1. Those Other Laws Dino Tsibouris Attorney at Law dino@tsibouris.com 2006 NCHELP FALL TRAINING CONFERENCE

2. It’s all so regulated… Licensing requirements to do business Limits to interest rates and loan fees Privacy and information security 2006 NCHELP FALL TRAINING CONFERENCE

3. Licensing National banks and thrifts don’t need a license from the state Non-bank lenders and purchasers of loans may need a license to make or enforce a loan 2006 NCHELP FALL TRAINING CONFERENCE

4. Licensing A common test: Are you in the “business of lending?” –NJ includes companies that purchase loans from others –OH includes the original lender only –MN excludes loans under other state law 2006 NCHELP FALL TRAINING CONFERENCE

5. Licensing Physical location concerns Limits on assignment Specific rates of interest and permissible fees 2006 NCHELP FALL TRAINING CONFERENCE

6. Loan Pricing State license lender laws establish permitted rates and fees –Interest rates –Late fees –Loan origination fees of 1-2% –Prepayment fees –Refund of unearned charges 2006 NCHELP FALL TRAINING CONFERENCE

7. Loan Pricing National Bank Act (12 USC 85) A national bank located in a state may charge interest at the maximum rate permitted to any state-chartered or licensed lending institution by the law of that state 2006 NCHELP FALL TRAINING CONFERENCE

8. Loan Pricing National Bank Act (12 USC 85) “Interest" includes any payment compensating a creditor for: –An extension of credit –Making available of a line of credit –Any default or breach by a borrower 2006 NCHELP FALL TRAINING CONFERENCE

9. Loan Pricing National Bank Act 12 USC 85 “Interest" includes, among other things: –Numerical periodic rates –Late fees –Creditor-imposed NSF fees 2006 NCHELP FALL TRAINING CONFERENCE

10. Loan Pricing National Bank Act 12 USC 85 “Interest" does not ordinarily include: –Premiums/commissions for insurance guaranteeing repayment of any extension of credit –Document preparation –Fees incurred to obtain credit reports 2006 NCHELP FALL TRAINING CONFERENCE

11. Loan Pricing – Tied to State Law Ohio Revised Code 1109.20 –Interest/finance charges not exceeding APR of twenty-five per cent –Also may charge, as interest, other fees and charges that are agreed upon by the bank and the borrower 2006 NCHELP FALL TRAINING CONFERENCE

12. Loan Pricing – Tied to State Law RC 1109.20 “Interest” –Charges for late payments –NSF fees –Application, processing, origination fees –Guarantee fees –Prepayment fees 2006 NCHELP FALL TRAINING CONFERENCE

13. Loan Pricing – Tied to State Law RC 1109.20 “Interest” Any fees and charges shall not be included in the computation of the annual percentage rate or the rates of interest or finance charges for purposes of applying the twenty-five per cent limitation 2006 NCHELP FALL TRAINING CONFERENCE

14. Loan Pricing – Tied to State Law 12 CFR 7.4001 The term “interest” as used in 12 U.S.C. 85 includes … includes, among other things,… RC 1109.20 A bank may charge… as interest, other fees and charges that are agreed upon … including, but not limited to,… Many possibilities; uncertain outcomes 2006 NCHELP FALL TRAINING CONFERENCE

15. Important Considerations Make sure rates and fees are properly structured –Within legal limits –Business case for each fee Challenges to the relationship between lenders those who buy their loans 2006 NCHELP FALL TRAINING CONFERENCE

16. Privacy GLB Contract management State privacy law FTC Breach notification 2006 NCHELP FALL TRAINING CONFERENCE

17. Privacy – GLB Permitted Sharing Third party with notice and opt-out Permitted disclosure without consent –Service providers (notice, contract) –Joint marketing agreements (contract) Express consent from consumer 2006 NCHELP FALL TRAINING CONFERENCE

18. Privacy – Consent GLB: “Clear and Conspicuous” –Reasonably understandable and designed to call attention to the nature and significance of the information contained –May combine with other clear and conspicuous notices FCRA: “Clear and Conspicuous” –Small type on back of mailer in a paragraph of type about other matters inadequate (Use different type, color - Cole v. U.S. Capital) 2006 NCHELP FALL TRAINING CONFERENCE

19. Privacy – Scope of Consent I authorize the release of information pertinent to my loans: (i) by the school, the lender, and the guarantor, or their agents, to the references on the applicable loans and to members of my immediate family unless I submit written directions otherwise; and, (ii) by and among my schools, lenders, guarantors, the Department of Education, and their agents. Source: FFELP MPN 2006 NCHELP FALL TRAINING CONFERENCE

20. Privacy – Scope of Consent Agent: A person authorized to act for and under the direction of another person when dealing with third parties. Can enter into binding agreements on the principal's behalf and may even create liability for the principal if the agent causes harm while carrying out his or her duties. Source: www.nolo.com 2006 NCHELP FALL TRAINING CONFERENCE

21. Security 88,348,579+ persons had their PFI improperly accessed/stolen between February 15, 2005 and June 16, 2006 (Privacy Rights Clearinghouse) A consumer calling the FTC helpline reported that in one day thieves used her stolen PFI to open 9 credit card accounts and charged $15,000

22. Technical Security Hackers Unprotected Wireless Access Compromised Passwords Unencrypted Data Storage and/or Transmissions

23. Physical Security CDs/Files Lost/Stolen During Transport Files Lost/Stolen from Storage Improper Destruction of Files Lost/Stolen Laptops

24. Humans, Contractors, and Vendors Dishonest Persons Failure to Follow Corporate Security Regulations Mistakes/Errors

25. Privacy – Contract Management Privacy Agreements –Limits on use –Audit rights –Notice if breached –Indemnity for claims and losses –No limit on liability 2006 NCHELP FALL TRAINING CONFERENCE

26. If a Breach Occurs Key steps –Identify the information lost –Identify “affected persons” –Notify law enforcement –Prepare customer and media response plan –Notify affected persons 2006 NCHELP FALL TRAINING CONFERENCE

27. State Laws Consumer protection and deceptive trade statutes State AGs offices are pursuing loss or breach of consumer personal information through traditional consumer protection and deceptive trade practices statutes

28. Federal Laws Federal Trade Commission Act (FTC Act) prohibits “unfair or deceptive acts or practices.” Gramm Leach Bliley Act governs the collection and disclosure of NPI (Privacy Rule); requires design, application, and maintenance of safeguards to protect NPI (Safeguards Rule)

29. DSW, Inc. Both state and federal cases were filed against DSW, Inc. –DSW is based in Ohio and sells shoes in 206 stores nationwide –Ohio Attorney General filed suit under Ohio Consumer Sales Practices Act –Federal Trade Commission filed suit under FTC Act

30. DSW, Inc. DSW retained consumers’ names, credit/debit card numbers, checking account information and drivers’ license numbers March 8, 2005 DSW learns that the data it retained from some 1.4M sales transactions was removed from its custody

31. State of Ohio v. DSW, Inc. Attorney General suit claimed DSW’s failure to notify all affected consumers was “unfair or deceptive” act under Ohio’s Consumer Sales Practices Act Asked court to order DSW to send written notice to all affected consumers

32. State of Ohio v. DSW, Inc. DSW: Difficult to contact all customers because it did not keep detailed information on all customers' addresses DSW SEC filing: Set aside $6.5 million to handle claims from the case and indicated total exposure could reach $9.5 million

33. In re DSW, Inc. FTC: DSW violated FTC Act when it “failed to provide reasonable and appropriate security for personal information collected at its stores”

34. In re DSW, Inc. Alleged violations: –Storing data it didn’t need to keep –Not using available security measures to limit wireless access to computer networks –Storing data in unencrypted files, accessed via a well known user ID and password –Failing to employ sufficient measures to detect unauthorized access

35. In re DSW, Inc. Settlement DSW must establish a comprehensive information security program: –Reasonably designed to protect the security, confidentiality, and integrity of personal information collected from or about consumers –Fully documented in writing –Contain administrative, technical, and physical safeguards appropriate to DSW’s size and complexity

36. In re DSW, Inc. Settlement “Security Program” Requires: –Designated employee(s) to coordinate and be accountable for IS program –Identify internal/external risks to NPI that could result in unauthorized disclosure or misuse –Assessment of the sufficiency of any safeguards used to control risks

37. In re DSW, Inc. Settlement “Security Program” Requires: –Regular testing of the key controls, systems, and procedures –Evaluation and adjustment of the program based on results of testing, material changes to operations or business arrangements

38. In re DSW, Inc. Settlement “Security Program” Requires: –Initial/biennial assessments and reports from independent third-party professional, using industry procedures and standards for a period of twenty (20) years

39. Gramm Leach Bliley Act –Violations of the G-L-B Act’s Privacy and Safeguards Rules are an “unfair or deceptive act or practice” in violation of the FTC Act –Privacy Rule mainly concerns drafting and delivery of “Privacy Notices” to consumers –Safeguards Rule mainly concerns security protection for NPI

40. In re NATIONWIDE MTGE GRP, INC. –FTC complaint alleged Nationwide and its owner collected NPI and failed to protect it –Violation of Privacy Rule is an unfair and deceptive practice under the FTC Act –Violation of Safeguards Rule is an unfair and deceptive practice under the FTC Act

41. In re NATIONWIDE MTGE GRP, INC. Security Rule settlement requirements: –Assign employee(s) to oversee program; –Conduct a risk assessment; –Put safeguards in place to control the risks identified and regularly test them; –Require service providers, by written contract, to protect NPI; and –Periodically update its security program

42. In re NATIONWIDE MTGE GRP, INC. Additional requirements: –Nationwide must obtain an assessment on its safeguards from a qualified, independent third-party –Must use industry procedures and standards –biennially for ten (10) years

43. Guin v. Brazos Higher Education Service Corp., Inc. NO duty under GLB to encrypt; Brazos acted with “reasonable care” Laptop containing unencrypted NPI stolen from employee’s home office Guin alleged Brazos’ failure to encrypt violated duty under GLB Act to protect security and confidentiality of NPI

44. 2006 NCHELP FALL TRAINING CONFERENCE Questions? Dino Tsibouris dino@tsibouris.com