SEC Adopts Privacy Rules for Financial Institutions

Under the Gramm-Leach-Bliley Act, the SEC adopted Regulation S-P, which details how and when a broker-dealer, fund or registered adviser may disclose nonpublic personal information about its customers. The rule is intended to inform consumers about the third parties with which a financial institution shares information, as well as the types of information that is shared.

Under Regulation S-P, which is effective November 13, broker-dealers, funds and registered advisers must provide initial and annual notices to customers about their privacy policies. In addition, they must give the client an opportunity to "opt out" and not have the information revealed. The SEC has modified the rule in consideration of the 115 comment letters it received, 20 of which were from various members of the financial community.

In a supportive letter, the Nat'l. Ass'n. of Insurance Commissioners asked the agency to spell out whether the federal or state governments have jurisdiction over the privacy regulations. The SEC said it believes that under the Act, the states are responsible for the regulation of any insurance activities conducted by broker-dealers, funds or registered advisers. However, if the insurance provided is a security, the activity is covered by Regulation S-P. Insurance company separate accounts that are "investment companies" under the Investment Company Act also are subject to the regulation.

The SEC revised the rule to clarify that the initial notice must be given not later than when a financial institution establishes a customer relationship. The SEC suggests that broker-dealers, funds or advisers provide the initial notice at the same time they are required to disclose other items such as the credit terms in margin transactions. Under certain circumstances, the final rule allows a "short-form" initial notice.

At least once during every 12-month period, Regulation S-P requires that an institution provide a "clear and conspicuous" notice on its privacy policies. Although several commenters suggested that a financial institution should provide the annual notice upon request, especially if the information in the notice hasn't changed, the SEC adopted this section as proposed. However, the SEC has revised the disclosure provisions so that broker-dealers, funds or advisers are not required to provide a lengthy and detailed notice.

The rule also permits a broker-dealer, fund or adviser to provide annual notices to customers over the institution's Web site if the customer conducts transactions electronically. A few commenters asked that institutions also be allowed to post the initial notice on their Web sites, but the SEC believes that this would not be sufficient.

Before any information is revealed to nonaffiliated third parties, the consumer's right to opt out must be accurately explained. The SEC adopted an exception to the opt out requirements for service providers and joint marketing. The exception provides that institutions are permitted to share information with a nonaffiliated third party without providing the consumer a right to opt out if the third party is to perform services for the financial institution, such as marketing the institution's own products and services offered under a joint agreement. The SEC noted, however, that the financial institution must enter into a contract with the third party guaranteeing that the confidentiality of the information will be maintained.

After many in the securities industry asked for more flexibility, the SEC adopted a final rule that permits two or more financial institutions to provide a joint notice as long as the notice is correct with respect to each institution. For example, a clearing broker could provide a joint notice with an introducing broker for which it clears transactions or a fund complex could provide a joint notice for all of the funds in the complex. n