Appeals Court Upholds Financial Privacy Regulations

The United States Court of Appeals for the District of Columbia Circuit has affirmed a lower court decision upholding regulations enacted by the Federal Trade Commission and six other federal agencies to implement the privacy provisions of the Gramm-Leach-Bliley Act (GLBA).

In November 1999, Congress enacted the GLBA, which restricts financial institutions' ability to share consumers' nonpublic personal information with nonaffiliated third parties. The Act requires, with certain exceptions, that the financial institutions intending to sell or share such data notify consumers of their disclosure policies and give consumers the opportunity to "opt out" of disclosure of their data. The Act directed the FTC and six other federal agencies to develop implementing regulations. The FTC's regulations were proposed in March 2000, issued in their final form in May 2000, and took effect in November 2000, with full compliance required by July 2001.

On August 30, 2000, Trans Union sued the FTC and the other federal agencies to halt implementation of the regulations. In its suit, Trans Union, one of three major credit reporting agencies (CRAs), argued that the regulations unlawfully restrict a CRAs ability to disclose and reuse certain consumer information because: 1) a CRA is not a "financial institution" subject to the FTC's rulemaking authority under the GLBA; 2) the regulations' definition of the term "personally identifiable financial information" (PIFI) is overly broad; 3) the regulations' restrictions on reuse of information are inconsistent with the GLBA; and 4) the regulations infringe Trans Union's right of free speech under the First Amendment. The U.S. District Court for the District of Coumbia rejected Trans Union's challenge and upheld the regulations. Trans Union appealed. On July 16, 2002, a three-judge panel of the Court of Appeals unanimously affirmed the District Court opinion.

The Court held that the FTC permissibly construed the term "financial institution" to apply to CRAs and therefore had the authority to regulate CRAs under the GLBA. The Court rejected Trans Union's challenges to the agencies' definition of "personally identifiable financial information," which includes all information obtained by a financial institution about a consumer in connection with providing a financial service to that consumer. The Court concluded that the Commission has the authority to define PIFI under its "broad rulemaking authority." The Court rejected Trans Union's argument that credit header information, such as name, address, telephone and social security numbers, is not "financial" information and does not fall within the definition of "personally identifiable financial information," because any information requested by a financial institution in order to provide a financial service "can be fairly characterized" as financial information.

The Court rejected Trans Union's assertion that the GLBA allows it to reuse account numbers for marketing purposes, holding that the language in the Act that permitted CRAs to receive account numbers was intended to facilitate firm offers of credit or insurance under provisions of the Fair Credit Reporting Act, and not "the unfettered marketing use of an account number by a CRA."

Finally, the Court held that the agencies' privacy regulations do not violate the First Amendment guarantees of free speech. The Court concluded that Trans Union's dissemination of consumer information "warrants reduced constitutional protection," and that the privacy regulations were narrowly tailored to directly advance the substantial governmental interest in protecting consumer privacy.

Copies of the Order are available from the FTC's Web site at http://www.ftc.gov and also from the FTC's Consumer Response Center, Room 130, 600 Pennsylvania Avenue, N.W., Washington, D.C. 20580. The FTC works for the consumer to prevent fraudulent, deceptive and unfair business practices in the marketplace and to provide information to help consumers spot, stop, and avoid them. To file a complaint, or to get free information on any of 150 consumer topics, call toll-free, 1-877-FTC-HELP (1-877-382-4357), or use the complaint form at http://www.ftc.gov. The FTC enters Internet, telemarketing, identity theft and other fraud-related complaints into Consumer Sentinel, a secure, online database available to hundreds of civil and criminal law enforcement agencies in the U.S. and abroad.