September 9, 1998
Michael R. Novak
Vice President & Director of Retail Banking
Cohoes Savings Bank
Cohoes, New York 12047
Re: Section 603(d) of the Fair Credit Reporting Act
Dear Mr. Novak:
This responds to your request for a staff opinion concerning whether the Fair Credit Reporting Act ("FCRA") permits your bank ("the Bank") to share information about the Bank's customers with investment representatives ("IRs"). Based on your letter and our telephone conversation, it is my understanding that the relevant facts are as follows. From their desks in the Bank's lobbies, the IRs sell securities and insurance products created by a number of different entities. These entities have authorized a broker/dealer corporation ("the Broker"), which is not an affiliate of the Bank, to sell the products. The Broker leases the space in the Bank's locations where the IRs have their desks. The IRs sign agreements with the Broker. The Broker holds the IRs' securities and insurance licenses and is responsible for ensuring that the IRs comply with applicable securities and insurance laws.
The IRs' salaries and benefits are paid by a wholly-owned subsidiary of the Bank ("the Subsidiary"). As president of the Subsidiary (in addition to your role as vice president of the Bank), you interview the candidates for IR positions and decide which of them will be hired. The IRs sign contracts with the Bank in which they agree to comply with the Bank's personnel rules and the Bank's rules regarding access to Bank records. On a day-to-day basis, the IRs are supervised by Bank employees. When IRs sell securities and insurance products, the Subsidiary receives a large portion of the commission.
Currently, Bank employees search through the Bank's customer databases, select customers who might be good candidates for the IRs' products, contact those customers, and ask them if they would like an IR to contact them. If the customer agrees to such a contact, the Bank employee passes the customer's name and contact information to the IR. The Bank wishes to adopt a different procedure for sharing information with the IRs. In that regard, you ask the following question:
If the Bank sufficiently discloses to its customers that it plans to share customer information with its affiliates, is the Bank permitted to share the information with the IRs so the IRs can contact the customer directly?
The FCRA prohibits the furnishing of "consumer reports" to any individual or entity that does not meet a permissible purpose to obtain such a report under Section 604 of the statute. Because the IRs meet none of the permissible purposes listed under Section 604, they may not obtain the Bank's customer information if such information meets the definition of "consumer report," found in Section 603(d). During our telephone conversation, you described two types of information that the Bank wishes to share with the IRs. The first type includes lists of customers such as all those who have savings account balances of $10,000 or more ("customer lists"). The second type includes information, obtained by the Bank from customer loan applications, regarding the customer's transaction with entities other than the Bank ("application information").
Both the customer lists and the application information meet the general definition of "consumer report" set out Section 603(d)(1), i.e., the information bears on the customers' "credit worthiness, credit standing, [or] credit capacity" and is "used or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing the consumer's eligibility for . . . credit or insurance." The next issue, then, is whether the two types of information are excluded from the definition of "consumer report" under Section 603(d)(2), the relevant portions of which read as follows:
The term "consumer report" does not include . . . any (i) report containing information solely as to transactions or experiences between the consumer and the person making the report;
(ii) communication of that information among persons related by common ownership or by corporate control; or (iii) communication of other information among persons related by common ownership or by corporate control, if it is clearly and conspicuously disclosed to the consumer that the information may be communicated among such persons and the consumer is given the opportunity, before the time that the information is initially communicated, to direct that such information not be communicated among such persons
Customer Lists
Section 603(d)(2)(A)(i) refers to "information solely as to transactions or experiences between the consumer and the person making the report." Such "transaction or experience" information includes the length of time the customer has held a credit card issued by the Bank, the number of times the customer has been late in making a payment on such a credit card, and the average monthly balance in the customer's savings account. A list of the Bank's customers who have savings account balances of $10,000 or more also would constitute "transaction or experience" information and would therefore be excluded from the definition of "consumer report" under Section 603(d)(2)(A)(i). Thus, the Bank would not violate the FCRA if it shared such information with the IRs or any other entity that requested the information.
Application Information
Based on our telephone conversation, it appears that the second type of information that the Bank wishes to share with the IRs, application information, would include lists of the customer's assets and liabilities with entities other than the Bank, and lists of the names of companies from whom the customer has purchased insurance and securities. This information could not be the Bank's "transaction or experience" information because it includes only the customer's transactions with entities other than the Bank. Because this second type of information is not "transaction or experience" information, it is not excluded from the definition of "consumer report" under Sections 603(d)(2)(A)(i) or (ii).
The next issue is whether such information may be excluded from the definition under Section 603(d)(2)(A)(iii), the "affiliate-sharing" exclusion. Under that section, as long as the Bank provides the proper disclosures and the consumer has not objected to the communication, it is permitted to "communicate" any customer information to the IRs -- and the customer information is excluded from the definition of "consumer report"-- if the IRs are "persons related by common ownership or by corporate control," i.e., "affiliates." The Subsidiary itself is an affiliate of the Bank, of course. We believe that the IRs are affiliates as well because they are employees of the Subsidiary. This conclusion is based on the following facts that we understand to be true: (1) the Subsidiary pays the IRs' salaries and benefits; (2) the IRs are supervised primarily by Bank employees; (3) the Subsidiary receives a large portion of the commissions that consumers pay for the insurance and securities products; and (4) the IRs would be obtaining the Bank's information only to select which consumers to contact about the insurance and securities products, rather than to forward the information to the Broker or the entities that created the insurance and securities products. (On this fourth point, we note that neither the Broker nor the other entities are "affiliates" of the Bank.) Because we conclude that the IRs are employees of a Bank affiliate, the Bank may communicate to the IRs all information obtained from customer loan applications regarding the customer's transactions with entities other than the Bank, as long as the Section 603(d)(2)(A)(iii) disclosure requirements are met. As noted above, that subsection requires that it be "clearly and conspicuously disclosed to the consumer that the information may be communicated among such persons and the consumer is given the opportunity, before the time that the information is initially communicated, to direct that such information not be communicated among such persons."
The views set forth in this informal staff opinion are those of the staff and are not binding on the Commission. Please recognize that Section 621(e) of the FCRA authorizes the Board of Governors of the Â鶹´«Ã½ Reserve System to issue interpretations of the FCRA, to the extent that the statute applies to banks and other financial institutions enumerated in that section.
Sincerely,
Thomas E. Kane