HB1623 - Testimony

Appendix B

April 6, 2000

Presented by Christopher C. Gallagher*
Testimony before the New Hampshire General Court House Commerce Committee

FCRA AND HB 1623

FCRA allows a financial institution (person) who has transactions or experiences with a consumer to share information relating to such matter with anyone without obtaining the permission of the consumer.1 GLBA allows a person to share Non-Public Personal Information (NPPI) which related transactions or experiences with a consumer with nonaffiliated third parties (NTPs) only after the consumer is given a clear and conspicuous notice of a company's information sharing policy and is given the opportunity to opt-out. It is not yet clear (and will no doubt be the subject of court review) how GLBA's NPPI and FCRA's transaction and experience information fit together.2 GLBA's express reservation in Section 506(c) that no inference may be drawn from GLBA as to whether NPPI may be deemed to be transaction or experience information under FRCA introduces uncertainty, but presumably transaction and experience information may continue to be shared with NTPs so long as GLBA's notice and opt-out provisions are followed.3 FCRA authorizations, however, will preempt inconsistent state restrictions.4 When FCRA is applied to state schemes that go beyond GLBA's notice and opt-out provisions, those state schemes are preempted to the extent they are inconsistent. Where FCRA is clear, the preemptions will be as well. Any such clear preemptions, therefore, will preempt inconsistent provisions of state legislation like HB 1623.

FCRA covers three types of personal information: "transactional" information, "experience" information and "other" information. If HB 1623 were enacted,5 it would be nullified in part because of the applicability of FCRA's state preemption provisions (effective until Jan. 1, 2004) on state level requirements that exceed those prescribed by GLBA (and survive the test of FCRA and GLBA juxtaposition). Without a severance clause, the entire law could be nullified because of this partial preemption.

Unlike the sharing of experience and transaction information, FCRA provides for an opt-out procedure prior to the sharing of "other" information with affiliates.6 Affiliate sharing of "other" information in the context of FCRA requires a clear and conspicuous opt-out. This is more stringent than the GLBA's exemption which allows sharing such information with affiliates without opt-out. In FCRA situations, therefore, the FCRA opt-out is likely to apply, even though GLBA doesn't demand it. That conflict will also be tested in court. But in situations where state provisions are applied beyond GLBA's and FCRA's combined, such as opt-in, the FCRA preemptions will no doubt prevail. In fact, FCRA expressly provides in Section 624(b)(2) that no state may impose any requirement or prohibition with respect to the exchange of information among persons affiliated by common ownership control until January 1, 2004. Even then, such requirements or prohibitions may not be inconsistent with FRCA. Thus, notwithstanding HB 1623's provisions to the contrary, affiliated company information sharing will be controlled by FCRA's opt-out until January 1, 2004.7

The sharing of transaction or experience information with anyone must first pass muster under GLBA and FCRA. It then must be scrutinized under HB 1623. If HB 1623 applies to any information sharing conduct not shielded by FCRA, that conduct would have to be preceded by an "opt-in" process. Presumably and ironically, "opt-out" would apply in the case of affiliate sharing of "other information." But even in that particular circumstance, large financial conglomerates have been given an advantage. The joint marketing provisions protecting smaller institutions in GLBA are not referred to in FCRA, and thus FCRA requirements would likely not apply. Smaller institutions would thus be saddled under HB 1623 with "opt-in" requirements, and accordingly would be forced to compete at an economic and operative disadvantage with larger institutions.

This discriminatory impact would affect virtually all of New Hampshire's smaller financial institutions, including especially its smaller domestic insurers. The delayed and confused implementation of HB 1623's most significant provisions would cause uncertainty, paralysis and likely, an exodus of financial institutions from New Hampshire. In the meanwhile, the state would have to bear the costs of FTC proceedings, court review and loss of assessment revenues as domestic financial service providers flee to other states where the onerous compliance required by GLBA has put "enough on their plates," without the additional clutter of HB 1623.

*Christopher C. Gallagher is admitted in New Hampshire.

Notes

1. New Hampshire's Fair Credit Reporting Act is consistent with FCRA in this respect. See RSA 359-B:3,IV.

2. GLBA, Section 502(e)(6)(A) preserves experience and transaction information as defined in FCRA. See also Section 506(c). GLBA, Section 506(a) provides for banking agencies to "jointly prescribe" FCRA regulations. Note that the Section is entitled Protection of Fair Credit Reporting Act. Banking regulations yet to be proposed may clear up some of these ambiguities, but it would appear that FTC will have the final say at the federal regulatory level.

3. GLBA, Section 502(e)(6)(A) preserves experience and transaction information as defined in FCRA. See also Section 506(c). GLBA, Section 506(a) provides for banking agencies to "jointly prescribe" FCRA regulations. Note that the Section is entitled Protection of Fair Credit Reporting Act. Banking regulations yet to be proposed may clear up some of these ambiguities, but it would appear that FTC will have the final say at the federal regulatory level.

4. Section 624(a).

5. Note that GLBA Section 507(b) gives vetting powers to the FTC, and that GLBA Section 508 calls for a federal study of many of the added "protective" devices.

6. Non-affiliates would not be provided with such information as a practical matter because by providing it, the provider would become a "credit reporting agency" under FCRA.

7. Since it can lead to credit reporting requirements, non-affiliated sharing of "other information" will be extremely risky, even if it is preceded by opt-in.

Appendix A: Domestic Insurers under HB1623

Return to Main Testimony

Return to top of page

Return to HOT TOPIC: PRIVACY
Return to Financial Services Articles
Return to Firm Publications