Disclaimer This Presentation is provided “as is” without any express or implied warranty. This Presentation is for educational purposes only and does not constitute legal advice. If you require legal advice, you should consult with an attorney.

“Administration Perspectives on Financial & Other Privacy Protection”

Overview Administration Privacy Policy Financial Privacy Last Year New Financial Privacy Proposal

I. Administration Privacy Policy Support self-regulation generally Sensitive categories deserve legal protection Medical & Genetic Financial Children’s Online Government should lead by example

Internet Privacy Quantity of policies  15% to 66% from 1998 to 1999 Quality of policies  Seek fair information practices Government  All federal agencies with clearly posted policies since 1999

Medical Records Privacy HIPAA 1996 called for legislation by 8/99 President announced proposed regs 10/99 Over 53,000 submissions of comments SOTU promise to make the regs final this year

Medical Records (cont.) Applies only to “covered entities”  Providers  Plans  Clearinghouses For other entities:  Codes of conduct, including DMA code  Proposal in President’s new bill

Genetic Discrimination February 8 Executive Order  Prohibits federal agencies from using genetic information in hiring or promotion Call for legislation  Daschle/Slaughter bills  Extend protections to private sector  Apply to purchase of health insurance

Children’s Online Privacy Children’s Online Privacy Protection Act of 1998 FTC rules took effect 4/2000 Rules praised by industry and advocates Key is “verifiable parental consent”

Government-held Information Government to lead by example -- clear policies at all agency web sites Improve government computer security -- reduces unauthorized access to files With Federal CIO Council, develop “privacy impact assessments” for new IT systems

II. Financial Privacy to Date Events last year Financial Modernization as Enacted

Events last year Few privacy provisions in original Senate or House Banking bill May 4 Presidential announcement on financial privacy  Included choice for 3d parties and affiliates 5/99 House Commerce markup  Included choice for 3d parties and affiliates

Events last year (cont.) 6/99 House passage of financial modernization  Similar to final bill 10/99 Presidential signing  Asked Treasury, OMB, and NEC to prepare additional legislation  Called for “meaningful choice” within holding companies

Financial Modernization Act Notice for 3d parties and affiliates Opt out choice for 3d parties only  Joint marketing exception Significant enforcement provisions  Full bank supervision and enforcement Rulemaking

III. The Clinton-Gore Financial Privacy Proposal April 30 announcement Overview:  Opt out choice for affiliates  Opt in for special categories Medical Personal spending habits  Access and correction

Overview (cont.) Overview:  Enforcement enhancement  Fill other gaps  Bankruptcy study Goal of balance: protect privacy and facilitate economically important activities

Opt-out as basic rule President previously promised “meaningful choice” within financial holding companies Opt-out for affiliates  Modern FHC of bank, insurer, broker, travel agency, many other affiliates  Should the price of opening a checking account be that those details go to all those affiliates?

Opt-out (continued) Opt out subject to exceptions of 502(e)  Goal of allowing sensible business activities to go forward -- information available to accountants, lawyers, etc. New exception for customer service  In order to facilitate customer services, such as maintenance and operation of consolidated customer call centers or the use of consolidated customer account statements.

Opt in for medical records For HIPAA-covered entities, HIPAA applies Basic rule of opt-in for sharing of medical data by entities in FHC Rule that no sharing of medical data from entity in FHC unless the same medical data is required of all customers

Opt in for personal spending habits For checks, credit & debit cards & similar instruments (“every purchase you have ever made”) Opt in for an individualized list of that consumer’s transactions or an individualized description of that consumer’s interests, preferences, or other characteristics

Personal spending habits Opt in for any such list or description constructed in response to an inquiry about a specific, named individual Exception for the transfer of aggregate lists of consumers Rationale: especially sensitive gets opt in, marketing lists get opt out as in other settings

Access & correction Access & correction for information under the control of, and reasonably available to, the financial institution Exceptions:  Confidential commercial information  No need to create new records  Subject to reasonable fee

Enforcement Under current law, greater enforcement authority for banking and other traditional financial regulators For financial institutions regulated by the FTC, add state AG enforcement authority Provide FTC with the monetary penalties it has under other consumer laws

Other provisions Provide notice to allow comparison shopping, and not just at loan closing FTC gets same rulemaking authority under FCRA as banking agencies Bankruptcy study this year by OMB, DOJ, & Treasury  Put bank account numbers on the Internet?  Federal example of privacy & public records

Concluding Remarks Proposal as completing the unfinished business from financial modernization Seeks balance, achieving both privacy protection and facilitating desirable economic activity Identifies especially sensitive categories of information for more careful protection

Concluding remarks President Clinton, April 30, 2000: “Today, I’d like to ask you to think about the challenge to our financial privacy coming out of the Information Revolution. We are moving from cash to electronic transactions. A bank is no longer just a bank, it’s often linked with an insurance firm, a broker, a travel agency...

Concluding remarks (cont…) “… All this helps to give us added convenience, lower prices, and more choices. But it’s also forcing us to redefine financial privacy for the Information Age and to rewrite the rules that go with it.” Let’s work together to write rules that make sense