United States: Federal Regulators Issue Report on Improving Financial Privacy Notices for Consumers
(Special Edition - Financial Services Alert)

The FRB, FDIC, OCC, NCUA, FTC and SEC (collectively, the "Federal Regulators") issued a report entitled Evolution of a Prototype Financial Privacy Notice (the "Report"). The Report concludes the first phase of an interagency project commissioned by the Federal Regulators on privacy notices issued by financial institutions, and the ability of consumers to read and understand them. The Report is available at: http://www.ftc.gov/privacy/privacyinitiatives/ftcfinalreport060228.pdf.

The Gramm-Leach Bliley Act (the "GLBA") introduced into law provisions that require financial institutions to provide their consumers with initial and annual notices of their privacy policies and practices. The GLBA further requires that the notices be clear, conspicuous and accurate statements of the financial institution’s privacy practices, and that they provide a means for consumers to opt out of certain information-sharing practices of the financial institution. Finally, the GLBA requires financial institutions to describe how they collect, share and protect consumers’ personal information. However, since the requirements went into effect, government research has indicated that the privacy notices being produced by financial institutions have been too lengthy and dense in content, and that they contain too much complex language.

In response to these findings, the Federal Regulators initiated a multi-phase project to explore the development of a prototype financial privacy notice that would be easier for consumers to understand and use. For phase one of the project, the Federal Regulators commissioned Kleimann Communication Group to explore quantitative reasons why consumers may not read nor understand privacy notices and, more importantly, to design an alternative paper-based privacy notice that would be easier for consumers to understand and use. The Report presents and discusses a prototype privacy notice which purports to meet these objectives, and discusses the research and methodology used in creating this prototype.

The nexus of the Report is that financial privacy notices can be written to include all of the information required by the GLBA in a short document that is understandable to consumers. The goal of the project was to create a financial information privacy notice prototype that:

Complies, both in content and design, with the notice requirements of GLBA and the affiliate marketing provisions of the Fair and Accurate Credit Transactions Act;

Attracts consumers’ attention, while at the same time using only objective and factual language;

Enables consumers to comprehend the basic concepts behind the privacy notices and understand how to use them;

Allows consumers to compare the information sharing practices across financial institutions; and

Enables consumers to understand how to opt out of certain information sharing policies of their financial institutions.

In proposing a privacy notice prototype that meets these requirements, the Report highlights several conclusions that were arrived at during the study. The themes of these conclusions were as follows:

Simplicity. The Report concluded that consumers tend to become easily overwhelmed by complex information, too many words or vague words and phrases. The simplification of financial privacy notices enhances consumers’ ability to understand the notices and make informed choices. Simplification includes: (i) stripping away redundancies; (ii) reducing the number of words used; (iii) using simpler words; and (iv) clarifying meaning and providing key context information up front. At the same time, the Report stressed the need not to oversimplify or strip away necessary contextual information.

Emphasis on design. The Report emphasized that consumers more readily understand important information when good design reinforces the content. For instance, creating notices in a tabular format improves consumers’ ability to read, understand, and use the information presented to them. It furthermore allows consumers to more easily compare the information-sharing practices of different financial institutions. The Report concluded that tabular design is far more effective than prose structure to help consumers understand and compare sharing policies. The use of headings, white space, bold text, bulleted lists, larger font size, and full size paper was also found to make the information more inviting and easier to read.

Neutral/Objective Language. The Report stressed that consumers need to be informed about privacy laws and information sharing practices in a factual and neutral way. Language should not direct a consumer to make any particular decision. The drafters should eschew inflammatory language or ‘marketing’ techniques.

"Whole-to-Part Design." The Report further stressed that the information provided in financial privacy notices needs to be contextualized in order for consumers to be able to understand it. While consumers may have a general awareness of information sharing practices, most consumers do not understand them. Consumers need a context for understanding the information in the notice, including context about financial sharing laws and personal information.

Standardization. The Report noted that standardization of form and content helps consumers recognize the notice and the information in it. It also enabled consumers to easily spot differences in policies by different financial institutions.

The prototype privacy notice, which is published and explained in detail in the Report, contains four primary components:

The Title: The title is designed to attract consumers’ attention and enable them to understand that the notice is from their bank, and that their personal information is currently being used by their bank.

The Frame: The frame provides the basis for ensuring consumer comprehension. It provides basic information about financial sharing practices as a background to assist consumers in evaluating their own bank’s sharing practices. The Report concluded that consumers were relatively uninformed about financial privacy and that they needed basic information to comprehend the disclosures that a GLBA notice is intended to convey.

The Disclosure Table: The prototype’s disclosure table discloses the sharing practices of the consumer’s financial institution and the seven basic reasons why any financial institution can share information. The Disclosure Table was described by the Report as the ‘heart’ of the prototype, as it shows consumers how their personal information might be shared, how their particular bank shares such information and what information sharing they can limit. The Report emphasized the Disclosure Table’s simple, concise and highly visual design as key to enabling consumers to understand the information presented without undue burden.

The Opt-Out Form: The Opt-Out Form allows consumers to limit the sharing of certain information by their financial institution.

The second phase of the project, which will be contracted out by the Federal Regulators separately, will involve a quantitative study and assessment of the Report’s prototype policy notice.

The principal authors of this Alert are Agnes Bundy Scanlan and Jeremy Estabrooks.

Goodwin Procter LLP is one of the nation's leading law firms, with a team of 700 attorneys and offices in Boston, Los Angeles, New York, San Diego, San Francisco and Washington, D.C. The firm combines in-depth legal knowledge with practical business experience to deliver innovative solutions to complex legal problems. We provide litigation, corporate law and real estate services to clients ranging from start-up companies to Fortune 500 multinationals, with a focus on matters involving private equity, technology companies, real estate capital markets, financial services, intellectual property and products liability.