UNITED STATES OF AMERICA
FEDERAL TRADE COMMISSION
WASHINGTON, D.C. 20580
Division of Credit Practices
~
Thomas E. Kane
Attorney
|
|
September 9, 1998
Michael R. Novak
Vice President & Director of Retail Banking
Cohoes Savings Bank
Cohoes, New York 12047
- Re: Section 603(d) of the Fair Credit Reporting Act
Dear Mr. Novak:
This responds to your request for a staff opinion concerning
whether the Fair Credit Reporting Act ("FCRA") permits
your bank ("the Bank") to share information about the
Bank's customers with investment representatives ("IRs").
Based on your letter and our telephone conversation, it is my
understanding that the relevant facts are as follows. From their
desks in the Bank's lobbies, the IRs sell securities and insurance
products created by a number of different entities. These entities
have authorized a broker/dealer corporation ("the Broker"),
which is not an affiliate of the Bank, to sell the products. The
Broker leases the space in the Bank's locations where the IRs
have their desks. The IRs sign agreements with the Broker. The
Broker holds the IRs' securities and insurance licenses and is
responsible for ensuring that the IRs comply with applicable securities
and insurance laws.
The IRs' salaries and benefits are paid by a wholly-owned subsidiary
of the Bank ("the Subsidiary"). As president of the
Subsidiary (in addition to your role as vice president of the
Bank), you interview the candidates for IR positions and decide
which of them will be hired. The IRs sign contracts with the Bank
in which they agree to comply with the Bank's personnel rules
and the Bank's rules regarding access to Bank records. On a day-to-day
basis, the IRs are supervised by Bank employees. When IRs sell
securities and insurance products, the Subsidiary receives a large
portion of the commission.
Currently, Bank employees search through the Bank's customer
databases, select customers who might be good candidates for the
IRs' products, contact those customers, and ask them if they would
like an IR to contact them. If the customer agrees to such a contact,
the Bank employee passes the customer's name and contact information
to the IR. The Bank wishes to adopt a different procedure for
sharing information with the IRs. In that regard, you ask the
following question:
If the Bank sufficiently discloses to its customers that
it plans to share customer information with its affiliates, is
the Bank permitted to share the information with the IRs so the
IRs can contact the customer directly?
The FCRA prohibits the furnishing of "consumer reports"
to any individual or entity that does not meet a permissible purpose
to obtain such a report under Section 604 of the statute. Because
the IRs meet none of the permissible purposes listed under Section
604, they may not obtain the Bank's customer information if such
information meets the definition of "consumer report,"
found in Section 603(d). During our telephone conversation, you
described two types of information that the Bank wishes to share
with the IRs. The first type includes lists of customers such
as all those who have savings account balances of $10,000 or more
("customer lists"). The second type includes information,
obtained by the Bank from customer loan applications, regarding
the customer's transaction with entities other than the Bank ("application
information").
Both the customer lists and the application information meet
the general definition of "consumer report" set out
Section 603(d)(1), i.e., the information bears on the
customers' "credit worthiness, credit standing, [or] credit
capacity" and is "used or expected to be used or collected
in whole or in part for the purpose of serving as a factor in
establishing the consumer's eligibility for . . . credit or insurance."
The next issue, then, is whether the two types of information
are excluded from the definition of "consumer report"
under Section 603(d)(2), the relevant portions of which read as
follows:
The term "consumer report" does not include
. . . any (i) report containing information solely as to transactions
or experiences between the consumer and the person making the
report;
(ii) communication of that information among persons
related by common ownership or by corporate control; or (iii)
communication of other information among persons related by
common ownership or by corporate control, if it is clearly and
conspicuously disclosed to the consumer that the information
may be communicated among such persons and the consumer is given
the opportunity, before the time that the information is initially
communicated, to direct that such information not be communicated
among such persons
Customer Lists
Section 603(d)(2)(A)(i) refers to "information solely as
to transactions or experiences between the consumer and the person
making the report." Such "transaction or experience"
information includes the length of time the customer has held
a credit card issued by the Bank, the number of times the customer
has been late in making a payment on such a credit card, and the
average monthly balance in the customer's savings account. A list
of the Bank's customers who have savings account balances of $10,000
or more also would constitute "transaction or experience"
information and would therefore be excluded from the definition
of "consumer report" under Section 603(d)(2)(A)(i).
Thus, the Bank would not violate the FCRA if it shared such information
with the IRs or any other entity that requested the information.
Application Information
Based on our telephone conversation, it appears that the second
type of information that the Bank wishes to share with the IRs,
application information, would include lists of the customer's
assets and liabilities with entities other than the Bank, and
lists of the names of companies from whom the customer has purchased
insurance and securities. This information could not be the Bank's
"transaction or experience" information because it includes
only the customer's transactions with entities other than
the Bank. Because this second type of information is not "transaction
or experience" information, it is not excluded from the definition
of "consumer report" under Sections 603(d)(2)(A)(i)
or (ii).
The next issue is whether such information may be excluded from
the definition under Section 603(d)(2)(A)(iii), the "affiliate-sharing"
exclusion. Under that section, as long as the Bank provides the
proper disclosures and the consumer has not objected to the communication,
it is permitted to "communicate" any customer information
to the IRs -- and the customer information is excluded from the
definition of "consumer report"-- if the IRs are "persons
related by common ownership or by corporate control," i.e.,
"affiliates." The Subsidiary itself is an affiliate
of the Bank, of course. We believe that the IRs are affiliates
as well because they are employees of the Subsidiary. This conclusion
is based on the following facts that we understand to be true:
(1) the Subsidiary pays the IRs' salaries and benefits; (2) the
IRs are supervised primarily by Bank employees; (3) the Subsidiary
receives a large portion of the commissions that consumers pay
for the insurance and securities products; and (4) the IRs would
be obtaining the Bank's information only to select which consumers
to contact about the insurance and securities products, rather
than to forward the information to the Broker or the entities
that created the insurance and securities products. (On this fourth
point, we note that neither the Broker nor the other entities
are "affiliates" of the Bank.) Because we conclude that
the IRs are employees of a Bank affiliate, the Bank may communicate
to the IRs all information obtained from customer loan applications
regarding the customer's transactions with entities other than
the Bank, as long as the Section 603(d)(2)(A)(iii) disclosure
requirements are met. As noted above, that subsection requires
that it be "clearly and conspicuously disclosed to the consumer
that the information may be communicated among such persons and
the consumer is given the opportunity, before the time that the
information is initially communicated, to direct that such information
not be communicated among such persons."
The views set forth in this informal staff opinion are those
of the staff and are not binding on the Commission. Please recognize
that Section 621(e) of the FCRA authorizes the Board of Governors
of the Federal Reserve System to issue interpretations of the
FCRA, to the extent that the statute applies to banks and other
financial institutions enumerated in that section.
Sincerely,
Thomas E. Kane
|