whether the opt-out right is                 Rule opt-out on their Privacy Rule                       service accounts, under § 313.14 and to
                                                provided under the GLBA or the FCRA.                    privacy notices and thus would be                        parties for security, fraud prevention,
                                                   The Commission invites comment on                    precluded from using the proposed                        legal purposes, or similar purposes
                                                the extent to which different motor                     alternative delivery method. The                         under § 313.15 (§ 313.6(a)(3));
                                                vehicle dealers provide a FCRA section                  Commission further invites comment on                       • if the motor vehicle dealer discloses
                                                603(d)(2)(A)(iii) opt-out and thus would                whether imposing this condition on                       nonpublic personal information to a
                                                be precluded from using the proposed                    using the alternative delivery method is                 nonaffiliated third party for joint
                                                alternative delivery method. The                        beneficial to consumers.                                 marketing as set forth under § 313.13, a
                                                Commission further invites comment as                   9(c)(2)(i)(D)                                            separate statement of the categories of
                                                to whether customers with opt-out                                                                                information disclosed and the categories
                                                rights under this section of the FCRA                      Proposed § 313.9(c)(2)(i)(D) would                    of third parties to whom the disclosures
                                                benefit from receiving the annual                       present the fourth condition for using                   were made (§ 313.6(a)(5));
                                                privacy notice pursuant to the current                  the alternative delivery method: That                       • the motor vehicle dealer’s policies
                                                delivery method or could receive the                    the substantive information a motor                      and practices with respect to protecting
                                                notice via the proposed alternative                     vehicle dealer is required to convey on                  the confidentiality and security of
                                                delivery method.                                        its annual privacy notice has not                        nonpublic personal information
                                                                                                        changed since the immediately previous                   (§ 313.6(a)(8)); and
                                                9(c)(2)(i)(C)                                           privacy notice (whether initial, annual,                    • the description of the purpose for
                                                   Proposed § 313.9(c)(2)(i)(C) would                   or revised) to the customer.58 The                       sharing with service providers and other
                                                contain the third condition for using the                                                                        entities that conduct fraud prevention,
                                                                                                          56 16 CFR 680.23(b).
                                                alternative delivery method, related to                                                                          security, or similar services
                                                                                                          57 Certain  requirements for the Affiliate Marketing
                                                the requirements of section 624 of the                                                                           (§ 313.6(a)(9)).
                                                                                                        notice and opt out differ, depending on whether it
                                                FCRA 54 and the Affiliate Marketing                     is included as part of the model privacy notice or          The Commission emphasizes that a
                                                Rule, 16 CFR part 680. FCRA section                     issued separately. Where a motor vehicle dealer          motor vehicle dealer would be
                                                624, as implemented by the Affiliate                    includes the Affiliate Marketing notice and opt-out
                                                                                                                                                                 precluded from using the alternative
                                                Marketing Rule, provides that a person                  on the model privacy notice, that opt-out must be
                                                                                                        of indefinite duration. See Appendix A to Part 313       delivery method only if it made
                                                may not use certain information about a                 at C.2(d)(6). In contrast, where a motor vehicle         substantive changes to the information
                                                consumer that it receives from an                       dealer provides the Affiliate Marketing notice and       disclosed on the previous written notice
                                                affiliate to market to that consumer                    opt-out separately, the Affiliate Marketing Rule
                                                                                                                                                                 sent to the consumer. Stylistic changes
                                                unless the consumer receives notice and                 allows the opt-out to be offered for as little as five
                                                                                                        years, subject to renewal, and the disclosure of the     in the wording of the notice that do not
                                                the opportunity to opt out of such                      duration of the opt-out must be included on the          denote a change in practices would not
                                                marketing.55                                            notice. See 16 CFR 680.22(b). 16 CFR                     prevent a motor vehicle dealer from
                                                   In contrast to the FCRA section                      680.23(a)(1)(iv). Because inclusion of the Affiliate
                                                                                                                                                                 using the alternative delivery method.
                                                603(d)(2)(A)(iii) notice and opt-out right              Marketing opt-out on the model privacy notice
                                                                                                        requires a motor vehicle dealer to honor the opt-out     Nor would the proposed section
                                                concerning affiliate sharing, which is                  indefinitely, a motor vehicle dealer that also offers    prohibit a motor vehicle dealer from
tkelley on DSK3SPTVN1PROD with PROPOSALS




                                                generally required to be included on the                the opt-out right separately in order to use the         using the alternative delivery method if
                                                GLBA annual privacy notice, the FCRA                    alternative delivery method would be able to
                                                                                                                                                                 the dealer eliminated categories of
                                                section 624 (and Affiliate Marketing                    comply with both the Privacy Rule and the Affiliate
                                                                                                        Marketing Rule by stating in the separate Affiliate      information it disclosed or categories of
                                                                                                        Marketing notice that the opt-out is of indefinite
                                                  52 15 U.S.C. 1681a(d)(2)(A)(iii).                     duration and by honoring such opt-out requests           § 313.9(c)(2)(i)(D) because if those situations apply,
                                                  53 See 64 FR 35162, 35176 (June 1, 2000).             indefinitely.                                            a motor vehicle dealer could not use the alternative
                                                  54 15 U.S.C. 1681s–3.                                    58 Note that information disclosed pursuant to        delivery method under proposed § 313.9(c)(2)(i)(A)
                                                  55 16 CFR 680.21(a).                                  § 313.6(a)(6) and (a)(7) is not included in proposed     and (B), as discussed above.



                                           VerDate Sep<11>2014   16:23 Jun 23, 2015   Jkt 235001   PO 00000   Frm 00022   Fmt 4702   Sfmt 4702   E:\FR\FM\24JNP1.SGM     24JNP1


                                                                      Federal Register / Vol. 80, No. 121 / Wednesday, June 24, 2015 / Proposed Rules                                              36273

                                                third parties to whom it disclosed                      obligations pursuant to state or                        information: (1) That its privacy notice
                                                information. Any other substantive                      international law would still be able to                has not changed, (2) that the notice is
                                                change to its information sharing                       use the model form in order to take                     available on its Web site, and (3) that a
                                                practices would preclude use of the                     advantage of the proposed alternative                   hard copy of the notice will be mailed
                                                alternative delivery method; however,                   delivery method. The Commission                         to customers if they call to request one.
                                                the motor vehicle dealer could use the                  invites comment on related state or                        Proposed § 313.9(c)(2)(ii)(A) states
                                                alternative delivery method to meet its                 international law requirements and their                that this notice must be ‘‘clear and
                                                next annual privacy notice requirement                  interaction with the model privacy                      conspicuous,’’ which is defined as
                                                if it first sent a revised privacy notice               notice, as well as the proposed                         meaning ‘‘reasonably understandable’’
                                                pursuant to the standard delivery                       condition on the alternative delivery                   and ‘‘designed to call attention to the
                                                requirements.                                           method in general.                                      nature and significance of the
                                                   The Commission invites comment                          The Commission contemplates that                     information.’’ 63 The Commission
                                                about the effect on customers of                        adoption of the model privacy form may                  believes that the existing examples in
                                                conditioning availability of the                        require changes to the wording and                      § 313.3(b)(2)(i) and (ii) for the
                                                alternative delivery method on there                    layout of the privacy notice, but not to                ‘‘reasonably understandable’’ and
                                                being no change from the previous                       the information conveyed. Thus,                         ‘‘designed to call attention’’
                                                year’s notice. The Commission further                   adoption of the model notice would not                  requirements likely would provide
                                                invites comment on how often motor                      constitute a change to the prior year’s                 sufficient guidance on ways to make the
                                                vehicle dealers change their privacy                    notice that would preclude use of the                   notice clear and conspicuous. For
                                                notice such that they would be                          alternative delivery method under                       example, the Rule states that, if the
                                                precluded from using the proposed                       proposed § 313.9(c)(2)(i)(D).62 The                     notice is combined with other
                                                alternative delivery method. Lastly, the                Commission solicits comment on this                     information, it must contain ‘‘distinctive
                                                Commission invites comment on the                       issue. The Commission further invites                   type size, style, and graphic devices,
                                                extent to which a motor vehicle dealer’s                comment on the extent to which motor                    such as shading or sidebars.’’ 64
                                                changing its data security policy should                vehicle dealers currently use the model                    Although the Commission proposes to
                                                preclude it, like financial institutions                privacy notice, and if they do not,                     require that motor vehicle dealers
                                                covered by Regulation P, from using the                 whether they would choose to adopt it                   convey this ‘‘notice of availability’’ not
                                                proposed alternative delivery method.                   in order to take advantage of the                       less than annually, they may elect to
                                                                                                        proposed alternative delivery method.                   convey it more often (e.g., quarterly or
                                                9(c)(2)(i)(E)                                           Lastly, the Commission invites                          monthly). The Commission invites
                                                   The last condition for use of the                    comment on the benefit to customers of                  comment on whether the approach used
                                                alternative delivery method, which                      receiving the model privacy notice                      for notice of availability for motor
                                                would be set forth in proposed                          rather than a privacy notice in a non-                  vehicle dealers should differ from that
                                                § 313.9(c)(2)(i)(E), requires that the                  standard format.                                        for the financial institutions covered by
                                                motor vehicle dealer use the model                         Finally, the Commission generally                    Regulation P. In particular, the
                                                privacy form for its annual privacy                     invites comment on the conditions in                    Commission is interested in comment
                                                notice. Currently, the Privacy Rule does                proposed § 313.9(c)(2)(i)(A) through (E)                on: (1) Whether the proposed example
                                                not require use of the model notice                     and whether any of those conditions                     notice of availability would make the
                                                because the statute under which it was                  should not be required or whether other                 alternative delivery method more
                                                promulgated only required that                          conditions should be added.                             feasible for motor vehicle dealers to
                                                regulators give financial institutions the              9(c)(2)(ii)                                             implement, (2) whether the illustrative
                                                option to use such a model notice.59                                                                            elements not specifically required by
                                                   However, the Commission proposes to                    Proposed § 313.9(c)(2)(ii) sets forth                 the Rule should be so required, and (3)
                                                permit use of the alternative delivery                  the mechanics of the alternative                        whether the proposed language would
                                                method only if a motor vehicle dealer                   delivery method for annual notices.                     be effective in informing customers of
                                                uses the model privacy form for its                     9(c)(2)(ii)(A)                                          the availability of the privacy notice.
                                                annual privacy notice. This approach                                                                               As noted, proposed § 313.9(c)(2)(ii)(A)
                                                                                                           Proposed § 313.9(c)(2)(ii)(A) would                  would require the notice of availability
                                                would likely incentivize use of the
                                                                                                        set forth the first component of the                    to be conveyed on an account statement,
                                                model notice, which consumer research
                                                                                                        alternative delivery method: that a                     coupon book, or notice or disclosure the
                                                has shown to be effective in
                                                                                                        motor vehicle dealer inform the                         motor vehicle dealer is required or
                                                communicating information.60 The
                                                                                                        customer of the availability of the                     expressly and specifically permitted to
                                                Commission does not believe that the
                                                                                                        annual privacy notice on its Web site.                  issue under any other provision of law.
                                                one-time burden of creating a model
                                                                                                        Under this proposed subsection, a motor                 An account statement would include
                                                notice will place an undue burden on                    vehicle dealer must clearly and
                                                motor vehicles dealers, who will likely                                                                         periodic statements or billing
                                                                                                        conspicuously convey, not less than
                                                be able to save costs by not sending                                                                            statements. A coupon book refers to a
                                                                                                        annually—on an account statement,
                                                annual privacy notices.                                                                                         book of payment coupons typically
                                                                                                        coupon book, or notice or disclosure the
                                                   The Commission notes that the model                                                                          included with an installment loan. The
                                                                                                        institution is required or expressly
                                                form accommodates information that                                                                              Commission believes customers are
                                                                                                        permitted to use under any other
                                                may be required by state or international                                                                       likely to read account statements or
                                                                                                        provision of law—three pieces of
                                                law, as applicable, in a box called                                                                             coupon books that directly concern the
tkelley on DSK3SPTVN1PROD with PROPOSALS




                                                ‘‘Other important information.’’ 61                       62 In a somewhat analogous situation, the
                                                                                                                                                                status of their account.
                                                Accordingly, the Commission expects                     agencies that promulgated the model privacy notice         A ‘‘notice or disclosure the institution
                                                that a motor vehicle dealer that has                    explained: ‘‘Adoption of the model form, with no        is required or expressly and specifically
                                                additional privacy disclosure                           change in policies or practices, would not              permitted to issue under any other
                                                                                                        constitute a revised notice [for purposes of the rule   provision of law’’ would include
                                                                                                        section on revised privacy notices], although
                                                  59 15U.S.C. 6803.                                     institutions may elect to consider the format change
                                                  60 74FR 62890, 62891 (Dec. 1, 2009).                                                                           63 16   CFR 313.3(b)(1).
                                                                                                        as revision, at their option.’’ 74 FR 62890, 62907 n.
                                                  61 Appendix A to Part 313 at C(3)(c).                 196.                                                     64 16   CFR 313.3(b)(2)(ii)(E).



                                           VerDate Sep<11>2014   16:23 Jun 23, 2015   Jkt 235001   PO 00000   Frm 00023   Fmt 4702   Sfmt 4702   E:\FR\FM\24JNP1.SGM     24JNP1


                                                36274                      Federal Register / Vol. 80, No. 121 / Wednesday, June 24, 2015 / Proposed Rules

                                                disclosures that are expressly and                        availability include a telephone number                  Commission believes that this
                                                specifically permitted by law, even if                    that a customer can call to request a                    requirement is feasible for most motor
                                                not required. This language builds on                     hard copy of the annual privacy notice.                  vehicle dealers, and for a motor vehicle
                                                the language used in the Affiliate                        This number need not be a dedicated                      dealer that does not currently post its
                                                Marketing Rule, which provides that ‘‘a                   number established for this purpose                      annual notice on its Web site, creating
                                                notice required by this subpart may be                    alone. This requirement is intended to                   a specific page for this purpose is a one-
                                                coordinated and consolidated with any                     assist customers who do not have                         time process that could be implemented
                                                other notice or disclosure required to be                 internet access or would prefer to                       without significant cost.
                                                issued under any other provision of law.                  receive a hard copy of the privacy                          This section would further require
                                                . . .’’ 65 The Commission notes that a                    notice. The Commission encourages                        that the Web page that contains the
                                                notice of availability would not satisfy                  motor vehicle dealers that already                       privacy notice be accessible to the
                                                the proposed rule requirement if                          maintain a toll-free number to use that                  customer without requiring the
                                                included on advertising materials that                    number in the statement required by                      customer to provide any information
                                                were neither required nor specifically                    § 313.9(c)(2)(ii)(A), to simplify the                    such as a login name or password or
                                                permitted by law. The Commission                          process for a customer to call and                       agree to any conditions to access the
                                                invites comment on the benefits and                       request a mailed copy of the privacy                     page. This provision is intended to
                                                costs of requiring the notice of                          notice.                                                  make accessing the privacy notice on an
                                                availability to be included on an                            As an alternative, the Commission                     institution’s Web site as simple and
                                                account statement, coupon book, or                        invites comment on whether the                           straightforward as possible.
                                                document required or expressly and                        approach used for notice of availability                    The Commission invites comment
                                                specifically permitted under any other                    for motor vehicle dealers should differ                  regarding the prevalence of motor
                                                provision of law. The Commission                          from that for the financial institutions                 vehicle dealers that currently maintain
                                                further requests comment as to the best                   covered by Regulation P. Specifically,                   Web sites, whether they currently post
                                                documents on which to place the notice                    the Commission seeks comment on the                      the Privacy Rule notice on those Web
                                                of availability, particularly in light of                 advantages and disadvantages of                          sites, and if they do not, how costly it
                                                what consumers are likely to read.                        requiring motor vehicle dealers to                       would be to do so. The Commission
                                                   The Commission further notes that                      provide a dedicated telephone number                     additionally seeks comment on whether
                                                where two or more motor vehicle                           for privacy notice requests so that                      motor vehicle dealers provide different
                                                dealers provide a joint privacy notice                    customers can easily request a hard                      privacy notices for different groups of
                                                pursuant to § 313.9(f), the proposal                      copy of the notice without navigating a                  customers, such that posting multiple
                                                would require each motor vehicle dealer                   complicated automated telephone                          privacy notices on the dealer’s Web site
                                                to separately provide the notice of                       menu. The Commission also invites                        may create confusion as to which is the
                                                availability. The Commission invites                      comment on whether it should require                     relevant privacy notice that is
                                                comment on how often motor vehicle                        a dedicated toll-free number for this                    applicable to a particular customer. The
                                                dealers jointly provide privacy notices                   purpose.                                                 Commission seeks comment on the
                                                and whether the proposed alternative                                                                               relative benefit or harm to customers of
                                                delivery method would be feasible for                     9(c)(2)(ii)(B)                                           accessing the privacy notice on a motor
                                                such jointly issued notices.                                 Proposed § 313.9(c)(2)(ii)(B) would set               vehicle dealer’s Web site as proposed.
                                                   Proposed § 313.9(c)(2)(ii)(A) also                     forth the second component of the                        Lastly, the Commission invites
                                                would require the institution to state on                 alternative delivery method: that the                    comment as to whether motor vehicle
                                                the notice of availability that its privacy               motor vehicle dealer post its current                    dealers should be required to provide
                                                policy has not changed, which, as                         privacy notice continuously and in a                     specific reminder information to a
                                                discussed in detail below, is a condition                                                                          consumer about that consumer’s
                                                                                                          clear and conspicuous manner on a page
                                                that a dealer must satisfy in order to be                                                                          previously established preferences—for
                                                                                                          of the institution’s Web site on which
                                                able to use the alternative delivery                                                                               example, whether the consumer has
                                                                                                          the only content is the privacy notice.
                                                method. This proposed requirement can                                                                              already opted out—via a login and
                                                                                                          The Commission believes that, were the
                                                help customers assess whether they are                                                                             password-protected section of the Web
                                                                                                          notice included on a page with other
                                                interested in reading the policy. This                                                                             site.
                                                                                                          content, such as other disclosures or
                                                statement would always be accurate if
                                                                                                          promotions for products, that content                    9(c)(2)(ii)(C)
                                                the alternative delivery method is used
                                                                                                          could detract from the prominence of
                                                correctly, since a motor vehicle dealer                                                                               Proposed § 313.9(c)(2)(ii)(C) would set
                                                                                                          the notice and make it less likely that a
                                                could not use the alternative delivery                                                                             forth the third component of the
                                                                                                          customer would actually read it.66 The
                                                method if its annual privacy notice had                                                                            alternative delivery method: That the
                                                changed.                                                     66 Information that is not content, such as           motor vehicle dealer mail its current
                                                   The proposal would further require                     navigational menus to other pages on the Web site,       privacy notice to those customers who
                                                that the statement include a specific                     could appear on the same page as the privacy             request it by telephone within ten
                                                web address that takes customers                          notice. Moreover, other pages on the dealer’s Web        calendar days of such request. The
                                                directly to the page where the privacy                    site could link to the page containing the privacy
                                                                                                          notice, but the customer would still have to be          Commission proposes this requirement
                                                notice is available. The section also                     provided a specific web address that takes the           to assist customers without internet
                                                would require that the web address                        customer directly to the page where the privacy          access and customers with internet
                                                conveyed on the notice of availability                    notice is available to satisfy the requirement to post   access who would prefer to receive a
                                                                                                          the notice on the motor vehicle dealer’s Web site
tkelley on DSK3SPTVN1PROD with PROPOSALS




                                                provide the customer with direct access                                                                            hard copy of the notice. This
                                                                                                          in proposed § 313.9(c)(2)(ii)(B). Finally, with regard
                                                to the page that contains the privacy                     to the proposed requirement that the notice be           requirement makes clear that a motor
                                                notice, so that the customer need not                     posted in a ‘‘clear and conspicuous’’ manner, the        vehicle dealer may not, for example,
                                                click on any additional links.                            Commission notes that existing § 313.3(b)(2)(iii)        wait to mail the privacy notice with
                                                   Next, proposed § 313.9(c)(2)(ii)(A)                    gives examples of what clear and conspicuous
                                                                                                          means for a privacy notice posted on a Web site.         another document, such as a quarterly
                                                would require that the notice of                          One example is a Web page that uses text or visual
                                                                                                          cues to encourage scrolling down the page if             the page does not include text, graphics, hyperlinks,
                                                  65 16   CFR 680.23(b).                                  necessary to view the entire notice, and as long as      or sound that may distract from the notice.



                                           VerDate Sep<11>2014     16:23 Jun 23, 2015   Jkt 235001   PO 00000   Frm 00024   Fmt 4702   Sfmt 4702   E:\FR\FM\24JNP1.SGM    24JNP1


                                                                        Federal Register / Vol. 80, No. 121 / Wednesday, June 24, 2015 / Proposed Rules                                                    36275

                                                statement. Motor vehicle dealers may                      institutions covered by Regulation P. In                information collection displays a valid
                                                not charge the customer for delivering                    particular, the Commission is interested                control number assigned by OMB.
                                                the annual notice, given that delivery of                 in comment on: (1) Whether the                             This proposal would amend 16 CFR
                                                the annual notice is required by statute                  proposed example notice of availability                 part 313. The collections of information
                                                and regulation.                                           would make the alternative delivery                     related to the Privacy Rule have been
                                                  The Commission invites comment on                       method more feasible for motor vehicle                  previously reviewed and approved by
                                                the cost associated with mailing privacy                  dealers to implement, (2) whether the                   OMB in accordance with the PRA and
                                                notices on request, and whether mailing                   elements not specifically required by                   assigned OMB Control Number 3084–
                                                of the privacy notice within ten                          the rule should be so required, and (3)                 0121.71
                                                calendar days of a request is feasible for                whether the proposed language would                        As explained below, the proposed
                                                motor vehicle dealers. The Commission                     be effective in informing customers of                  amendments do not modify or add to
                                                further requests comment on whether                       the availability of the privacy notice.                 information collection requirements that
                                                requiring mailing within ten calendar                                                                             were previously approved by OMB.
                                                days is sufficient to ensure that                         V. Regulatory Flexibility Act                           Under this proposal, a motor vehicle
                                                customers receive privacy notices in a                       The Regulatory Flexibility Act (RFA),                dealer will be permitted, but not
                                                timely manner.                                            as amended by the Small Business                        required, to use an alternative delivery
                                                9(c)(2)(iii)                                              Regulatory Enforcement Fairness Act of                  method for the annual privacy notice if:
                                                                                                          1996, requires each agency to consider                     • It does not share information with
                                                   Proposed § 313.9(c)(2)(iii) would                      the potential impact of its regulations on              nonaffiliated third parties other than for
                                                provide an example of a notice of                         small entities, including small                         purposes covered by the exclusions
                                                availability that satisfies                               businesses, small governmental units,                   allowed under the Privacy Rule;
                                                § 313.9(c)(2)(ii)(A). The Commission                      and small not-for-profit organizations.                    • It does not include on its annual
                                                intends this example to provide clear                                                                             privacy notice an opt-out under section
                                                                                                          The RFA generally requires an agency to
                                                guidance on permissible content for the                                                                           603(d)(2)(A)(iii) of the FCRA;
                                                                                                          conduct an initial regulatory flexibility
                                                notice of availability to facilitate                                                                                 • The annual privacy notice is not the
                                                                                                          analysis (IRFA) and a final regulatory
                                                compliance. The content of the example                                                                            only method used to satisfy the
                                                                                                          flexibility analysis (FRFA) of any rule
                                                notice of availability in proposed                                                                                requirements of section 624 of the FCRA
                                                                                                          subject to notice-and-comment
                                                § 313.9(c)(2)(iii) draws from language in                                                                         and 16 CFR part 680, if applicable;
                                                                                                          rulemaking requirements, unless the
                                                the existing model privacy notice in Part                                                                            • Certain information it is required to
                                                                                                          agency certifies that the rule will not
                                                313, App. A, which was previously                                                                                 convey on its annual privacy notice has
                                                                                                          have a significant economic impact on
                                                subject to consumer testing.67 The                                                                                not changed since it provided the
                                                                                                          a substantial number of small entities.69
                                                proposed example would include the                                                                                immediately prior privacy notice; and
                                                heading ‘‘Privacy Notice’’ in boldface                       An IRFA is not required here because
                                                                                                          the proposal, if adopted, would not have                   • It uses the Privacy Rule model
                                                (or otherwise emphasized) on the notice                                                                           privacy form for its annual privacy
                                                of availability. The proposed example                     a significant economic impact on a
                                                                                                          substantial number of small entities.                   notice.
                                                further would state that Federal law                                                                                 Under the proposed alternative
                                                requires the motor vehicle dealer to tell                 The Commission does not expect the
                                                                                                          proposal to impose costs on small                       delivery method, the motor vehicle
                                                customers how it collects, shares, and                                                                            dealer would have to:
                                                                                                          entities. All methods of compliance
                                                protects their personal information; this                                                                            • Convey at least annually on another
                                                language mirrors the ‘‘Why’’ box on the                   under current law will remain available
                                                                                                                                                                  notice or disclosure that its privacy
                                                model privacy notices.68 The remaining                    to small entities if the proposal is
                                                                                                                                                                  notice is available on its Web site and
                                                portion of the proposed example would                     adopted. Thus, a small entity that is in
                                                                                                                                                                  will be mailed upon request to a
                                                inform customers that the motor vehicle                   compliance with current law need not
                                                                                                                                                                  specified telephone number. Among
                                                dealer’s privacy notice has not changed,                  take any different or additional action if
                                                                                                                                                                  other things, the dealer would have to
                                                the address of the Web site at which                      the proposal is adopted. In addition, as
                                                                                                                                                                  include a specific web address that
                                                customers can access the privacy notice,                  discussed above, the Commission
                                                                                                                                                                  takes the customer directly to the
                                                and the telephone number to call to                       believes that the proposed alternative
                                                                                                                                                                  privacy notice;
                                                                                                          method would allow many motor
                                                request a free copy of the notice. The                                                                               • Post its current privacy notice
                                                Commission notes that the proposed                        vehicle dealers to reduce their costs.
                                                                                                                                                                  continuously on a page of its Web site
                                                example contains certain elements that                       Accordingly, the Commission certifies                that contains only the privacy notice,
                                                would satisfy proposed § 313.9(c)(2), but                 that this proposal, if adopted, would not               without requiring a login or any
                                                other language and formatting                             have a significant economic impact on                   conditions to access the page; and
                                                techniques could also satisfy that                        a substantial number of small entities.                    • Mail its current privacy notice to
                                                section. These elements include titling                   VI. Paperwork Reduction Act                             customers who request it by telephone
                                                the notice of availability ‘‘Privacy                                                                              within ten calendar days of such
                                                Notice,’’ including a statement that                        Under the Paperwork Reduction Act                     request.
                                                ‘‘Federal law requires the motor vehicle                  of 1995 (PRA),70 Federal agencies are                      Under the existing clearance, the FTC
                                                dealer to tell customers how it collects,                 generally required to seek Office of                    has attributed to itself the estimated
                                                shares, and protects their personal                       Management and Budget (OMB)                             burden regarding all motor vehicle
                                                information,’’ and stating that getting a                 approval for information collection                     dealers and then shares equally the
                                                copy of the notice is ‘‘free’’ to the                     requirements prior to implementation.                   remaining estimated PRA burden with
tkelley on DSK3SPTVN1PROD with PROPOSALS




                                                consumer.                                                 Under the PRA, the Commission may                       the Bureau for other types of financial
                                                   The Commission invites comment on                      not conduct or sponsor, and,                            institutions for which both agencies
                                                whether the proposed example notice of                    notwithstanding any other provision of                  have enforcement authority regarding
                                                availability for motor vehicle dealers                    law, a person is not required to respond                the GLBA Privacy Rule.72
                                                should differ from that for financial                     to an information collection, unless the
                                                                                                                                                                    71 The FTC has current clearance through October
                                                  67 See   Appendix A to 16 CFR part 313, at A.             69 5U.S.C. 603–605.                                   31, 2017. See 79 FR 55489 (Sept. 16, 2014).
                                                  68 Id.                                                    70 44 U.S.C. 3501 et seq.                               72 79 FR 55489.




                                           VerDate Sep<11>2014     16:23 Jun 23, 2015   Jkt 235001   PO 00000   Frm 00025   Fmt 4702    Sfmt 4702   E:\FR\FM\24JNP1.SGM   24JNP1


                                                36276                  Federal Register / Vol. 80, No. 121 / Wednesday, June 24, 2015 / Proposed Rules

                                                   The Commission does not believe that                 to further information through public                   dealers to adopt the alternative delivery
                                                this proposed rule would impose any                     comment, the Commission preliminarily                   method is minimal. Motor vehicle
                                                new or substantively revised collections                assumes that this 80% is characteristic                 dealers that already use the model form
                                                of information as defined by the PRA.                   as well for motor vehicle dealers. The                  and would adopt the alternative
                                                Rather, the Commission believes that                    Commission requests comment and the                     delivery method would incur minor
                                                the proposed amendment would have                       submission of information relevant to                   one-time legal, programming and
                                                the overall effect of reducing the                      the information sharing practices of                    training costs. These dealers would have
                                                currently cleared estimated burden for                  motor vehicle dealers and the extent to                 to communicate on a notice or
                                                the information collections associated                  which they may be able to use the                       disclosure they already issue under any
                                                with the Privacy Rule annual privacy                    proposed alternative delivery method.                   other provision of law that the privacy
                                                notice.                                                   The Commission does not have                          notice is available. The expense of
                                                   By definition, the expected cost                     precise data on the number of annual                    adding this notification would be minor.
                                                savings to motor vehicle dealers from                   privacy notices motor vehicle dealers                   Staff may need some additional training
                                                the proposed revisions to § 313.9(c) is                 currently provide to directly compute                   in storing copies of the model form and
                                                the expected number of annual privacy                   the total number of annual privacy                      sending it to customers on request.
                                                notices that would be provided through                  notices that would no longer be sent;                   Motor vehicle dealers that do not use
                                                the proposed alternative delivery                       however, in the Commission’s proposal                   the model form would incur a one-time
                                                method multiplied by the expected                       to extend the current PRA clearance for                 cost to create one. However, since the
                                                reduction in the cost per-notice from                   the Privacy Rule,76 the Commission                      promulgation of the model privacy form
                                                using the alternative delivery method.                  estimated the total costs to motor                      in 2009, an Online Form Builder has
                                                The first step in estimating the expected               vehicle dealers to disseminate annual                   existed that any institution can use to
                                                cost savings to motor vehicle dealers                   disclosures to be about $18.4 million.77                readily create a unique, customized
                                                from proposed § 313.9(c)(2) would be to                 Applying the Commission’s estimate                      privacy notice using the model form
                                                identify the motor vehicle dealers                      that 80% of motor vehicle dealers                       template.80 The Commission assumes
                                                whose current information sharing                       would be able to utilize the alternative                that motor vehicle dealers that do not
                                                practices would allow them to use the                   delivery method, the estimated                          currently have Web sites would not
                                                proposed alternative method. The                        reduction in ongoing burden would be                    choose to comply with these
                                                Commission would then need to                           approximately 638,400 hours annually                    requirements in order to use the
                                                determine their currents costs for                      for roughly 48,000 motor vehicle                        alternative delivery method.
                                                providing the annual privacy notices                    dealers.78 The reduction in estimated                      The Commission has determined that
                                                and the expected costs of providing                     ongoing costs from the reduction in                     the proposed rule does not contain any
                                                these notices under proposed                            ongoing burden would be                                 new or substantively revised
                                                § 313.9(c)(2).                                          approximately $14.7 million annually.79                 information collection requirements as
                                                   In order to reach such an estimate for               The Commission requests comment on                      defined by the PRA and that the burden
                                                financial institutions, the Commission                  this preliminary analysis as well as the                estimate for the previously-approved
                                                looked to the Bureau’s rulemaking. The                  submission of additional data that could                information collections should be
                                                Bureau performed a number of analyses                   inform the Commission’s consideration                   reduced as explained above. The
                                                and outreach activities to approximate                  of the cost savings to motor vehicle                    Commission welcomes comments on
                                                the expected cost savings for financial                 dealers.                                                these determinations or any other aspect
                                                institutions. After examining 125 banks                   The Commission believes that the                      of the proposal for purposes of the PRA.
                                                selected through random sampling, the                   one-time cost for some motor vehicle                    Comments should be submitted as
                                                Bureau found that the overall average                                                                           outlined in the ADDRESSES section
                                                rate at which banks’ information sharing                  76 79  FR 55489 (Sept. 14, 2014).
                                                                                                                                                                above. All comments will become a
                                                practices would make them eligible for                    77 Id. at 55490–91 Table IIB.
                                                                                                                                                                matter of public record.
                                                                                                           78 The 638,400 hours estimate is 80% of the
                                                using the alternative delivery method if
                                                                                                        previously published estimate of 798,000 hours,
                                                other conditions were met is 80%.73 The                 cumulatively, for established motor vehicle dealers
                                                                                                                                                                Invitation To Comment
                                                Bureau’s results indicated that a large                 to disseminate annual notices. See id. at 55490            You can file a comment online or on
                                                majority of smaller banks would likely                  (Table IIB). The estimated number of motor vehicle      paper. For the Commission to consider
                                                be able to use the proposed alternative                 dealers that would use the alternative delivery
                                                                                                        method is 80% of the previously published estimate      your comment, we must receive it on or
                                                delivery method but most of the largest                 of the number of motor vehicle dealers, 60,000. See     before August 31, 2015. Write
                                                banks would not.74 For non-depository                   id. at Table IIA notes.                                 ‘‘Amendment to the Privacy of
                                                institutions subject to the Commission’s                   79 This is the product of the above-noted costs to
                                                                                                                                                                Consumer Financial Information Rule,
                                                enforcement, the Bureau similarly                       motor vehicle dealers to disseminate annual
                                                                                                                                                                16 CFR part 313, Project No. R411016’’
                                                estimated that 80% would be able to use                 disclosures, $18.4 million, multiplied by the
                                                                                                        assumed 80% reduction for the alternative delivery      on your comment. Your comment—
                                                the alternate delivery method.75 Subject                method. Estimates of ongoing savings are gross          including your name and your state—
                                                                                                        figures and do not take into account any ongoing        will be placed on the public record of
                                                  73 79  FR at 27226.                                   costs associated with the alternative delivery
                                                  74 Id.                                                method, which the Commission believes would be          this proceeding, including, to the extent
                                                         Only 18% of sampled banks with assets
                                                over $10 billion could clearly use the proposed         minimal. They would consist of additional text on       practicable, on the Commission Web
                                                alternative delivery method, while 81% of sampled       a notice or disclosure the institution already          site, at http://www.ftc.gov/os/
                                                banks with assets of $10 billion or less and 88% of     provides, additional phone calls from consumers         publiccomments.shtm. As a matter of
                                                sampled banks with assets of $500 million or less       requesting that the model form be mailed, and the
                                                                                                        costs of mailing the forms prompted by these calls.     discretion, the Commission tries to
tkelley on DSK3SPTVN1PROD with PROPOSALS




                                                could clearly use the proposed alternative delivery
                                                method. The Bureau also examined the privacy            The Commission currently believes that few              remove individuals’ home contact
                                                policies of 54 credit unions and found 62% of those     consumers will request that the form be mailed in       information from comments before
                                                with assets over $500 million could use the             order to read it or to exercise any voluntary opt-out   placing them on the Commission Web
                                                alternative delivery method and 44% of those with       right, given the availability of the notices online.
                                                $500 million or less in assets could (though, due to    There would be minimal ongoing costs associated         site.
                                                inadequate information, the Bureau could not make       with the alternative delivery method from
                                                the assessment for 48% of those credit unions with      maintaining a Web page if a motor vehicle dealer          80 This Online Form Builder is available at
                                                $500 million or less in assets). Id.                    already has a Web page dedicated to the annual          http://www.federalreserve.gov/newsevents/press/
                                                   75 79 FR at 27229.                                   privacy policy.                                         bcreg/20100415a.htm.



                                           VerDate Sep<11>2014   16:23 Jun 23, 2015   Jkt 235001   PO 00000   Frm 00026   Fmt 4702   Sfmt 4702   E:\FR\FM\24JNP1.SGM   24JNP1


                                                                       Federal Register / Vol. 80, No. 121 / Wednesday, June 24, 2015 / Proposed Rules                                             36277

                                                   Because your comment will be made                    following address: Federal Trade                       1843(k), which incorporates by
                                                public, you are solely responsible for                  Commission, Office of the Secretary,                   reference activities enumerated by the
                                                making sure that your comment doesn’t                   Constitution Center, 400 7th Street SW.,               Federal Reserve Board in 12 CFR
                                                include any sensitive personal                          5th Floor, Suite 5610 (Annex E),                       211.5(d) and 12 CFR 225.28. The
                                                information, such as Social Security                    Washington, DC 20024. If possible,                     ‘‘financial institutions’’ subject to the
                                                number, date of birth, driver’s license                 submit your paper comment to the                       Commission’s rulemaking authority are
                                                number or other state identification                    Commission by courier or overnight                     any persons described in 12 U.S.C. 5519
                                                number or foreign country equivalent,                   service.                                               that are predominantly engaged in the
                                                passport number, financial account                        Visit the Commission Web site at                     sale and servicing of motor vehicles, the
                                                number, or credit or debit card number.                 http://www.ftc.gov to read this Notice                 leasing and servicing of motor vehicles,
                                                You are also solely responsible for                     and the news release describing it. The                or both. They are referred to in this part
                                                making sure that your comment doesn’t                   FTC Act and other laws that the                        as ‘‘You.’’
                                                include any sensitive health                            Commission administers permit the                      ■ 3. In § 313.3, revise paragraphs (e), (i),
                                                information, including medical records                  collection of public comments to                       (k), and (q) to read as follows:
                                                or other individually identifiable health               consider and use in this proceeding as
                                                information. In addition, do not include                                                                       § 313.3   Definitions.
                                                                                                        appropriate. The Commission will
                                                any ‘‘[t]rade secret or any commercial or               consider all timely and responsive                     *       *     *    *    *
                                                financial information which . . . is                    public comments that it receives on or                    (e)(1) Consumer means an individual
                                                privileged or confidential,’’ as discussed              before August 31, 2015. For information                who obtains or has obtained a financial
                                                in section 6(f) of the FTC Act, 15 U.S.C.               on the Commission’s privacy policy,                    product or service from you that is to be
                                                46(f), and FTC Rule 4.10(a)(2), 16 CFR                  including routine uses permitted by the                used primarily for personal, family, or
                                                4.10(a)(2). In particular, do not include               Privacy Act, see http://www.ftc.gov/ftc/               household purposes, or that individual’s
                                                competitively sensitive information                     privacy.htm.                                           legal representative.
                                                such as costs, sales statistics,                                                                                  (2) Examples for purposes of 16 CFR
                                                inventories, formulas, patterns, devices,               List of Subjects in 16 CFR Part 313                    part 313 and 314—(i) An individual
                                                manufacturing processes, or customer                      Consumer protection, Motor vehicle                   who applies to you for credit for
                                                names.                                                  dealers, Privacy, Reporting and                        personal, family, or household purposes
                                                   If you want the Commission to give                   recordkeeping requirements, Trade                      is a consumer of a financial service,
                                                your comment confidential treatment,                    practices.                                             regardless of whether the credit is
                                                you must file it in paper form, with a                                                                         extended.
                                                request for confidential treatment, and                 Authority and Issuance                                    (ii) An individual who provides
                                                you have to follow the procedure                          For the reasons set forth in the                     nonpublic personal information to you
                                                explained in FTC Rule 4.9(c), 16 CFR                    preamble, the Commission proposes to                   in order to obtain a determination about
                                                4.9(c).81 Your comment will be kept                     amend 16 CFR part 313, as set forth                    whether he or she may qualify for a loan
                                                confidential only if the FTC General                    below:                                                 to be used primarily for personal,
                                                Counsel, in his or her sole discretion,                                                                        family, or household purposes is a
                                                grants your request in accordance with                  PART 313—PRIVACY OF CONSUMER                           consumer of a financial service,
                                                the law and the public interest.                        FINANCIAL INFORMATION                                  regardless of whether the loan is
                                                   Postal mail addressed to the                                                                                extended.
                                                Commission is subject to delay due to                   ■  1. The authority citation for Part 313                 (iii) If you hold ownership or
                                                heightened security screening. As a                     is revised to read as follows:                         servicing rights to an individual’s loan
                                                result, we encourage you to submit your                   Authority: 15 U.S.C. 6801 et seq., 12                that is used primarily for personal,
                                                comments online. To make sure that the                  U.S.C. 5519.                                           family, or household purposes, the
                                                Commission considers your online                        ■ 2. In § 313.1, revise paragraph (b) to               individual is your consumer, even if
                                                comment, you must file it at https://                   read as follows:                                       you hold those rights in conjunction
                                                ftcpublic.commentworks.com/ftc/                                                                                with one or more other institutions.
                                                GLBPrivacyamendment, by following                       § 313.1    Purpose and scope.                          (The individual is also a consumer with
                                                the instructions on the web-based form.                 *      *     *      *    *                             respect to the other financial
                                                If this Notice appears at http://                          (b) Scope. This part applies only to                institutions involved.) An individual
                                                www.regulations.gov/#!home, you also                    nonpublic personal information about                   who has a loan in which you have
                                                may file a comment through that Web                     individuals who obtain financial                       ownership or servicing rights is your
                                                site.                                                   products or services primarily for                     consumer, even if you, or another
                                                   If you file your comment on paper,                   personal, family or household purposes                 institution with those rights, hire an
                                                write ‘‘Amendment to the Privacy of                     from the institutions listed below. This               agent to collect on the loan.
                                                Consumer Financial Information Rule,                    part does not apply to information about                  (iv) An individual who is a consumer
                                                16 CFR part 313, Project No. R411016’’                  companies or about individuals who                     of another financial institution is not
                                                on your comment and on the envelope,                    obtain financial products or services for              your consumer solely because you act as
                                                and mail your comment to the following                  business, commercial, or agricultural                  agent for, or provide processing or other
                                                address: Federal Trade Commission,                      purposes. This part applies to those                   services to, that financial institution.
                                                Office of the Secretary, 600                            ‘‘financial institutions’’ over which the                 (v) An individual is not your
                                                Pennsylvania Avenue NW., Suite CC–                      Federal Trade Commission                               consumer solely because he or she is a
tkelley on DSK3SPTVN1PROD with PROPOSALS




                                                5610 (Annex E), Washington, DC 20580,                   (‘‘Commission’’) has rulemaking                        participant or a beneficiary of an
                                                or deliver your comment to the                          authority pursuant to section                          employee benefit plan that you sponsor
                                                                                                        504(a)(1)(C) of the Gramm-Leach-Bliley                 or for which you act as a trustee or
                                                  81 In particular, the written request for             Act. An entity is a ‘‘financial                        fiduciary.
                                                confidential treatment that accompanies the             institution’’ if its business is engaging in              (3) Examples for purposes of 16 CFR
                                                comment must include the factual and legal basis
                                                for the request, and must identify the specific
                                                                                                        a financial activity as described in                   part 314—(i) An individual who
                                                portions of the comment to be withheld from the         section 4(k) of the Bank Holding                       provides nonpublic personal
                                                public record. See FTC Rule 4.9(c), 16 CFR 4.9(c).      Company Act of 1956, 12 U.S.C.                         information to you in connection with


                                           VerDate Sep<11>2014   16:23 Jun 23, 2015   Jkt 235001   PO 00000   Frm 00027   Fmt 4702   Sfmt 4702   E:\FR\FM\24JNP1.SGM   24JNP1


                                                36278                 Federal Register / Vol. 80, No. 121 / Wednesday, June 24, 2015 / Proposed Rules

                                                obtaining or seeking to obtain financial,               or attempt to collect any amount from                  card demonstrates that a retailer is
                                                investment, or economic advisory                        the consumer on the account; or                        significantly engaged in extending
                                                services is a consumer, regardless of                       (7) Obtains real estate settlement                 credit.
                                                whether you establish a continuing                      services from you.                                        (ii) A personal property or real estate
                                                advisory relationship.                                      (ii) No continuing relationship. (A)               appraiser is a financial institution
                                                   (ii) An individual is not your                       For purposes of 16 CFR parts 313 and                   because real and personal property
                                                consumer solely because he or she has                   314, a consumer does not, however,                     appraisal is a financial activity listed in
                                                designated you as trustee for a trust.                  have a continuing relationship with you                12 CFR 225.28(b)(2)(i) and referenced in
                                                   (iii) An individual is not your                      if:                                                    section 4(k)(4)(F) of the Bank Holding
                                                consumer solely because he or she is a                      (1) The consumer obtains a financial               Company Act.
                                                beneficiary of a trust for which you are                product or service from you only in                       (iii) A career counselor that
                                                a trustee.                                              isolated transactions, such as cashing a               specializes in providing career
                                                *       *    *     *     *                              check with you or making a wire                        counseling services to individuals
                                                   (i)(1) Customer relationship means a                 transfer through you;                                  currently employed by or recently
                                                continuing relationship between a                           (2) You sell the consumer’s loan and               displaced from a financial organization,
                                                consumer and you under which you                        do not retain the rights to service that               individuals who are seeking
                                                provide one or more financial products                  loan; or                                               employment with a financial
                                                or services to the consumer that are to                     (3) The consumer obtains one-time                  organization, or individuals who are
                                                be used primarily for personal, family,                 personal or real property appraisal                    currently employed by or seeking
                                                or household purposes.                                  services from you.                                     placement with the finance, accounting
                                                   (2) Examples—(i) Continuing                              (B) For purposes of 16 CFR part 314,               or audit departments of any company is
                                                relationship. (A) A consumer has a                      a consumer also does not have a                        a financial institution because such
                                                continuing relationship with you, for                   continuing relationship with you if:                   career counseling activities are financial
                                                purposes of 16 CFR part 313 and part                        (1) The consumer obtains a financial               activities listed in 12 CFR
                                                314, if the consumer:                                   product or service from you only in                    225.28(b)(9)(iii) and referenced in
                                                   (1) Has a credit or investment account               isolated transactions, such as using your              section 4(k)(4)(F) of the Bank Holding
                                                with you;                                               ATM to withdraw cash from an account                   Company Act.
                                                   (2) Obtains a loan from you;                         at another financial institution or                       (iv) A business that prints and sells
                                                   (3) Purchases an insurance product                   purchasing a money order from you;                     checks for consumers, either as its sole
                                                from you;                                                   (2) You sell the consumer airline                  business or as one of its product lines,
                                                   (4) Enters into an agreement or                      tickets, travel insurance, or traveler’s               is a financial institution because
                                                understanding with you whereby you                      checks in isolated transactions; or                    printing and selling checks is a financial
                                                undertake to arrange credit to purchase                     (3) The consumer purchases checks                  activity that is listed in 12 CFR
                                                a vehicle, for the consumer;                            for a personal checking account from                   225.28(b)(10)(ii) and referenced in
                                                   (5) Enters into a lease of personal                  you.                                                   section 4(k)(4)(F) of the Bank Holding
                                                property on a non-operating basis with                  *        *    *    *     *                             Company Act.
                                                you; or                                                     (k)(1) Financial institution means any                (v) A business that regularly wires
                                                   (6) Has a loan for which you own the                 institution the business of which is                   money to and from consumers is a
                                                servicing rights.                                       engaging in financial activities as                    financial institution because transferring
                                                   (B) A consumer also has a continuing                 described in section 4(k) of the Bank                  money is a financial activity referenced
                                                relationship with you, for purposes of                  Holding Company Act of 1956 (12                        in section 4(k)(4)(A) of the Bank
                                                16 CFR part 314, if the consumer:                       U.S.C. 1843(k)). An institution that is                Holding Company Act and regularly
                                                   (1) Holds an investment product                      significantly engaged in financial                     providing that service demonstrates that
                                                through you, such as when you act as                    activities is a financial institution.                 the business is significantly engaged in
                                                a custodian for securities or for assets in                 (2) Example of financial institution               that activity.
                                                an Individual Retirement Arrangement;                   for purposes of 16 CFR part 313 and                       (vi) A check cashing business is a
                                                   (2) Enters into an agreement or                      314. An automobile dealership that, as                 financial institution because cashing a
                                                understanding with you whereby you                      a usual part of its business, leases                   check is exchanging money, which is a
                                                undertake to arrange or broker a home                   automobiles on a nonoperating basis for                financial activity listed in section
                                                mortgage loan, for the consumer;                        longer than 90 days is a financial                     4(k)(4)(A) of the Bank Holding Company
                                                   (3) Obtains financial, investment, or                institution with respect to its leasing                Act.
                                                economic advisory services from you for                 business because leasing personal                         (vii) An accountant or other tax
                                                a fee;                                                  property on a nonoperating basis where                 preparation service that is in the
                                                   (4) Becomes your client for the                      the initial term of the lease is at least 90           business of completing income tax
                                                purpose of obtaining tax preparation or                 days is a financial activity listed in 12              returns is a financial institution because
                                                credit counseling services from you;                    CFR 225.28(b)(3) and referenced in                     tax preparation services is a financial
                                                   (5) Obtains career counseling while                  section 4(k)(4)(F) of the Bank Holding                 activity listed in 12 CFR 225.28(b)(6)(vi)
                                                seeking employment with a financial                     Company Act.                                           and referenced in section 4(k)(4)(G) of
                                                institution or the finance, accounting, or                  (3) Examples of financial institution              the Bank Holding Company Act.
                                                audit department of any company (or                     for purposes of 16 CFR part 314. (i) A                    (viii) A business that operates a travel
tkelley on DSK3SPTVN1PROD with PROPOSALS




                                                while employed by such a financial                      retailer that extends credit by issuing its            agency in connection with financial
                                                institution or department of any                        own credit card directly to consumers is               services is a financial institution
                                                company);                                               a financial institution because extending              because operating a travel agency in
                                                   (6) Is obligated on an account that you              credit is a financial activity listed in 12            connection with financial services is a
                                                purchase from another financial                         CFR 225.28(b)(1) and referenced in                     financial activity listed in 12 CFR
                                                institution, regardless of whether the                  section 4(k)(4)(F) of the Bank Holding                 211.5(d)(15) and referenced in section
                                                account is in default when purchased,                   Company Act and issuing that extension                 4(k)(4)(G) of the Bank Holding Company
                                                unless you do not locate the consumer                   of credit through a proprietary credit                 Act.


                                           VerDate Sep<11>2014   16:23 Jun 23, 2015   Jkt 235001   PO 00000   Frm 00028   Fmt 4702   Sfmt 4702   E:\FR\FM\24JNP1.SGM   24JNP1


                                                                      Federal Register / Vol. 80, No. 121 / Wednesday, June 24, 2015 / Proposed Rules                                                  36279

                                                   (ix) An entity that provides real estate                (iv) A grocery store is not a financial                (D) The information you are required
                                                settlement services is a financial                      institution merely because it allows                   to convey on your annual privacy notice
                                                institution because providing real estate               individuals to whom it sells groceries to              pursuant to § 313.6(a)(1) through (5), (8),
                                                settlement services is a financial activity             cash a check, or write a check for a                   and (9) has not changed since you
                                                listed in 12 CFR 225.28(b)(2)(viii) and                 higher amount than the grocery                         provided the immediately previous
                                                referenced in section 4(k)(4)(F) of the                 purchase and obtain cash in return.                    privacy notice (whether initial, annual
                                                Bank Holding Company Act.                               *      *     *     *     *                             or revised) to the customer, other than
                                                   (x) A mortgage broker is a financial                    (q) For purposes of 16 CFR part 313,                to eliminate categories of information
                                                institution because brokering loans is a                You includes each ‘‘financial                          you disclose or categories of third
                                                financial activity listed in 12 CFR                     institution’’ over which the Commission                parties to whom you disclose
                                                225.28(b)(1) and referenced in section                  has rulemaking authority pursuant to                   information; and
                                                4(k)(4)(F) of the Bank Holding Company                  section 504(a)(1)(C) of the Gramm-                        (E) You use the model privacy form in
                                                Act.                                                    Leach-Bliley Act. For purposes of 16                   the appendix to this part for your
                                                   (xi) An investment advisory company                  CFR part 314, You includes each                        annual privacy notice.
                                                and a credit counseling service are each                ‘‘financial institution’’ (but excludes any               (ii) For an annual privacy notice that
                                                financial institutions because providing                ‘‘other person’’) over which the                       meets the requirements in paragraph
                                                financial and investment advisory                       Commission has enforcement                             (c)(2)(i) of this section, you satisfy the
                                                services are financial activities                       jurisdiction pursuant to section                       requirement in § 313.5(a)(1) to provide a
                                                referenced in section 4(k)(4)(C) of the                 505(a)(7) of the Gramm-Leach-Bliley                    notice if you:
                                                Bank Holding Company Act.                               Act.                                                      (A) Convey in a clear and
                                                   (4) Financial institution does not                   ■ 4. In § 313.9, revise paragraph (c) to               conspicuous manner not less than
                                                include:                                                read as follows:                                       annually on an account statement,
                                                   (i) Any person or entity with respect
                                                                                                                                                               coupon book, or a notice or disclosure
                                                to any financial activity that is subject               § 313.9 Delivering privacy and opt out
                                                                                                        notices.                                               you are required or expressly and
                                                to the jurisdiction of the Commodity
                                                                                                                                                               specifically permitted to issue under
                                                Futures Trading Commission under the                    *       *    *    *      *                             any other provision of law that your
                                                Commodity Exchange Act (7 U.S.C. 1 et                      (c) Annual notices only. (1)
                                                                                                                                                               privacy notice is available on your Web
                                                seq.);                                                  Reasonable expectation. You may
                                                                                                                                                               site and will be mailed to the customer
                                                   (ii) The Federal Agricultural Mortgage               reasonably expect that a customer will
                                                                                                                                                               upon request by telephone. The
                                                Corporation or any entity chartered and                 receive actual notice of your annual
                                                                                                                                                               statement must state that your privacy
                                                operating under the Farm Credit Act of                  privacy notice if:
                                                                                                           (i) The customer uses your Web site                 notice has not changed and must
                                                1971 (12 U.S.C. 2001 et seq.); or
                                                   (iii) Institutions chartered by Congress             to access financial products and services              include a specific Web address that
                                                specifically to engage in securitizations,              electronically and agrees to receive                   takes the customer directly to the page
                                                secondary market sales (including sales                 notices at the Web site, and you post                  where the privacy notice is posted and
                                                of servicing rights) or similar                         your current privacy notice                            a designated telephone number for the
                                                transactions related to a transaction of a              continuously in a clear and conspicuous                customer to request that it be mailed;
                                                consumer, as long as such institutions                  manner on the Web site; or                                (B) Post your current privacy notice
                                                do not sell or transfer nonpublic                          (ii) The customer has requested that                continuously in a clear and conspicuous
                                                personal information to a nonaffiliated                 you refrain from sending any                           manner on a page of your Web site that
                                                third party other than as permitted by                  information regarding the customer                     contains only the privacy notice,
                                                §§ 313.14 and 313.15 of this Part.                      relationship, and your current privacy                 without requiring the customer to
                                                   (iv) Entities that engage in financial               notice remains available to the customer               provide any information such as a login
                                                activities but that are not significantly               upon request.                                          name or password or agree to any
                                                engaged in those financial activities.                     (2) Alternative method for providing                conditions to access the page; and
                                                   (5) Example of entities that are not                 certain annual notices. (i)                               (C) Mail your current privacy notice
                                                significantly engaged in financial                      Notwithstanding paragraph (a) of this                  to those customers who request it by
                                                activities for purposes of 16 CFR part                  section, you may use the alternative                   telephone within ten days of the
                                                313 and 314. A motor vehicle dealer is                  method described in paragraph (c)(2)(ii)               request.
                                                not a financial institution merely                      of this section to satisfy the requirement                (iii) An example of a statement that
                                                because it accepts payment in the form                  in § 313.5(a)(1) to provide a notice if:               satisfies paragraph (c)(2)(ii)(A) of this
                                                of cash, checks, or credit cards that it                   (A) You do not disclose the                         section is: ‘‘Privacy Notice’’ in boldface
                                                did not issue.                                          customer’s nonpublic personal                          or otherwise emphasized: Privacy
                                                   (6) Examples of entities that are not                information with nonaffiliated third                   Notice—Federal law requires us to tell
                                                significantly engaged in financial                      parties other than for purposes under                  you how we collect, share, and protect
                                                activities for purposes of 16 CFR part                  §§ 313.13, 313.14, and 313.15;                         your personal information. Our privacy
                                                314. (i) A retailer is not a financial                     (B) You do not include on your                      policy has not changed and you may
                                                institution if its only means of                        annual privacy notice pursuant to                      review our policy and practices with
                                                extending credit are occasional ‘‘lay                   § 313.6(a)(7) an opt out under section                 respect to your personal information at
                                                away’’ and deferred payment plans or                    603(d)(2)(A)(iii) of the Fair Credit                   [Web address] or we will mail you a free
                                                accepting payment by means of credit                    Reporting Act (15 U.S.C.                               copy upon request if you call us at
tkelley on DSK3SPTVN1PROD with PROPOSALS




                                                cards issued by others.                                 1681a(d)(2)(A)(iii));                                  [telephone number].
                                                   (ii) A retailer is not a financial                      (C) The requirements of section 624 of              *       *     *     *    *
                                                institution merely because it accepts                   the Fair Credit Reporting Act (15 U.S.C.
                                                                                                        1681s–3) and Part 680 of this chapter, if                By direction of the Commission.
                                                payment in the form of cash, checks, or
                                                credit cards that it did not issue.                     applicable, have been satisfied                        Donald S. Clark,
                                                   (iii) A merchant is not a financial                  previously or the annual privacy notice                Secretary.
                                                institution merely because it allows an                 is not the only notice provided to satisfy             [FR Doc. 2015–14328 Filed 6–23–15; 8:45 am]
                                                individual to ‘‘run a tab.’’                            such requirements;                                     BILLING CODE 6750–01–P




                                           VerDate Sep<11>2014   16:23 Jun 23, 2015   Jkt 235001   PO 00000   Frm 00029   Fmt 4702   Sfmt 9990   E:\FR\FM\24JNP1.SGM   24JNP1



Document Created: 2015-12-15 14:09:42
Document Modified: 2015-12-15 14:09:42
CategoryRegulatory Information
CollectionFederal Register
sudoc ClassAE 2.7:
GS 4.107:
AE 2.106:
PublisherOffice of the Federal Register, National Archives and Records Administration
SectionProposed Rules
ActionNotice of proposed rulemaking; Request for public comment.
DatesComments must be received on or before August 31, 2015.
ContactSteven Toporoff, (202) 326-3135, Attorney, Division of Privacy and Identity Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW., Washington, DC 20580.
FR Citation80 FR 36267 
RIN Number3084-AB42
CFR AssociatedConsumer Protection; Motor Vehicle Dealers; Privacy; Reporting and Recordkeeping Requirements and Trade Practices

2024 Federal Register | Disclaimer | Privacy Policy
USC | CFR | eCFR