Notification Is Just The Tip Of The Privacy Iceberg

The affiliates and non-affiliates with which the institution shares the information.

The internal controls in place for the security and confidentiality of the information.

Gudmundsen declared that it is not enough to write a privacy policy and to send out notices about it. When consumers choose to opt out, the financial institution needs a "back-end table" showing which consumers do not want their information disclosed, he stated.

Marema indicated that the GLB opt-out provision is the issue on which the Alliance receives the most inquiries from its members. She specified that insurance companies are asking "a lot of practical questions," such as how they are to administer an opt-out program, whether they need to provide an 800 telephone number for opting out, whether customers can opt out by e-mail or whether to offer a combination of these services.

Other insurer concerns cited by Marema included whether an opt-out by one insured triggers an opt-out for the entire family covered by the policy and whether a company's opt-out should apply to its entire holding group.

Sinder cautioned that "every privacy policy is like a contract." Therefore, he advised insurers with various business units to have as few privacy policies as possible.

Gudmundsen pointed out that Section 13 of GLB provides exceptions to the opt-out requirement. This exemption covers joint marketing agreements between two financial services companies that offer a financial product, even if the companies are not affiliated, he said, adding that the exception also applies to joint service-provider agreements.

Sinder suggested that the Section 13 exception creates a potential loophole by allowing financial services institutions to enter into joint marketing agreements to circumvent the opt-out provision.

He added that GLB "will not be the last word" on privacy. He predicted that, because of an amendment to GLB allowing the states to exceed federal law in developing privacy rules, financial institutions "will be the first ones back" asking federal lawmakers "for a fix to the mosaic of state laws."

Drawing a distinction between privacy and security, Loesch said that under GLB, "the parameters [for security] are not as finely defined as they are for the type of information that must be protected." He noted that technological standards are constantly evolving, as are best practices. McGlynn added that this flux makes compliance "a moving target."

Loesch also stated, "We have to think of security in two contexts: transfer and storage."

Gudmundsen also observed that there is internal security and external security. He said that his employer has state-of-the-art internal security systems, including encryption, authorization, physical safeguards and authentication. In terms of external security, the company must now keep track of information it shares with third parties, he said.

"We have the obligation to do a risk assessment of all of our partners [and vendors] to determine how safe and secure the information is with them," he said. Moreover, he said his employer must do preliminary due diligence on those partners and have contractual provisions in place obligating the partners to treat the information safely, securely and only for the purposes for which it was given to them.

Finally, and "most nebulous" of all, under GLB his employer must monitor the partners' use of the information. He pointed out that GLB does not define "monitor." However, the statute does indicate that the company should refer back to the risk assessment and determine, on the basis of several factors, what its monitoring obligations are.

He also believes that regulators will be looking into a company's training programs. "You have to tell every one of your employees how important the privacy of customer information is and what their role is in protecting that privacy," he stated. He added that July 1 "is just the beginning." There needs to be a "constant retraining," he said.

Marema acknowledged that "there is no cookie-cutter approach" to privacy notification. Although the Alliance and other groups have developed notification forms for members, forms must be tailored to reflect a particular institution's practices, she said.

How a financial services company uses information will become a competitive advantage, McGlynn forecasted. In other words, consumers will gauge a company's trustworthiness by looking at whether the company keeps its word about not disclosing customer information, he said.

He also believes brokers and agents will look for insurance companies "that will assist them in providing a safe environment"that can provide "conduits for the safe transmission of data" about policyholders.

"Do your privacy compliance right the first time," Marema said, addressing all those concerned. Otherwise, that failure to comply will generate even more regulation, most likely at the federal level, she warned.

Colorado Commissioner, Kirven, advised that those who collect information should be "slow to share" it until they can be sure that they are in compliance with the law.

E.E. Mazier is a staff writer for NU's Property & Casualty/Risk & Benefits Management Edition.

Reproduced from National Underwriter Life & Health/Financial Services Edition, June 11, 2001. Copyright 2001 by The National Underwriter Company in the serial publication. All rights reserved.Copyright in this article as an independent work may be held by the author.

Copyright 2001 by The National Underwriter Company. All rights reserved. Contact Webmaster