How the Privacy Provisions of the Gramm-Leach-Bliley Act Affect Your Business

As of July, 1, 2001 the Gramm-Leach-Bliley Act ("Act") will require financial institutions to make certain privacy disclosures to consumers. These requirements will not apply to real estate brokerage services and property management activities, but will likely apply to real estate brokers who involve themselves in the mortgage loan process. Appraisers have disclosure obligations when they have been hired directly by a consumer to conduct an appraisal. Appraisers are not covered by the Act when performing an appraisal at the request of a lending institution. This article will discuss who is required to make privacy disclosures, when the disclosures need to be made, and how the disclosures should be made.

The Act's Implementing Regulations

The Act governs the collection, use, and disclosure of nonpublic personal information by financial institutions. Financial institutions are involved in several aspects of the real estate transaction, chief among those being the mortgage loan. The parties involved with mortgage loans must comply with the terms of the regulations.

Briefly stated, the regulations implementing the Act require the newly-authorized combination of banking, securities, and insurance businesses to disclose to consumers their policy regarding the disclosure of nonpublic personal information to unaffiliated third parties. Consumers are defined as those persons seeking a financial product or service for their personal, family, or household use. Consumers have the option to prevent disclosure of their personal information.

Brokers and Property Managers

The regulations apply to all businesses that are described by the regulations as engaging in a "financial activity." Financial activities are defined in the regulations as those activities described in Section 4(k) of the Bank Holding Company Act, including those which the Federal Reserve finds to be "closely related to banking." Although the Federal Reserve uses the term "real estate settlement services" in its regulation to describe activities "closely related to banking," for purposes of this regulation, real estate settlement services do not include real estate brokerage services and property management activities.

How the regulations will likely apply to the following:

Appraisers

The disclosure obligations of real estate appraisers is determined by the status of the person contracting for the appraisal. Appraisers who deliver their service through a bank, for example, are not covered because there is no consumer or customer relationship created with the appraiser. On the other hand, an appraiser doing the same appraisal for an individual would be included under the regulation.

Other Activities

Real estate brokers who are involved in other ancillary services related to the transaction will have to consider the application of the regulations to those other services. Those involved in mortgage lending or mortgage brokering are covered because they are engaged in the lending functions. Members engaged in the mortgage loan process are encouraged to consult with an attorney on the affect of the regulation.

What Disclosures Need to Be Made

If the disclosure obligation arises, the discloser must inform its consumers and customers about how their "nonpublic personally identifiable information" will be used. Nonpublic personally identifiable information is any information collected, either directly or indirectly, from the consumer in connection with the providing of a financial product or service. While information available from a public source is not included in this definition, it is the responsibility of the business to assure that any information it classifies as publicly available is in fact available. When the disclosure obligation arises, it is recommended that those parties consult closely with their attorney about the type of disclosure that needs to be made and when this disclosure needs to be made.

The regulations state that a consumer must receive an initial disclosure notice (defined below) if the business intends to share any nonpublic personally identifiable information with unaffiliated third parties. The consumer must also be given the ability to opt out. No notice is required for a consumer when the business does not share the nonpublic personally identifiable information. However, once a consumer establishes a "customer relationship" with the business, the customer must be provided at the outset of the customer relationship with a copy of the privacy policy notice of the business and annually thereafter until the customer relationship terminates, regardless of whether the information is being shared with unaffiliated third parties or not.

Type of Disclosure Form

The regulation makes the preparation of the form needed to accomplish the disclosure a complicated task. There is no standard form that will work for everyone. While the regulations contain some example clauses, they also make it clear that compliance requires the covered financial institution to review its own policies and practices concerning nonpublic personal information and tailor its disclosure form to reflect those practices.

Nine points must be covered in the disclosure form, when applicable. These nine items are:
(1) the categories of nonpublic personal information that are collected;
(2) the categories of nonpublic personal information that are disclosed;
(3) the categories of affiliated and nonaffiliated third parties (unless one of the exceptions applies) to whom nonpublic personal information is disclosed;
(4) the categories of nonpublic personal information disclosed about former customers, and the categories of affiliated and nonaffiliated third parties (unless one of the exceptions applies) to whom it is disclosed;
(5) if nonpublic personal information is disclosed to a nonaffiliated third party who provides services or function on behalf of the business, the categories of information used must be disclosed as well as the categories of nonaffiliated third parties with whom the business has contracted;
(6) an explanation of the consumer's right to opt out of the disclosure of nonpublic personal information to nonaffiliated parties and how the consumer may exercise that right;
(7) any disclosure required under the Fair Credit Reporting Act relating to the ability of a consumer to opt out of the disclosure of personal information to affiliated third parties;
(8) the policies and practices followed to protect the confidentiality and security of the nonpublic personal information collected; and
(9) notice of any disclosure of nonpublic personal information permitted under the exceptions contained in the regulations.

The regulations contain a couple of exceptions concerning the disclosure related to the processing and servicing of the customer's transaction. The exception most relevant to this discussion is the for a proposed or actual loan securitization, secondary market sale (including sales of servicing rights), or a similar transaction would qualify for the exception, when disclosure would otherwise be required. When this exception applies, the regulations require only that this form disclose to the customer that the business makes disclosures to other nonaffiliated third parties as permitted by law.

Conclusion

On July 1, 2001, the Act takes effect. Real estate brokerage services and property management will not be affected by the new regulations. Appraisers may be affected, depending on who contracts for the appraisal. A real estate broker or anyone else who involves themselves in a financial activity, as defined in the Act, will be required to make the privacy disclosures mandated by the Act.