Vol. 23, No. 4/Summer 2001
The Gramm-Leach-Bliley Act
By Heidi Yacker
Congress passed the Financial Services Modernization Act (a.k.a. the Gramm-Leach Bliley Act, P.L. 106-102) to modernize American finance and bring it into line with other countries. While the main thrust of the legislation is to reform the banking and financial services industry, Title V of the act contains privacy provisions. These provisions prohibit financial institutions from providing any "nonpublic personal information" to any unaffiliated third party without first allowing the consumer the opportunity to refuse to have the information shared – an "opt-out" option. Financial institutions must now inform customers of both their privacy policies and policies regarding information sharing.
Acting under these provisions, the Federal Trade Commission (FTC) issued rules, effective July 1, 2001, for standards to be used by financial institutions in safeguarding the privacy of their customers’ records. It included credit bureaus in its definition of a financial institution. The FTC rules can be found at the Agency’s web site (www.ftc.gov).
Credit bureaus maintain consumer reports on individuals. These reports are divided into two parts. The top of the report contains the "credit header" - personal identifying information such as name, address, phone number and Social Security number. The second part is the individual’s credit history. Use of this second part is regulated by the Fair Credit Reporting Act; the credit header information is not.
Credit bureaus sell credit header information to such entities as marketers and private investigators. They also sell it to information services like LexisNexis and West Group that provide online search services to help find missing persons or perform employee background checks. Privacy advocates claim that the information can also be used for illegitimate purposes such as identity theft. They state that information provided to financial institutions should not be used by outside groups for other purposes.
The Individual Reference Services Group Inc. (IRSG), a trade association of credit bureaus and information brokers, brought suit against the FTC charging that they were wrongfully included as regulated entities. The suit stated that they should not be subject to the notification and opt-out provisions of the law. In an April 30 decision, seen as a victory for privacy advocates, the federal district court in Washington, D.C. upheld the constitutionality of the FTC rule. Information on the IRSG’s stance can be found at the association’s Web site (www.irsg.org).
The regulations and court decision could have far-reaching effects on information brokerage. It will be very expensive for credit bureaus to notify consumers of their information sharing policies. If consumers choose to refuse to allow the information to be shared, the credit header information could eventually lose its value. This could result in marketers’ inability to pinpoint likely customers and require them to increase their mass mailings.
Government Relations Chair Heidi Yacker is a librarian at Congressional Research Service. You can contact her at firstname.lastname@example.org.