For other versions of this document, see http://wikileaks.org/wiki/CRS-RL32626 ------------------------------------------------------------------------------ Order Code RL32626 CRS Report for Congress Received through the CRS Web American Bankers Association v. Lockyer: Whether California's Financial Information Privacy Law Has Been Preempted by the Fair and Accurate Credit Transactions (FACT) Act Updated November 23, 2005 M. Maureen Murphy Legislative Attorney American Law Division Congressional Research Service ~ The Library of Congress American Bankers Association v. Lockyer: Whether California's Financial Information Privacy Law Has Been Preempted by the Fair and Accurate Credit Transactions (FACT) Act Summary P.L. 108-159, the Fair and Accurate Credit Transaction (FACT) Act of 2003, extends a clause in the Fair Credit Reporting Act purporting to preempt state law and, thereby, establish a national standard for sharing of consumer financial information among affiliated companies. The legislative history of the FACT Act indicates awareness that California's Financial Information Privacy Law, enacted in 2003, would be preempted. Nonetheless, on June 30, 2004, a federal court ruled, in American Bankers Association v. Lockyer, that the FACT Act preempted state law only with respect to credit report information and that an anti-preemption clause in the privacy title of P.L. 106-102, the Gramm-Leach-Bliley Act of 1999, permits states to enact more protective laws such as that of California. The federal banking regulators and the Federal Trade Commission joined the plaintiffs in urging the U.S. Court of Appeals for the Ninth Circuit to reverse the decision and to expedite the appeal. On June 20, 2005, the appellate court reversed the district court ruling and found that the FACT Act preempted the California law to the extent that it attempted to regulate communication among affiliated companies of information covered by the FCRA's definition of "information." On October 4, 2005, the district court issued an injunction against enforcement of the California statute's affiliate information sharing provisions, having found that distinguishing information shared among affiliates that is covered by the FACT Act from that which could survive was not practicable. California has appealed this ruling. This report will be updated as events warrant. Contents Background . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Federal Statutes on Affiliate Information Sharing: GLBA and FCRA . . . . . 2 The FACT Act Provisions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 FACT Act Legislative History . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 Preemption Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 District Court Ruling: American Bankers Association v. Lockyer . . . . . . . . 6 Issues on Appeal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Analysis of the District Court's Decision . . . . . . . . . . . . . . . . . . . . . . . . . . 12 The Ninth Circuit Ruling: American Bankers Association v. Gould . . . . . . 14 District Court Ruling on Remand: American Bankers Association v. Lockyer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Legislation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 American Bankers Association v. Lockyer: Whether California's Financial Information Privacy Law Has Been Preempted by the Fair and Accurate Credit Transactions (FACT) Act Background The California Financial Information Privacy Act,1 was enacted on August 28, 2003, as Congress was considering the legislation that was to become the Fair and Accurate Credit Transactions (FACT) Act.2 The California law became effective on July 1, 2004. It governs the rights of California residents with respect to the dissemination of nonpublic personal information by financial institutions. In some respects, it diverges from two federal laws that impose restrictions on the dissemination of customer information by financial institutions: (1) the privacy title of the Gramm-Leach Bliley Act of 1999 (GLBA)3 and (2) 1996 amendments to the Fair Credit Reporting Act of 1970 (FCRA).4 It includes a requirement that, before sharing nonpublic personal information with nonaffiliated third parties, financial institutions obtain an opt-in, i.e., affirmative consent, from their customers.5 Before such information may be shared with affiliates not in the same line of business and regulated by the same functional regulator, an opt-out notice is required, i.e., a notice providing an opportunity to preclude disclosure of information. Wholly-owned subsidiaries and affiliates in the same line of business (securities, banking, or insurance) may share information, except medical information, without an opt-out or opt-in requirement. California's law was enacted as a temporary federal statute purporting to preempt state regulation of information sharing among corporate affiliates was set to expire on December 31, 2003. The FACT Act, among other things, makes that 1 Cal. Fin. Code §§ 4050 - 4060. 2 P.L. 108-159, 117 Stat. 1952 (2004). 3 P.L. 106-102, 11 Stat. 1338, 15 U.S.C. §§ 6801 et seq. 4 P.L. 91-508, tit. VI; 84 Stat. 1128; 15 U.S.C. §§ 601 et seq. 5 For further information, see CRS Report RL31758, Financial Privacy: The Economics of Opt-In vs Opt-Out, by Loretta Nott; and CRS Report RL31847, The Role of Information in Lending: The Cost of Privacy Restrictions, by Loretta Nott. CRS-2 preemption permanent and limits the ability of affiliated companies to share consumer information for marketing solicitations.6 Federal Statutes on Affiliate Information Sharing: GLBA and FCRA Generally, both the Gramm-Leach-Bliley Act (GLBA) of 19997 and the Fair Credit Reporting Act (FCRA) of 1970,8 as amended, address the issue of sharing of information about consumers among business entities. GLBA applies to "financial institutions." It restricts entities, which are in the business of providing financial services, from sharing customer non-public personal information with non-affiliated third parties. FCRA regulates credit bureaus and the credit reporting business. It does not require such businesses to register or be chartered. Instead, it defines certain functions and regulates businesses performing those functions under the nomenclature of "credit reporting agencies." It prescribes standards that address information used to determine eligibility of consumers for credit, insurance, or employment and covers "any person which, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of preparing or furnishing consumer reports."9 As originally enacted, FCRA did not include an express provision on the exchange of consumer credit information among affiliated companies. Subsequently, under the Fair Credit Act Amendments of 1996,10 information sharing among affiliates was specifically excepted from the definition of "consumer report," thereby permitting affiliated companies to share with one another customer information without implicating FCRA obligations and requirements.11 With respect to coverage of interaffiliate information sharing, FCRA preempts state law in broad language. GLBA takes an opposite approach; it contains an anti- preemption clause which preempts state laws only to the extent that state laws provide consumers less protection than does GLBA. Under GLBA, inconsistent state statutes, regulations, orders, or interpretations are preempted, to the extent of their 6 For further information on the FACT Act, see CRS Report RL32535, Implementation of the Fair and Accurate Transactions (FACT) Act of 2003, by Angie A. Welborn and Grace Chu; CRS Report RS21449, Fair Credit Reporting Act: Preemption of State Law, by Angie A. Welborn; and, CRS Report RL32121, Fair Credit Reporting Act: A Side-by-Side Comparison of House, Senate and Conference Versions, by Angie A. Welborn and Loretta Nott. 7 P. L. 106-102, 113 Stat. 1338, 15 U.S.C. §§ 6801 et seq. 8 P.L. 91-508, tit. 6, § 601, 1128; 15 U.S.C. §§ 1681 et seq. 9 15 U.S.C. § 1681a(f). 10 P.L. 104-208, Div. A, Tit., II, Subtitle d, Ch. 1, § 2419, 110 Stat. 3009-452, adding 15 U.S.C. § 1681t(b)(2). 11 Exchange of experience and transaction information among affiliated companies is totally excluded from the definition of "consumer report"; exchange of other information among affiliates is excluded provided the consumer is given a notice and an opportunity to prevent the disclosure, an opt-out.16 U.S.C. §§ 1681a(d)2)(A)(ii) and (iii). CRS-3 inconsistency; and, a state law is not inconsistent "if the protection such statute, regulation, order, or interpretation affords any person is greater" than provided by GLBA.12 The difficulty is that the FCRA provisions relating to affiliate information sharing and the GLBA privacy provisions do not clearly lay out their interaction with one another. GLBA requires an opt-out for financial institutions to share nonpublic personal information with non-affiliated third parties. It does not address any such requirement for interaffiliate sharing. GLBA does, however, require financial institutions to notify their customers of their privacy policy, including their policies with respect to information sharing among affiliates. GLBA also has a savings clause preserving the operation of FCRA.13 The FACT Act Provisions The FACT Act provision on information sharing among affiliated companies amends FCRA,14 as amended in 1996. FCRA regulates the credit reporting business by prescribing standards for the credit reporting business and for users of consumer credit reports. It generally defines "consumer reports" and limits the purposes and conditions under which "consumer reports" may be furnished by "consumer reporting agencies."15 Under the 1996 amendments, the definition of "consumer report" was amended to exclude communication of transaction and experience information among corporate affiliates. Also excluded, provided the consumer was afforded an opportunity to prevent it, i.e., opt out, was communication of other information concerning the consumer among affiliates.16 Essentially, this permits companies to share with their affiliates certain information respecting their transactions and experience with a customer without any notification. Other customer information, such as credit reports and information supplied or gathered in connection with applying for loans or other services, may be shared with other companies in the corporate family if the customers are given "clear and conspicuous" notice about the sharing and an opportunity to direct that the information not be shared.17 Under the 1996 FCRA amendments, what had been the FCRA's general anti-preemption clause preserving more protective state law, was modified to specify federal preemption of state law until January 1, 2004, with respect to certain issues. Included among the issues temporarily preempted was the "exchange of information among persons 12 15 U.S.C. § 6807. Under this provision, inconsistency is to be determined by the Federal Trade Commission (FTC). 15 U.S.C. § 6807(b). 13 It reads: "[e]xcept for the amendments made by subsections (a) and (b)[relating to enforcement], nothing in this title shall be construed to modify, limit, or supersede the operation of the Fair Credit Reporting Act, and no inference shall be drawn on the basis of the provisions of this title regarding whether information is transaction or experience information under section 603 of such Act." 15 U.S.C. § 6806(c). 14 84 Stat. 1128, 15 U.S.C. §§ 1681 et seq. 15 15 U.S.C. § 1681b. 16 15 U.S.C. §§ 1681a(d)(2)(A)(ii) and (iii). 17 15 U..C. § 1681a(d)(2)(A)(iii). CRS-4 affiliated by common ownership or common control."18 Under the FACT Act amendments, this preemption provision was made permanent and an additional limitation was placed on information sharing among affiliated companies. Subject to certain exceptions, affiliated companies may not share customer information for marketing solicitations unless the consumer is provided clear and conspicuous notification that the information may be exchanged and an opportunity and a simple method to opt-out.19 FACT Act Legislative History When the FACT Act was passed, there were indications of congressional awareness of the California Financial Information Privacy Act treatment of information sharing among affiliated companies. The California law was enacted as the FCRA temporary preemption of state law was about to expire, contemporaneously with congressional consideration of proposals to extend the FCRA preemption. The legislative history of the FACT Act includes references to the preemptive effect the FACT Act was anticipated to have on the California provisions respecting information sharing among corporate affiliates. The Conference Committee proclaimed that "the legislation will ... ensure the operational efficiency of our national credit system by creating a number of preemptive standards."20 Floor debate included statements that the bill would preempt the California law requirement with respect to sharing of information among affiliates21 and rejection 18 15 U.S.C. § 1681t(b)(2). 19 15 U.S.C. § 1681s-3. The limitations with respect to using the information communicated among affiliates for marketing purposes is also covered by the preemption-of-state law provision. 15 U.S.C. § 1681s-3(c). 20 H.Rept. 108-396, 66 (2003) 21 149 Cong. Rec. H 8120 (September 9, 2003, daily ed.) (Rep. Frank, a proponent of the measure, and ranking minority member of the committee reporting the bill, the House Financial Services Committee. In the Senate, the debate centered on S. 1753, which was passed by the Senate and its language, eventually, substituted for that of the House bill, H.R. 2622, with reconciliation of the two versions occurring in the Conference Committee. In the Senate debate, Sen. Feinstein was clear in informing her colleagues that "this bill reduces the privacy rights of 36 million Californians." 149 Cong. Rec. S13980 (November 5, 2003, daily ed.). Sen. Reed said that "[f]ailure to reauthorize national standards would balkanize our national credit system and potentially hurt every consumer in America," and indicated that he was speaking inclusively of all affiliate information sharing. 149 Cong. Rec. S13858 (November 5, 2003). According to Sen. Reed: When Congress passed the amendments to the Fair Credit Reporting Act in 1996, affiliate sharing had a very different meaning. The Gramm-Leach-Bliley Act had not yet been passed, and massive financial services holding companies had not emerged. Today, according to the Federal Reserve's National Information Center, the largest bank holding company has at least 1639 affiliates as of June 30, 2003. The meaning of affiliate sharing has changed, and will likely continue to change as the financial services industry adapts to changing times. Id., at S 13859. CRS-5 by the Senate of an amendment that would have made the California standard a national standard on affiliate information sharing.22 Preemption Analysis Preemption analysis begins with the Supremacy Clause of the U.S. Constitution.23 Under it, Congress may override state laws in conflict with the exercise of powers delegated to it under Article I of the U.S. Constitution. When Congress has done so, preempted state laws are unenforceable. Determining whether a federal statute has a preemptive effect is a matter of statutory analysis. If Congress enacts legislation under one of its delegated powers that includes an explicit statement that state law is preempted, the Supreme Court generally will give effect to that legislative intent.24 Where there is no language of preemption, the Court is likely to find preemption when it identifies a direct conflict between the federal law and the state law or when it concludes that the federal government has so occupied the field as to preclude enforcement of state law with respect to the subject at hand.25 Since the FCRA clause on affiliate information sharing contains explicit language of preemption, the issue is one of statutory construction, i.e., discerning and giving effect to congressional intent.26 Generally, that intent is determined by examining the statutory language, giving effect to its plain meaning in relation to its context in the statute, and, if further elaboration is necessary, its legislative history.27 In dealing with matters traditionally within the power of states to protect public health and safety, i.e., the police power, the Supreme Court often applies a presumption against preemption.28 In some recent decisions upholding an express federal preemption, however, the presumption against preempting state police power laws or regulations did not figure in the Court's analysis. These cases seem to have 22 S. Amend. 2054, offered by Sen. Feinstein, 149 Con. Rec. 13860 (November 5, 2003). 23 U.S. Const., Art. VI, cl. 2. It declares that the Constitution and "the Laws of the United States which shall be made in Pursuance thereof ... shall be the supreme Law of the Land ... any Thing in the Constitution or Laws of any State to the Contrary notwithstanding." 24 Rice v. Santa Fe Elevator Corp., 331 U.S. 218, 230 (1947); Wisconsin Public Intervenor v. Mortier, 501 U.S. 597, 605 (1991). 25 CRS Report 97-589, Statutory Interpretation: General Principles and Recent Trends, by George Costello. 26 "The purpose of Congress is the ultimate touchstone" in every preemption case. Retail Clerks v. Schermerhorn, 375 U.S. 96, 103 (1963). 27 See Cipollone v. Liggett Group, Inc., 505 U.S. 504, 532 (Blackmun, J. concurring in part and dissenting in part). 28 See, e.g., Medtronic, Inc. v. Lohr, 518 U.S. 485 (1996) (express preemption provision in the 1976 Medical Device Amendments to the Federal Food, Drug, and Cosmetic Act did not preempt state tort action for a defective pacemaker); Cipollone v. Liggett Group, Inc., 505 U.S. 504 (1992) (express preemption clause in federal cigarette labeling legislation read narrowly in light of presumption against preemption of state police power and state tort action found not preempted). CRS-6 been confined to examining the language and legislative history of the provision in question.29 District Court Ruling: American Bankers Association v. Lockyer In American Bankers Association v. Lockyer,30 the American Bankers Association, the Consumers Bankers Association, and the Financial Services Roundtable challenged the validity of California's Financial Information Privacy Act31 treatment of information sharing among affiliated companies. Specifically, at issue is the California prohibition on disclosure of a consumer's nonpublic personal information to the financial institution's affiliates without providing the consumer with written notice and a reasonable opportunity to prevent the disclosure, i.e., an opt out. Plaintiffs maintained that the provision is preempted by the FCRA, as amended in 1996 and by section 214 of the FACT Act32 in 2003. The California Attorney General, defended the California statute as permissible under the GLBA anti- preemption clause, which preserves any state law that is more protective.33 At the district court level, the court identified its task as that of determining Congressional intent. To do so, it assumed that a narrow reading must be given to the FCRA/FACT Act preemption provision and a presumption against preemption invoked because the California law represented the exercise of the state's police power.34 The court relied on the purposes enunciated in FCRA35 and various judicial 29 In Lorillard Tobacco Co. v. Reilly, 533 U.S. 525 (2001), the Court found Massachusetts regulations on sale of tobacco products to minors to be preempted by federal cigarette labeling laws as requirements on smoking and health. The court examined the legislative history of the cigarette labeling laws, including the language in a previous version of the federal law. In Geier v. American Honda Motor Co, Inc., 529 U.S. 861 (2000), a state tort action for failure to equip a certain vehicle with an airbag was held to have been preempted by a federal motor vehicle safety standard promulgated under the National Traffic and Motor Vehicle Safety Act of 1966, 80 Stat. 718, under which an airbag was not required on the particular vehicle. See, Susan Raeker-Jordan, "A Study in Judicial Sleight of Hand: Did Geier v. American Honda Motor Co Eradicate the Presumption Against Preemption," 17 Brigham Young University Journal of Public Law 1 (2002); Mary J. Davis, " Unmasking the Presumption in Favor of Preemption," 53 South Carolina Law Review 967 (2002). 30 ___ F.Supp. 2d ___ (E.D.Cal. 2004), 2004 WL 1490432. 31 Cal. Fin. Code §§ 4050 - 4060. 32 P.L. 108-159, 117 Stat. 1952, 1980 (2004). 33 15 U.S.C. § 6807. 34 It drew this presumption from three cases, one of which involved express language of preemption. That was Cipollone v. Liggett Group, Inc., 505 U.S. 504 (1992) (cigarette labeling statute's express preemption provision held by a plurality of the Court to preempt a state common law negligence action by taking a narrow view of the scope of the express preemption provision and invocation of presumption against preemption when dealing with a state's police power). In California v. ARC Am. Corp., 490 U.S. 93 (1989), a state antitrust law allowing indirect purchasers to recover damages in price fixing cases was held (continued...) CRS-7 interpretations of the scope of the FCRA in construing it, not as a system for regulating commercial dissemination of consumer information but as regulation of consumer reporting agencies and the contents of consumer reports. It invoked an appellate court FCRA decision36 to draw a distinction between consumer reports and the information they contain when that information is not used, expected to be used, or collected for one of the permissible purposes of "consumer reports" under the FCRA.37 It then examined the FCRA provisions excluding information exchanged among affiliates from the definition of "consumer report" and preempting state laws on affiliate information sharing.38 The latter reads: [n]o requirement or prohibition may be imposed under the laws of any State ... with respect to the exchange of information among persons affiliated by common ownership or common corporate control, except that this paragraph shall not 34 (...continued) not to be preempted as an obstacle to the accomplishment of a federal antitrust statute in view of the long exercise of state police power in the antitrust area. In General Motors v. Abrams, 897 F. 2d 34 (2d Cir. 1990), an FTC consent order was held not to preempt New York State's lemon law by occupying the field in consideration of the tradition of state regulation of trade practices. 35 The court relied on 15 U.S.C. § 1681. It includes Congressional findings and a statement of purpose. The latter states that the purpose of the legislation is "to require that consumer reporting agencies adopt reasonable procedures for meeting the needs of commerce for consumer credit, personnel, insurance, and other information in a manner which is fair and equitable to the consumer, with regard to the confidentiality, accuracy, relevancy, and proper utilization of such information in accordance with the requirements of this chapter." 36 Ippolito v. WNS, Inc., 864 F. 2d 440 (7th Cir. 1988). The portion of the opinion that Lockyer relied on stated: as defined in §§ 1681a(d) and 1681b, not all reports containing information on a consumer are `consumer reports.' To constitute a `consumer report,' the information contained in the report must have been `used or expected to be used or collected in whole or in part' for one of the purposes set out in the FCRA if: (1) the person who requests the report actually uses the report for one of the `consumer purposes' set forth in the FCRA; (2) the consumer reporting agency which prepares the report `expects' the report to be used for one of the `consumer purposes' set forth in the FCRA; or (3) the consumer reporting agency which prepared the report originally collected the information contained in the report expecting it to be used for one of the `consumer purposes' set forth in the FCRA. Ippolito v. WNS, Inc., 864 F. 2d 440 , 449 (7th Cir. 1988), cert. denied, The decision involved a claim that a consumer report was illegally obtained. The court ruled that because the purpose for which the report was intended did not involve consumer credit, insurance, etc., but investigation of the owners of a business by another business in connection with litigation, the information supplied by the consumer reporting agency was not a "consumer report." 37 15 U.S.C. § 1681b (consumer's request, court order, consumer credit transaction, insurance, government benefit eligibility, child support agency, and employment). For further information, see, CRS Report RL31666, Fair Credit Reporting Act: Rights and Responsibilities, by Angie A. Welborn. 38 15 U.S.C. § 1681t(b)(2). CRS-8 apply with respect to subsection (a) or (c)(1) of section 2480e of title 9, Vermont Statutes Annotated (as in effect on September 30, 1996).39 It noted that the FCRA language, on its face, seems to preempt all state laws on affiliate sharing of consumer information. It then reasoned that interpreting the language of preemption that way would encompass broader coverage than the underlying legislation and, thereby, cover all information rather than just consumer credit information or credit report information. The court reasoned that since information sharing among affiliates is exempted from the FCRA's definition of "consumer report," it would make no sense for the FCRA to exclude affiliate information sharing from FCRA coverage in that manner in one clause and in another bring it within the ambit of the statute by precluding states from regulating it. The court saw this reasoning reinforced by the fact that the same clause that preempted state law with respect to affiliate sharing of information specifically preserved a Vermont law from preemption, which applied state credit reporting law to affiliate sharing of information.40 GLBA was also a factor in the court's decision. That its notice requirement applies to affiliate information sharing led the court to read the GLBA anti- preemption clause to cover California's right to enact its opt-out requirement for affiliate information sharing. To support this conclusion, it quoted from the legislative history, including the following remark by Senator Sarbanes, the sponsor of the anti-preemption clause: "We were able to include in the conference report an amendment that I proposed which ensures that the Federal Government will not preempt stronger State financial privacy laws that exist now or may be enacted in the future. As a result, States will be free to enact stronger financial privacy safeguards if they deem it appropriate."41 39 The Vermont law places strictures on the release of credit reports. The FCRA preemption provision is stated as a general exception to FCRA's general anti-preemption clause , 15 U.S.C. § 1681t(a), preserving state laws. 40 The court appears to have overlooked the fact that the Vermont statute's coverage of credit reports was broader than FCRA's coverage of "consumer reports," and, therefore, would have covered affiliate information sharing but for the exclusion. 41 145 Cong. Rec. S13789 (November 3, 1999, daily ed.). CRS-9 Issues on Appeal In the appeal of Lockyer, to the U.S. Court of Appeals for the Ninth Circuit,42 the appellant was supported by financial services trade associations43 and federal bank, thrift, and credit union regulators, and the Federal Trade Commission (FTC).44 The American Bankers Association, the Financial Services Roundtable, and the Consumer Bankers Association, who are the appellants in the case, argue for a plain meaning interpretation of the FCRA language. In their view, the sharing of customer information among affiliated companies is "the essential predicate to offering comprehensive banking, insurance, and securities products" to customers of financial services companies.45 Their premise is that the nation-wide integrated financial services companies authorized by financial modernization legislation46 relies on the three laws at issue and that, contrary to the district court's interpretation, the FCRA's 1996 amendments and the FACT Act provide comprehensive regulation of customer information sharing among affiliated financial companies. They appear to fault the district court for considering "consumer reports" only in the narrow or technical sense of information covered by the FCRA that is subject to the most stringent limitations on providers, users, or collectors and is generally obtained through consumer reporting agencies. They see the three laws on a continuum and the district court as ignoring the plain language of the FCRA preemption, the clause in GLBA that preserves the operation of the FACT Act, and the legislative history of the FACT Act. They argue that the district court should not have engaged in contextual exegesis of unambiguous language and that, in doing so, the court limited the scope of the statutory language. They further argue that the contextual analysis was incomplete since it failed to note the contrast the subject provision has with other preemption provisions in FCRA that do include limiting language.47 They take issue 42 American Bankers Association v. Lockyer, appeal docketed, No. 04-16334 (9th Cir. July 28, 2004). 43 There are amicus briefs representing: (1) the Investment Company Institute, Securities Industry Association, Investment Counsel Association of America, American Insurance Association, American Council of Life Insurers, and the National Business Coalition of E- Commerce and Privacy; (2) the Clearing House Association; (3) E-Loan, Inc.; and, (4) Citizens for a Sound Economy. 44 Amicus Curiae Brief of the Office of Thrift Supervision, the Office of the Comptroller of the Currency, the Federal Deposit Insurance Corporation, the Board of Governors of the Federal Reserve System, the National Credit Union Administration, and the Federal Trade Commission in Support of Appellants, American Bankers Association v. Lockyer, (9th Cir. No. 04-16334) (hereinafter, Regulators' Brief). 45 Brief of Plaintiffs-Appellants at 2, American Bankers Association v. Lockyer, (9th Cir. No. 04-16334). 46 "[T]hey operate as integrated financial services businesses, often under a common brand," sharing "customer information among their affiliates to provide comprehensive, seamless services and products that customers expect, especially from commonly branded entities -- e.g., immediate transfer of funds and balance information between a bank and its securities affiliate." Id., at 16. 47 For example, 15 U.S.C. § 1618t(b)(1)(A). FCRA has a general savings clause, 15 U.S.C. (continued...) CRS-10 with the district court's conclusion that the FCRA is concerned only with "consumer reports," citing legislative history of the 1996 amendments48 and of the FACT Act49 to this end. With respect to the presumption against preemption, the appellants argue that it cannot overcome explicit, clear language of preemption. The appellants also argue that the GLBA anti-preemption clause does not apply to state laws preempted under FCRA and cites legislative history to this effect.50 The amicus brief of the federal banking regulators in support of the appellants also argues for a plain meaning construction of the FCRA/FACT Act language. It views the district court decision as predicated "on a fundamental misperception of the framework and scope of FCRA"51 and as one that is "frustrating Congress' objective."52 It portrays FCRA, FACT Act, and GLBA, as a "carefully crafted national system to govern the accumulation, dissemination and use of a consumer's personal financial information."53 It contains considerable treatment of the legislative history and the rationale behind the inclusion in the 1996 FCRA amendments of the preemption of state law with respect to information sharing among affiliates. This is used to discredit the court's interpretation of the FCRA as too narrow. According to the federal regulators, FCRA, as originally enacted, contained an exemption permitting all businesses to share with other entities information about their own dealings -- i.e., "experience and transaction" information -- without being subject 47 (...continued) § 1681t(a), preserving state laws that do "not annul, alter, affect, or exempt any person subject to [its] ... provisions ... from complying with the laws of any State with respect to the collection, distribution, or use of any information on consumers, except to the extent that those laws are inconsistent with any provision of [FCRA] ... , and then only to the extent of the inconsistency." One of the exceptions to this clause is 15 U.S.C. § 1618(b)(1)(A) which states that "No requirement or prohibition may be imposed under the laws of any State ... with respect to any subject matter regulated under ... subsection (c) or (e) of section 1681b of this title, relating to the prescreening of consumer reports." [Emphasis added to indicate the limiting language referred to in the American Bankers' Association brief.] 48 Authorities cited for this include the detailed legislative history analysis written by the General Counsel of the House Banking Committee during the time of Congressional consideration of the 1996 FCRA amendments, i.e., Joseph L. Seidel, The Consumer Credit Reporting Reform Act: Information Sharing and Preemption, 2 N.C. Banking Institute 79 (1998). 49 Floor statements include those of Sen. Feinstein, 149 Cong. Rec. S13848, 13860 (November 4, 2003, daily ed.); Sen. Boxer, id., at S13874; Sen. Shelby, floor manager of the bill, 149 Cong. Rec. S13863, 13873 (November 4, 2003 daily ed.); and Sen Durbin, 149 Cong. Rec. at S13875 (November 4, 2003, daily ed.). 50 145 Cong. Rec. S13883, 13901 (daily ed. Nov. 4, 1999), in which Sen. Gramm assured Sen. Mack that "Section 507 is intended to apply only to subtitle A of title V of the bill, and is not to be construed to apply to any provision of law other than the provisions of this subtitle. Thus, section 507 does not affect the existing FCRA provisions on that statute's relationship to state laws." 51 Regulators' Brief, at 16. 52 Id., at 14. 53 Regulators' Brief, at 1-2. CRS-11 to regulation as credit reporting agencies. In the 1990's, this became a problem for holding companies: transaction and experience information could be shared with an affiliate without triggering the added regulatory requirements, but information derived from one affiliate could not be shared by another affiliate with a third affiliate. Anything else could not be shared among affiliates without compliance with the obligations imposed on credit reporting agencies. In that situation, according to the regulators, affiliated companies were inhibited from sharing any information among themselves. The 1996 amendments remedied this by treating affiliated companies as if they were one company for the purposes of sharing experience and transaction information and by permitting affiliated companies to share other information among affiliates subject to an opt-out. According to the regulators: At the same time that it established the federal criteria that enabled affiliates to share a broad range of consumer information without becoming consumer reporting agencies, the 1996 legislation also expressly preempted state laws that impose requirements or prohibitions `with respect to the exchange of information among persons affiliated by common ownership or common corporate control.' 15 U.S.C. § 1681t(b)92). The type of information covered by this preemption was not limited to `consumer report' information. The combined effect of these provisions was to set national, uniform requirements for the sharing of consumer information among affiliates.54 They argue that GLBA's anti-preemption clause does not permit the states to enact restrictions on affiliate information sharing; rather, it is limited to the provisions of GLBA and does not affect the preemptive force of FCRA. California, supported by 27 states55 and the District of Columbia, argues for upholding the district court's ruling. California has four major arguments. The first is that the presumption against preemption in state police power cases requires unambiguous statutory language. California maintains that the right of the states "to legislate within their historic police power to protect consumers" requires that the preemptive language be given a narrow reading to preempt only state consumer reporting laws, rather than all state laws.56 It sees the language at issue as ambiguous. It contend that even the American Bankers' Association is not advocating a literal reading of the plain language of the preemptive clause of the FCRA and that such a reading would invalidate all state laws respecting information sharing, "financial or consumer or otherwise," among affiliated corporations.57 54 Regulators' Brief, at 6. 55 Vermont, Arkansas, Colorado, Connecticut, Delaware, Hawaii, Illinois, Iowa, Louisiana, Maine, Maryland, Massachusetts, Minnesota, Mississippi, Montana, Nevada, New Hampshire, New Mexico, New York, North Dakota, Ohio, Oklahoma, Oregon, Rhode Island Tennessee, Washington, and Wisconsin. 56 Brief of Appellees California Attorney General Bill Lockyer and California Insurance Commissioner John Garamendi, American Bankers Association v. Lockyer 2 (9th Cir. No. 04-16334) (hereinafter, Brief of Appellees). 57 Id., at 11. CRS-12 The state offers a second argument, that the FCRA preemption provision preempts only state laws regulating consumer reporting. This draws on 1996 legislative history for support. According to California, the motivating factor and main purpose of preempting state laws with respect to information sharing among affiliates was to eliminate the possibility that affiliated companies would be treated as credit reporting agencies under the FCRA and under state credit reporting laws. The state argues that the banking associations "have not cited anything in the legislative history of the 1996 amendments supporting their interpretation that Congress intended the FCRA to reach beyond the scope of consumer reporting to void state financial privacy laws like [the California law]."58 A third argument characterizes the American Bankers' Association's resort to FACT Act legislative history as "muddying the waters" and "legally and logically irrelevant in discerning the intent of Congress when it added the affiliate-sharing preemption provision to the FCRA in 1996."59 According to California, the FACT Act did not alter the meaning of the preemption clause; it merely eliminated a provision by which it was scheduled to sunset. It asks the court to refrain from drawing any inference that California's law was considered preempted by any failure by Congress to enact any proposed amendments60 A final argument relies on the savings clause in GLBA's privacy title. According to the state, GLBA "expressly preserved the ability of the states to enact consumer protection statutes providing greater privacy protection," and that "[t]his is precisely what California did."61 The brief relies on legislative history, particularly the statement by Senator Sarbanes , supra at 8, that was quoted in the district court's decision.62 Analysis of the District Court's Decision The district court's ruling, with its refusal to limit itself to the strict language of the FCRA preemption clause and its narrow reading of FCRA's potential reach and of the legislative history of the 1996 and 2003 amendments, may have surprised legislators, regulators, and financial services trade groups. It may have been welcomed by consumer groups, privacy advocates, and opponents of increasing federal power. Whether the decision is ultimately reversed or not, the ruling is interesting because it appears to embrace a view of a provision, the temporary enactment and permanent extension of which was hotly debated, widely discussed, and almost universally acknowledged to be precisely what the court ruled it was not. The reason for the disparity between the perception during the debate and the interpretation of the court, six months later, may, therefore, provide some 58 Id., at 23. 59 Id., at 2. 60 Authorities cited included Solid Waste Agency v. United States Army Corp of Engineers, 531 U.S. 159 (2001) and Pension Benefit Guar. Corp. v. LTV Corp., 496 U.S. 633 (1990). 61 Id., at 10. 62 Id., at 64. CRS-13 illumination to followers of the legislative process. The straight language of the affiliate information sharing preemption was not free-standing legislation but was surrounded by the language, structure, and purposes of the Fair Credit Reporting Act. It was the placing of this language within the confines and constrictions of a law that had limited purposes that was viewed by the district court as requiring a contextual analysis rather than a limited parsing of the verbiage of the simple language of the affiliate information sharing preemption. Despite this fact, however, there are various issues that the district court's opinion raises that might lead an appellate court to reach a different conclusion. Among them are the following: 1. Did the court do a sufficient job of analyzing what the FCRA regulates? FCRA regulates "consumer reporting agencies," which, by definition would likely include financial services companies that share with their affiliates the kind of information that is covered by the FCRA definition of "consumer report." Specifically, financial services companies share non-transaction and non-experience information bearing on a consumer's credit worthiness, which is used or expected to be used to serve in determining eligibility for credit, insurance, employment or other purposes covered by the FCRA.63 Such information is regulated by the FCRA when it is disseminated among affiliated companies unless the company disclosing such information to its affiliates provides consumers with a notice and an opt-out. Without the notice and opt-out, the disclosure would constitute a consumer credit report under FCRA and, thus, by inference, the disclosing company would be subject to regulation as a credit reporting agency. 2. The court, in construing the statute, overlooked the statutory history of the 1996 amendments. While there is considerable ambiguity in this legislative history, it may provide support for the view that Congress intended to preclude any state law placing further limits on interaffiliate sharing of information on consumers.64 3. The court's analysis of GLBA may be open to question. As the court, in Bank of America, N.A. v. City of Daly City,65 recognized, most commentators have read GLBA to be a law regulating the sharing of nonpublic personal information about consumers by companies with non-affiliated third parties, not a general law regulating the sharing of such information among affiliates and non-affiliated third parties. Its only provision respecting sharing of information among affiliates is the requirement that the institution's policy with respect to sharing information among affiliates be disclosed in its privacy notice. Its only specification with respect to this notice is that the notice under the FCRA opt-out requirement be included in the GLBA privacy notice. 63 15 U.S.C. § 1681a(d). 64 See, Seidel, supra, n.48. 65 Bank of America, N.A. v. City of Daly City, 279 F. Supp. 2d 1118 (N.D. Cal. 2003), vacated as moot, 9th Cir. May 14, 2004. The district court held local ordinances invalid as having been preempted by the FCRA language. On appeal of another issue, the decision was vacated as moot. CRS-14 4. OCC, one of the regulators charged with writing the GLBA rules, has taken the position that "[t]he FCRA preemption provision ensures that affiliated entities may share customer information without interference from State law and subject only to the FCRA notice and opt-out requirements if applicable. The preemption is broad and extends beyond state information sharing statutes to preempt any State statute that affects the ability of an entity to share any information with its affiliates. Congress intended the preemption provision to establish a national uniform standard in this area ...."66 The Ninth Circuit Ruling: American Bankers Association v. Gould67 On appeal, the U.S. Court of Appeals for the Ninth Circuit reversed the district court and held that the California law was preempted by the FCRA's affiliate- information-sharing provisions. The court was careful to limit its holding by emphasizing that the preemption extended only to "information" covered by the FCRA definition of "consumer report."68 The court outlined FCRA as a regime governing "consumer reporting agencies" and "consumer reports," which exempts from its coverage the sharing of consumer-report information among affiliated companies under certain conditions. To reach these conclusions it set forth premises on which its analysis of the preemptive scope of federal legislation was based: (1) preemption depends on congressional intent; (2) in an area of traditional state authority, such as consumer protection, congressional intent must be clear; (3) analysis must begin with the plain statutory language, which is to be viewed within the overall context of the regulatory scheme, interpreted as a coordinated whole.69 The court found FCRA's preemption to cover only information within the FCRA definition of "consumer report." That definition extends to "information ... bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living which is used or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing the consumer's eligibility for" certain purposes.70 It remanded 66 Letter from Julie L. Williams, First Senior Deputy Comptroller and Chief Counsel, Office of the Comptroller of the Currency, to Sandra Murphy, Bowles Brice McDavid Graff & Love (September 24, 2001), quoted in Bank of America v. City of Daly City, 279 F. Supp. 2d 1118, 1122 (N.D. Cal. 2003), vacated as moot ___ F.3d ___ (9th Cir. 2004). 67 412 F. 3d 1081 (9th Cir. 2005). 68 15 U.S.C. § 1681a(d)(1). 69 For this, the court relied on Food & Drug Admin. v. Brown & WilliamsonTobacco Corp., 529 U.S. 120, 133 (2000). 70 15 U.S.C. § 1681a(d)(1). This specifies the following authorized purposes: "(A) credit or insurance to be used primarily for personal, family, or household purposes; (b) employment; or (C) any other purpose authorized under 1681b of this title." Id. Section 1681(b) adds, among others, the following purposes, subject to certain conditions: "determination of the consumer's eligibility for a license or other benefit granted by a governmental instrumentality ..."; for insurance underwriting determinations involving the (continued...) CRS-15 the case to the district court for a determination of whether, in light of the restricted meaning of "information" under FCRA, any of the affiliate-information-sharing provisions of the California law survive preemption under FCRA, and, if so, whether such provisions could be severed so as to be enforceable. It also ruled that the provision of GLBA purporting to preserve FCRA's operation,71 acted to preserve FCRA's preemptive scope, thus, making GLBA's anti- preemption clause72 irrelevant. District Court Ruling on Remand: American Bankers Association v. Lockyer73 On October 4, 2005, in American Bankers Association v. Lockyer, the district court issued an injunction against the enforcement of the affiliate information-sharing provisions of the California legislation. It found no practicable way of distinguishing FCRA affiliate information-sharing protected by the FACT Act preemption clause from affiliate information-sharing which could be subjected to state law. The court began with the premise, derived from the FCRA definition of "consumer report,"74 that FCRA covered "information" that met two standards: scope and use. For information to be considered a "consumer report," it must be the type of information falling within the scope set forth in the definition of "consumer report." It must also meet the definition's condition that the information be used for one of the purposes set forth in the definition. The court found that virtually all information collected on consumers would fall within the identified scope since it was likely to concern "credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of,"75 but that only a portion of the information collected by 70 (...continued) consumer; child support enforcement; and response to a court order or a federal grand jury subpoena. 71 15 U.S.C. § 6806. 72 15 U.S.C. § 6807. 73 __ F.Supp. 2d ___, 2005 WL2452798 (E.D.Cal. 2005). 74 15 U.S.C. § 1681a(d)(1). Under this definition: The term "consumer report" means any written, oral, or other communication of any information by a consumer reporting agency bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living which is used or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing the consumer's eligibility for-- (A) credit or insurance to be used primarily for personal, family, or household purposes; (B) employment purposes; or (C) any other purpose authorized under section 604 75 "Scope" covers information that concerns a consumer's "credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of (continued...) CRS-16 the plaintiff financial institutions fit within FCRA authorized purposes.76 The problem, however, was that there was no way of determining in advance which pieces of information would never be put to one of the uses or purposes covered by the FCRA.77 The court also decided that it had no power to sever those portions of the California statute's affiliate information-sharing provisions that were unconstitutional as being federally preempted from any that could survive. California's Attorney General, Bill Lockyer, has appealed the district court ruling.78 Legislation Although no specific legislation has been introduced to address the California situation, there have been measures to address the question of financial privacy generally.79 There is a possibility that, since the appeals court has upheld the position of federal regulators and financial services industry trade associations, consumer advocates might seek legislation to overturn the decision. This could mean a replay of the policy debates occurring prior to passage of the FACT Act. Consumer advocates80 and state attorneys generals81 would again speak in favor of preempting only state law that does not provide consumers the same level of protection; and federal regulators and financial services companies would argue for the national uniformity that federal preemptions brings. 75 (...continued) living." 15 U.S.C. § 1681a(d)(1). 76 FCRA covers "information" that is "used, expected to be used, or collected for the purpose of establishing eligibility for credit or insurance, employment, or [other authorized purposes]. 15 U.S.C. §1681a(d)(1). 77 The court stated that, "[w]hile in theory it seems financial institutions could delineate in advance what information enjoys federal protection and which does not, in practice any such delineation would simply be conjecture." 2005 WL 2452798, at 3. 78 American Bankers Assoc. v. Lockyer, 9th Cir. No. 05-17163, appeal docketed 11/9/05). 79 See CRS Report RS20185, Privacy Protection for Customer Financial Information, by M. Maureen Murphy. 80 See Hearings on H.R. 1622, the Fair and Accurate Credit Transactions Act before the , House Committee on Financial Services (July 9,2003), Testimony of Chris Hofnagle, Deputy Counsel, Electronic Privacy Information Center and Testimony of Stephen Broback, Education Director, Consumer Federation of America, at 4, ff. Available September 30, 2004 at [http://financialservices.house.gov/hearings.asp?formmode=detail&hearing=244]. 81 See Hearings on Fair Credit Reporting Act: How it Functions for Consumers and the Economy before the Subcommittee on Financial Institutions and Consumer Affairs of the House Financial Services Committee (June 4, 2003), Testimony of Julie Brill, Assistant Attorney General of the State of Vermont, at 16. Available September 30, 2004 at [http://financialservices.house.gov/hearings.asp?formmode=detail&hearing=225]. ------------------------------------------------------------------------------ For other versions of this document, see http://wikileaks.org/wiki/CRS-RL32626