Federal Trade Commission: Privacy of Consumer Financial Information
Highlights
Pursuant to a legislative requirement, GAO reviewed the Federal Trade Commission's (FTC) major rule on the privacy of consumer financial information. GAO noted that: (1) the final rule implements notice requirements and restrictions on a financial institution's ability to disclose nonpublic personal information about consumers to nonaffiliated third parties; (2) the final rule prohibits a financial institution from disclosing such information to nonaffiliated third parties unless the institution satisfies various notice and opt-out requirements and the consumer has not elected to opt out of the disclosure; (3) statutory law requires institutions to provide its customers with a notice of its privacy policies and practices; and (4) FTC complied with applicable requirements in promulgating the rule.
Federal Trade Commission: Privacy of Consumer Financial Information, OGC-00-40, June 23, 2000
The Honorable John McCain
Chairman
The Honorable Ernest F. Hollings
Ranking Minority Member
Committee on Commerce, Science, and Transportation
United States Senate
The Honorable James A. Leach
Chairman
The Honorable John J. LaFalce
Ranking Minority Member
Committee on Banking and Financial Services
House of Representatives
Pursuant to section 801(a)(2)(A) of title 5, United States Code, this is our report on a major rule promulgated by the Federal Trade Commission (FTC), entitled "Privacy of Consumer Financial Information" (16 CFR Part 313). We received the rule on June 16, 2000. It was published in the Federal Register as a final rule on May 24, 2000. 65 Fed. Reg. 33646.
The final rule is issued pursuant to section 504 of the Gramm-Leach-Bliley Act (G-L-B Act) and implements notice requirements and restrictions on a financial institution's ability to disclose nonpublic personal information about consumers to nonaffiliated third parties. The rule also implements section 502, which prohibits a financial institution from disclosing such information to nonaffiliated third parties unless the institution satisfies various notice and opt-out requirements and the consumer has not elected to opt out of the disclosure. Finally, section 503 requires institutions to provide its customers with a notice of its privacy policies and practices.
Enclosed is our assessment of the FTC's compliance with the procedural steps required by section 801(a)(1)(B)(i) through (iv) of title 5 with respect to the rule. Our review indicates that the FTC complied with the applicable requirements.
If you have any questions about this report, please contact James W. Vickers, Assistant General Counsel, at (202) 512-8210. The official responsible for GAO evaluation work relating to the subject matter of the rule is Thomas McCool, Director, Financial Institutions and Markets Issues. Mr. McCool can be reached at (202) 512-8678.
Robert P. Murphy
General Counsel
Enclosure
ENCLOSURE
ANALYSIS UNDER 5 U.S.C. 801(a)(1)(B)(i)-(iv) OF A MAJOR RULE
ISSUED BY THE
FEDERAL TRADE COMMISSION
ENTITLED
"PRIVACY OF CONSUMER FINANCIAL INFORMATION"
(16 CFR PART 313)
(i) Cost-benefit analysis
The FTC considered the costs and benefits of the final rule in conjunction with its Regulatory Flexibility Analysis and the burden estimates for its Paperwork Reduction Act submission. It appears that the major costs will be associated with the paperwork burdens of the various notices required by the G-L-B Act which the FTC estimates to be 4.03 million hours annually at an average annual cost of $87.3 million.
(ii) Agency actions relevant to the Regulatory Flexibility Act, 5 U.S.C. 603-605, 607, and 609
The FTC prepared an Initial Regulatory Flexibility Analysis and a Final Regulatory Flexibility Analysis. The analyses comply with the requirements of the Act. The FTC notes that the G-L-B Act does not permit exempting small entities from the requirements of the Act.
(iii) Agency actions relevant to sections 202-205 of the Unfunded Mandates Reform Act of 1995, 2 U.S.C. 1532-1535
The rule, promulgated by an independent regulatory agency, is not subject to title II of the Act.
(iv) Other relevant information or requirements under acts and executive orders
Administrative Procedure Act, 5 U.S.C. 551 et seq.
The final rule was issued using the notice and comment procedures contained at 5 U.S.C. 553.
On March 1, 2000, the FTC published in the Federal Register a Notice of Proposed Rulemaking. 65 Fed. Reg. 11174. A total of 640 comments were received in response to the notice and are responded to in the preamble to the final rule.
Paperwork Reduction Act, 44 U.S.C. 3501-3520
The final rule contains an information collection that has been reviewed and approved by the Office of Management and Budget. It has been assigned OMB Control No. 3084-0121.
Statutory authorization for the rule
The final rule is issued under authority of 15 U.S.C. 6801 et seq. and section 504 of the Gramm-Leach-Bliley Act (Pub. L. 106-102, Nov. 12, 1999).
Executive Order No. 12866
As an independent regulatory agency, rules promulgated by the FTC are not subject to review under the order.