HB1623 - An Act Relative to the Disclosure of Customer Financial Information by Financial Institutions

April 6, 2000

Presented by Christopher C. Gallagher*
Testimony before the New Hampshire General Court House Commerce Committee

Good morning Mr. Chairman and members of the Committee. I appreciate the opportunity to testify this morning. For the record, my name is Christopher C. Gallagher. I am an attorney with the Concord law firm of Gallagher, Callahan & Gartrell, and this morning I am here representing the New Hampshire Bankers Association, for which I am General Counsel. I am also representing Fidelity Investments, from whom your Committee has received a separate letter in opposition to the bill.

HB 1623 represents an effort to add new duties and procedures to the nationwide implementation of the substantial and comprehensive provisions of Title V of the Gramm-Leach-Bliley Act (GLBA), Subtitle A relating to Disclosure of Nonpublic Personal Information. In order to comprehend the effects of HB 1623, it is necessary to understand the provisions of the federal Title V, its inevitable impact on consumer awareness, its new privacy protections, which expand consumer choice relative to financial services provider uses of their personal information, and its regulatory burden on providers of financial services. With respect to each of these issues, such impact will be enormous. This impact in turn will affect the availability, the access and the cost of financial services nationwide. Title V will change the highly competitive financial services marketplace forever. Enacting HB 1623 adds elements that will impose more burdens, more costs and less consumer choice, without any significant benefit to those who are now concerned about the confidentiality of their own financial information. Moreover, HB 1623 will have a decidedly negative impact on N.H. financial providers and on our state's economy. All of this will occur without any substantial benefit to individual consumers who are concerned with the privacy of their financial information.

This is not an overstatement. As everyone on this Committee knows, today's information revolution is driven by new technologies evolving at warp speed. Because of their economic efficiencies, this evolution will not relent. It will continue even though its many benefits are presently associated with feelings we all have, in varying degrees, about the implications of new access to personal information about ourselves, that until recently has been kept confidential because before the new technology arrived, no one would, or even could, gather, process and utilize data now readily available about each of us. We are also sharing such information more as we deal on-line and at a distance with retailers and others who need identifiable information about us in exchange for the convenience and choice afforded to all of us by the process.

Convenience, choice, cost savings and the business model of the Internet itself tell us there is no turning back. But privacy issues, the product of a conflict between the fast-moving information age and slower-moving human evolution, will continue to concern us. And while medical and sexually-based information may be much more serious, financial information is important. Accordingly, people will complain, lawmakers will respond, and when they do, we can only hope that their statutory mandates do not restrict the free flow of information needed to support the new economy, or worse, restrict its growth and development. We also implore you not to add unreasonably to the regulatory burden Title V has already imposed on our industry.

Again, I do not over emphasize. The bill before you today has the power to significantly harm our state's economy, by driving out state-chartered banks and domestic insurers and by cutting off our own consumers from access to services offered from outside N.H. No one knows at present the operational impact of HB 1623's customer pre-approval on the competitive evolution of the financial services or any other industry. "Opt-in" is just another form of choice, a choice that will be made in any format by those who would opt-out anyway. For the rest of us privacy pragmatists, so called, who seek a balance between the costs and benefits of the information economy, it hobbles business, raises costs and interferes substantially with the benefits and business model driving the new economy.

First, however, let's review how GLBA as proposed is supposed to work. Subtitle A of Title V of the Act limits the circumstances in which a financial institution may disclose to others, nonpublic information collected in the context of interaction with its customers. Such information cannot be shared, except among affiliates, unless the customer (or prospective customer) has been given a reasonable opportunity to "opt-out" of such sharing. These new privacy protection Rules apply only to information about individuals who obtain products and services to be used for personal, family or household purposes. Covered institutions include all providers of such financial services and products, businesses well-beyond traditional banks, insurance and securities dealers, including all financing companies, travel agents and many consultants and retailers. Beyond its "opt-out" provisions, the Act requires notice when a customer relationship begins and annual written notice thereafter to each customer of any provider, of that provider's policies and practices regarding privacy, security and information sharing. Those notices are scheduled to be sent in late November of this year; some 500 million of them, and are guaranteed to be effective if what is sought is heightened awareness, choice and consumer control over personal financially-related information.

Standards for security are not yet drafted. Regulations are in the comment stage. Fair Credit Reporting Act (FCRA) regulations needed to blend FCRA with GLBA are not yet on the drawing boards. We have brought with us for your review what proposed rules there are, the Act itself and Title V, Subtitle A, so that you might have an opportunity to see them. You can see for yourselves that this is a weighty, complex and cumbersome process. For your convenience, they can all be accessed on our web site, www.gcglaw.com.

We believe that GLBA will both address, and prompt the market to effectively address, the concerns raised in HB 1623. We believe that it will do the job. Though enabled by GLBA, state government intervention is costly, cumbersome, premature, and will only serve to confuse the customer. We also assure you that we have all we can do right now to comply with GLBA's approaching deadlines. That "we" includes the regulators as well as the industry. To ask for more, before we have even begun to comply with what has just become the law but is not yet effective, is not good public policy. It will harm N.H. business and will interfere with the process of elevating consumer awareness. The GLBA process now beginning will provide adequate control over sensitive consumer information and will implement procedures designed to establish the five fair information practices agreed to by all who follow this issue closely.

(Review each and its existence in laws now on the books.)

Notice

Choice

Access

Security

Enforcement

Allow me to raise a few of the issues presented by this bill.

It is very late in the Session for this Legislature to deal with its complexities.
GLBA regulation will not be completed until late spring. Regulators (including our N.H. Dept. of Insurance (DOI)) have not yet begun to draft security standards required by the Act. The FCRA regulations called for are not yet drafted.
If this bill passes it will be the test case for the entire USA and will move us into the Federal Trade Commission and the courts for years to come.
If this bill passes, DOI is sure to lose more domestic insurance companies. Banks of every size and stripe are likely not just to convert to national charters, but to leave N.H.
Out-of-state financial service providers will bypass N.H., limiting New Hampshire citizen choice, convenience and access to competitive financial products and services.
Today's wide availability of credit and the portability of credit are made possible by the collection and use of information. This system works because we all participate in it and it is reliable. It depends as much upon the free flow of public record information as it does the full and complete reporting of financial institutions to credit reporting services.
"Opt-in" raises costs and narrows choice for all, while giving nothing to those who "want out" of the information flow. GLBA's "opt-out" protects them.
"Opt-in" is a significant barrier to the free flow of information because it raises costs, reduces access to customers and leaves out entirely the apathetic among us.
"Opt-in" can cripple the business models of the new economy, web content is paid for by advertising. Moreover it requires actual approval — in contract form — of all adjustments in any company's information strategies and business plans.
Preemptive triggers and legal wrangles about the effect HB 1623, as it relates to FCRA and GLBA, will result in another significant lawsuit, taking years. See memos attached.
By isolating itself from the rest of the nation, N.H. will jeopardize the so-called "New Hampshire Advantage" by telling business that New Hampshire is a financial services island with an unbalanced and uninformed view of the new economy and its operational systems.
In addition to enhancing the availability of credit, information sharing has enabled the industry to develop very sophisticated neural networks to identify and stop fraud. Losses due to fraud have dramatically decreased over the past several years.

There are ways to approach all of this. GLBA has required a federal level study of the issues raised by HB 1623. If the state wants to do its own study, it can. The policy issues are considerable. Informed opinion must precede piling more statutory mandates on top of those that already have been set in motion nationally.

The recent FDIC panel on the subject, including my participation and that of all of the regulators now wrestling with these issues and GLBA, is available on our web site at www.gcglaw.com.

(Comment on these policy approaches)

An Arm's Race between consumers and providers will not work.

Self-Regulation

The Courts

Statutory

Markets

Bills similar to HB 1623 have been proposed by privacy activists everywhere. It is difficult to divine the motives behind those bills because in almost all cases they do not change the protections offered to those who wish to utilize them.

This bill, HB 1623, has some peculiar wrinkles.

Page 1, line 4 establishes a privacy right
Page 2 at line 25 introduces the functions of a mercantile agency, moving the bill's rights and duties to business. Even FCRA and GLBA don't address commercial privacy practices regarding information exchanges with the likes of Dunn and Bradstreet. Generally, business is presumed able to fend for itself.
Note on Page 2 at line 37 the astonishing prohibition on the formation of any business that actually trades in voluntarily provided information! This telling insertion elevates the suspicions of those who wonder what this bill is aimed at, and why it is being offered now. But in any case, for this state to pass a law that would prohibit a business from being formed to provide some tangible benefit in exchange for personal information by forbidding insistence on supplying it is quite remarkable and by itself enough reason to ITL this bill.
At Page 5, line 8, this bill requires that entities to whom the authorizations under opt-in would apply must be named. Run that scenario through a test of practical reality. Who would I name before I get permission? How could I run my business if I had to name my prospective partners and get customer approval in publicly disseminated documents? How easily could I change partners and how much would the cost of that change be built into the partners' cost for the services provided?
Last but not least is the surprising provision of rulemaking powers to the bank commissioner alone, when the prime state regulator under GLBA is DOI.
I would add that to have any definition of financial services or of financial services providers that differs from GLBA in any way whatever is an invitation to compliance chaos and consumer confusion. Page 2, line 19 differs from GLBA. Page 2, lines 3-18, financial information, differs from GLBA. In fact most relevant definitions differ from GLBA.

New Hampshire is properly proud of its prominence in the new economy. Its continued prosperity depends upon maintaining that edge. Every single candidate for governor has emphasized the importance of that single issue. Defeating the bill will not move us any further in that regard. Passing it will move us back — and move us back considerably. If anyone says differently, ask them if they have read and understood how FCRA, GLBA and HB 1623 fit together. Appendices attached delve into the legal thicket these matters present. Ask them how the "opt-out" provisions in those bills fail to protect them personally — because they do. Ask them if they know this bill will be an intrusion by our state government into the business model of the new economy itself; an intrusion that should not be directed for emotional reasons tied to issues like predatory practices and identity theft. These issues are not addressed by this bill.

These issues that are addressed by the bill are serious; we acknowledge that. They are not frivolous. They call for you to address them carefully, in deliberate study and with the benefits of GLBA, and its yet unenacted regulations and unstudied studies, behind us, rather than a future unknown.

Pushing this late bill through this session, stressed as it is by weightier issues, fails to do the public justice and fails to give this issue the respect that it deserves. Give the statutes and the markets a chance to work. Of all the ways to deal with this sensitive issue, overkill is the worst.

Speaking for myself, the New Hampshire Bankers Association and for Fidelity, I urge you not to pass this bill.

Appendix A: Domestic Insurers Under HB 1623

Appendix B: FCRA AND HB 1623

*Christopher C. Gallagher is admitted in New Hampshire.

Return to top of page

Return to HOT TOPIC: PRIVACY
Return to Financial Services Articles
Return to Firm Publications