1. What? Model Privacy Notice Who? Dino Tsibouris (614) 360-1160 dino@tsibouris.com

2. Background Gramm-Leach-Bliley Act requires financial institutions to give notice of —Information-collecting practices —Information-sharing practices —Opportunity to opt out of some information-sharing Initial and annual notice required

3. Background Applies to “financial institutions” – any businesses significantly engaged in financial activities such as lending

4. Background Privacy policies had become long, difficult to understand, and ineffective Previously issued Sample Clauses confused consumers

5. Current Law New notice solution: Model Privacy Form Not mandatory, but provides Safe Harbor – Will replace Sample Clause Safe Harbor Effective since December 31, 2009 Build your form on the FTC website Build your form

6. Model Privacy Form Consumer-friendly table format Standardized, two-page form Three versions of form: 1.No opt out 2.Opt out by telephone or online 3.Opt out by mail

9. What Regulators Want “A clear, conspicuous, and accurate statement of the company's privacy practices.” (GLBA) Sears Enforcement – Sears’ extensive data collection mentioned on line 75 of legal agreement. – A “buried disclosure” such as this is not adequate notice. (FTC) FTC Privacy Roundtables – Notice improvements ongoing

10. Opt Out Phone/Online No Opt OutOpt Out Mail

11. Questions & Answers Dino Tsibouris (614) 360-1160 dino@tsibouris.com