Update on Affiliate Sharing Rules April 26, 2007

Introduction A.Purpose of this presentation is to briefly touch upon the relationship of Fair Credit Reporting Act (FCRA) affiliate sharing rules in § 603(d)(2)(A) and § 624. B.We will briefly summarize the current state of affairs and highlight some key provisions of the proposed regulation. C.Finally, we will provide some thoughts regarding when the § 624 affiliate sharing rules may be issued.

FCRA § 603(d)(2)(A) General affiliate sharing opt out requirements are found in the definition of “consumer report”. This section specifically excludes from the definition of a “consumer report” any: –Reports containing information solely regarding transactions or experiences between the party making the report and the consumer. This information may be shared without regard to affiliation and without being subject to an opt out right under FCRA.  Note: if the information is shared with a nonaffiliated third party it may be subject to opt-out rights under GLBA/Reg P. –Communication of information other than transaction and experience information (“other information”) with an affiliate, but only after the consumer is given notice and an opportunity to opt out of such sharing.  Note: there are limitations on sharing data received from a consumer reporting agency.

FCRA § 624 Inserted by FACT Act § 214(a)(2). Adds to the general affiliate sharing requirements found in FCRA § 603(d)(2)(A) by prohibiting the affiliate receiving such data from using it to solicit the consumer for products and services unless: –It is clearly and conspicuously disclosed to the consumer that the information may be shared among such persons for purposes of making such solicitations; and –Consumer is provided an opportunity and simple method to prohibit the making of such solicitation (i.e. to “opt out”).

FCRA § 624 (Continued) “Opt out” is good for 5 years. Must provide notice and opportunity to extend opt out at end of this period prior to using the information for marketing solicitation purposes. There are several exclusions to the rule, including one for the use of information by a person that has a pre- existing business relationship with the consumer. This is defined as a relationship based on: –Financial contract in place between the consumer and the person in question; –Purchase, rental or lease of goods or services, or a financial transaction (including holding an active account or policy or other form of continuing relationship) in the immediately preceding 18 months; –Inquiry or application by the consumer in the immediately preceding 3 months; or –Any other pre-existing relationship as defined in the regulation.

Rulemaking History FACT Act § 3(1) tasked the Federal Reserve and FTC with job of writing regulations establishing effective dates for those FACT Act provisions that did not have effective dates in the statute. They issued a proposed version of what would become known as “Reg V” on Christmas Eve, This proposal called for FACT Act § 214(a) to be effective on December 1, Final version of Reg V was issued on February 11, It struck the December 1 st effective date. Basis for doing so was that compliance date was tied to rulemaking schedule in FACT Act § 214(b).

Rulemaking (Continued) Proposed version of affiliate sharing rules were published in June/July They are yet to be finalized.

Proposed Rule Highlights A.General Clarifications 1)Section 624 regulations govern use of the shared information by the receiving affiliate for marketing solicitations. It does not supersede § 603(d)(2)(A)(iii) opt out rules for sharing “other information” generally. 2)The “sharing affiliate” (not the “receiving affiliate”) is the party responsible for the new notice requirement, although a joint notice would be allowed.

Proposed Rule (Continued) B.Definitions 1)Eligibility Information: information that would be a consumer report if not for the (a) the transaction/ experience and (b) other information exceptions found in found in FCRA § 603(d)(2)(A). 2)Pre-existing Business Relationship: this definition tracks the language of the statute. The regulatory agencies have declined to expand on it at this point.

Proposed Rule (Continued) C.Notification Requirements 1)Notice must be clear, conspicuous, and concise. It must: a.Disclose the consumer’s ability to limit the receiving affiliate from using his/her eligibility information for marketing solicitation purposes. b.State that the election will apply for a specified period of time (< 5 years), and that the consumer has the right to extend this at the end of this term. c.Include a reasonable and simple means for the consumer to opt out. 2)Proposed rule would allow sending a joint notice to cover multiple affiliates, and would allow combining the notice with GLBA/Reg P privacy notices. 3)Notice would need to be sent in such a manner so that each consumer can reasonably be expected to receive actual notice.

Proposed Rule (Continued) D.Opt Out Requirements 1)Receiving affiliate may not use eligibility information to make or send solicitations to the consumer until s/he has had a reasonable opportunity, after receipt of the notice, to opt out. For example: a.For paper notices mailed to the consumer this would be 30 days after mailing the notice. b.If the notice is provided electronically this would be 30 days after the date the consumer acknowledges receipt of the electronic notice. 2)Opt out methods must be reasonable and simple. This could include: a.Check-off boxes on a form included with the notice; b.Including a reply form and SASE together with the notice; c.Providing an electronic means to opt out; or d.Providing a toll-free phone number.

Proposed Rule (Continued) D.Opt Out Requirements (Continued) 3)Opt out election must be complied with “as soon as reasonably practicable” after receipt. 4)Opt out can be exercised (or revoked) by the consumer at any time. 5)If consumer’s relationship terminates while the opt out election is in force, then the election continues indefinitely unless revoked by the consumer.

Current State of Affairs While regulation has been proposed, it is not yet finalized. This means the affiliate marketing opt out rules found in FCRA § 624 are also not yet effective. General affiliate sharing opt out requirements (found in definition of “consumer report” at FCRA § 603(d)) remain in effect.

Epilogue Unclear when final affiliate sharing rules might be issued. Second Quarter 2007 rumored for a while. Does the proposed model privacy notice mean the affiliate sharing final rule is drawing closer?

LEGAL STUFF: Because of its generality, the information provided in this program may not be applicable to all situations and should not be acted upon without specific advice from your compliance officer or legal counsel. If you have any questions concerning this program, please contact Tom Quinn at: –(857) © 2007 Pierce Atwood LLP