Financial privacy notices get little response
By Laura Bruce • Bankrate.com

Apparently the hoopla surrounding the mailing of a billion privacy notices went pretty much unnoticed -- at least by the millions of consumers who received them.

The notices, which had to be in the mail by July 1, were sent by financial institutions and insurance companies to consumers as part of a new law aimed, in part, at giving consumers a little bit of control by allowing them to tell the banks, brokerages and the like not to share their personal financial information with certain other companies.

Financial institutions still have the right to share customer information with affiliates, but consumers have the right to prevent those institutions from selling or sharing that information with nonaffiliated third parties.

Content or confused?
Consumers could "opt out" of having their information shared with third parties by calling or returning a form that was included with the notices.

But apparently less than 5 percent of the billion or so privacy notices were returned by people wanting to opt out of having their private information shared by every Tom, Dick and Harriet doing business with their financial institutions. If that number is accurate, then you can see why the institutions claim consumers generally trust the way their private information is handled.

Perhaps. But it's more likely that many people either didn't have a clue the notices were coming and, therefore, weren't looking for them, or they didn't recognize them in all the clutter. Or they didn't realize what the notices said when they received them.

While some companies sent the notices under separate cover, most stuck them in the same envelope with statements, bills, marketing offers and the like. Maybe everyone should read all that stuff, but most don't -- and that's what many companies were counting on.

"We've received hundreds of e-mails and letters from consumers saying they didn't notice them in the envelope or they thought it was another ad. Many people threw them away not knowing what they were," says Beth Givens of the San Diego-based Privacy Rights Clearinghouse.

Another drawback for consumers may have been the "readability" of the notices. A consultant hired by the Privacy Rights Clearinghouse analyzed 60 notices and says they were written at a third or fourth year college reading level instead of the junior high school level that's recommended for materials written for the general public.

Legally speaking
Richard Harvey, chief privacy officer for Chevy Chase Bank headquartered in Chevy Chase, Maryland, doesn't buy that.

"People were inundated with these things. I don't know how many people really took time to read them. When I hear people say they were incomprehensible and they should have been written at a different level, I'm not sure that would have made a difference.

"Everyone had to comply with the act. There wasn't an easy way to say these things."

Some congressional leaders are concerned with the way the notices were written.

"The lawyers clearly won out at the banks. To protect themselves they were taking language from the regulation, which, itself, wasn't worded as clearly as it should have been," says Dean Sagar, spokesman for Rep. John LaFalce, D-N.Y., who introduced the privacy provisions as part of the Gramm-Leach-Bliley financial services modernization act.

Ironically, many notices were written in such a way that consumers didn't realize it when their financial institution went beyond the law to protect the customer's privacy.

Those companies don't share information with nonaffiliated, third party companies already, and were not required to include a phone number or address for consumers to use to opt out. It was a break for the customers, but the companies didn't explain it very well.

Scaring off subprime consumers
"We got a lot of complaints from people saying, 'I got the notice but they didn't give me a way to opt out,'" Givens says. "The notices were so poorly laid out that individuals reading them couldn't even figure out when the bank was doing a good deed."

But what was more troubling, according to Sagar, was the tone used by some companies.

"Some seemed very threatening to someone on the edge of subprime or below. They basically said, 'You won't get offers of credit to improve or lower your rate.' Too many notices minimized the importance of choice. 'You can do this but if you do you won't have access to credit or services. We're going to use it anyway -- you basically have no rights.'

"We felt the purpose was being subverted. It was more about the rights of the financial institutions."

Sagar says the notices weren't supposed to be legal documents to protect the institutions, they were supposed to be straightforward documents to announce a new right under federal law. That, he says, clearly wasn't done.

Rush to judgment
Sagar admits lawmakers have to accept some responsibility. The privacy provisions, he says, were a rush job -- a job that should have been done better.

"This was something that our committee enacted in the final stage of developing a modernization bill. In the final bill there was no privacy provision, and it was clear on the floor that was the key issue -- the absence of privacy protections," Sagar says.

"So, at the last minute we sat down with two members of the Rules committee and crafted a compromise privacy policy. It came to the floor as a bipartisan agreement from Rules and Commerce and Banking. It passed with one dissenting vote -- for two reasons. No one had any idea what was in it, and the Democrats and Republicans had very different ideas of what privacy was.

"We had a bill that clearly was no one's idea of a best or a final solution to privacy. It's what, in those circumstances, could be done."

Sagar says privacy is an ongoing issue and the law will be improved. One change he hopes to see is a standardized opt out form that will be sent to consumers annually.

Chevy Chase Bank's Harvey would like to see federal and state lawmakers give the current law time to show its effect before adding new provisions.

But privacy advocates are opposed to the wait-and-see attitude.

"I don't have a lot of hope for sitting back and waiting for a while. The privacy provision in Gramm-Leach-Bliley was flawed from the start. We all know it's a very weak privacy standard and needs to be strengthened," Givens says.

Perhaps some financial institutions should take a cue from Harvey, who says that most banks did a good job of complying with the act but others did better.

"Some utilized this as an opportunity to communicate with customers, not just about what was specifically required, but also to say, 'We respect your expectation of privacy. We're in this with you, you can trust us to handle your information,'" says Harvey.

"Some also used it as an opportunity to talk to customers about the very critical issue of identity theft. We showed what they can do to not become a victim and, if you are a victim, what you can do to recover. We also explained the benefits of sharing customer information and answered some commonly asked questions."

One common misperception was that consumers who wanted to opt out had to respond by July 1. The July 1 deadline pertained only to the institutions. They had to mail out their notices by then. Companies will have to mail notices annually from now on, but consumers can opt out at any time.

If you threw away or missed your notices, print this form and mail it to your financial institution, brokerage or insurance company. They may respond by sending their own opt out form and requesting that you send it in, but at least it gets the ball rolling.

-- Posted: July 27, 2001