Emerging Regulatory Issues
Bank of America Supports an Expansive Definition of Personal Data to be Released
The CRE earlier wrote about this issue in which they raised several questions about the proposed rules. Specifically, the CRE raised questions about the extent to which individual consumer information could be shared by bank affiliates without compromising the privacy rights of the consumers. Some of the questions raised by the CRE were:
- What kinds of publicly available information should be excluded from the new requirements?
- Should nonidentifiable personal information (i.e. information with no indicators of the individual's identity) be subject to, or excluded from, the proposed rule?
- How should the notice of the pending disclosure and attendant right to "opt out" (i.e. to prevent the disclosure) be provided?
- How much advance notice should the individual who is the subject of the data have to "opt out"?
- What categories of nonpublic personal information should a financial institution be allowed to collect for eventual disclosure?
The following are excerpts from Bank of America regarding the proposed rule:
Publicly Available Information
The GLB Act provides that "nonpublic personal information" is personally identifiable financial information that is provided by a consumer to a financial institution, results from any transaction with the consumer or any service performed for the consumer or is otherwise obtained by a financial institution, but excludes publicly available information. The Proposed Rule suggests two alternatives for the definition of public information, which differ in their treatment of information available from public sources. Under Alternative A, information is public information only if it was actually obtained by the financial institution from a publicly available source (i.e. government records, widely distributed media or government-mandated disclosures). On the other hand, under Alternative B, information is public information if it can be obtained from a publicly available source, even if it was obtained from the customer or other source.
The final rule should adopt the concept expressed in Alternative B. To do otherwise would elevate source over substance and foster factual disputes over the immediate origin of information that, by definition, is available to anyone and everyone. If Alternative A is adopted, financial institutions would incur the unnecessary costs of tracking the actual source of information they hold and would bear the burden of proof that they had not inappropriately disclosed information which is clearly available generally to the public.
