Consumer Law & Policy Blog

Financial Privacy Legislation May Lead to Simplified Notices; What Will the Effect be on Consumer Opt-outs?

by Jeff Sovern

In 1999, Congress enacted the Gramm-Leach-Bliley Act, 15 U.S.C. § 6801 et seq., permitting financial institutions to disclose information about their customers provided they notified customers that they have the right to keep the information confidential.  The result has been a flood of privacy notices.  See W.A. Lee, Opt-Out Notices Give No One a Thrill, 166 Am. Banker Issue 131, at 1 (July 10, 2001) (more than a billion notices sent to consumers by that time).   It appears that few consumers have opted out, with estimates running under ten percent, though little information on opt-outs has been available.   Why have so few consumers opted out?  Is it because few consumers actually care enough about the privacy of their financial information to opt-out?  Or is it because consumers have so much difficulty wading through the notices?  In that regard, critics have complained about the readability of the notices (though the Lee article cited above reports that an American Bankers Association telephone survey found that two-thirds of the consumers who said they had received the notices also said they read them), see John Schwartz, Privacy Policy Notices are Called Too Common and Too Confusing, N.Y. Times, May 7, 2001 at A1; Mark Hochhauser, Lost in the Fine Print: Readability of Financial Privacy Notices (2001), while some have implied that financial institutions prefer complicated forms.  Here, for example, is an excerpt from a speech by Julie Williams, then-Acting Comptroller of the Currency, given on July 12, 2005:

[W]hen presented with the prospect of lessening burden and saving costs by providing a streamlined, short form privacy notice containing only certain key information – some in the industry seem to balk. Marketing departments get uneasy because simple and straightforward disclosure of a bank’s information sharing policies and an easy means for customers to opt out of that sharing might mean – that customers will actually understand those policies – and decide to opt out! The tension here is that shorter, focused consumer disclosures can meaningfully reduce regulatory burden, but, if they are done well, they will also empower consumers to make some decisions that a particular bank may not like.

(emphasis in original).  Soon we may get a chance to find out whether and how consumers respond to simplified notices.  Last fall Congress added a new subsection (e) to 15 U.S.C. § 6803, directing federal regulators to develop a model privacy disclosure form.  Federal regulators presumably have no incentive to fashion a form that is more complex than necessary, and so, If we're lucky, the new form will be both short and comprehensible.  While financial institutions will be under no obligation to use the model form, the statute offers them an incentive to do so by providing that those using the model form will be deemed in compliance with the statute.  And if financial institutions prefer their own more complicated forms to the simpler form, that too will say something.

Telephone Record Privacy

Observers of privacy in the United States have long commented on how privacy protections are largely sectoral and enacted in response to particular incidents.  For example, after a newspaper printed the video rental records of then-Supreme Court nominee Robert Bork (revealing that he had a taste for westerns), Congress enacted 18 U.S.C. § 2710, protecting the privacy of video records.  In the wake of the Hewlett-Packard pretexting scandal, Congress has now repeated the pattern for telephone privacy by enacting the Telephone Records and Privacy Protection Act of 2006, Pub. L. No. 109-476, 120 Stat. 3568, which adds a new section 1039 to title 18 of the U.S. Code.  The statute bars obtaining or attempting to obtain confidential phone records by pretexting or via the Internet without the permission of the consumer to whom the records pertain as well as selling, purchasing, or receiving confidential phone records without the permission of the affected consumer.

Brian Wolfman had blogged on the bill (at the point at which it had been passed by the Senate) back on December 9.

Can Everything You Search Be Used Against You?

by Greg Beck

CNET’s Declan McCullagh highlights a recent 7th Circuit decision that hasn’t received much attention until now.  The court in United States v. Schuster upheld a hacker’s fifteen-month prison sentence for breaking into a wireless network service and interfering with other users, relying in part on the defendant's Google searches for “how to broadcast interference over wifi 2.4 GHZ,” “interference over wifi 2.4 Ghz,” “wireless networks 2.4 interference,” and “make device interfere wireless network.”  As the article points out, this is not the first time Google search terms have been used to support a criminal conviction.  A North Carolina murder defendant was convicted last year in part based on his searches for the words “neck,” “snap,” “break,” and “hold” after police recovered the search data from his computer.

Although there is no indication in the court's opinion about how prosecutors in this case obtained the search data, Google has acknowledged that it can trace searches back to a particular computer or, in some cases, to a particular user.  What exactly does Google know about you?  Its privacy policy states that it automatically records information that your browser sends whenever you visit a website. This can include your search terms, IP address, date and time of your search request, and, if you have cookies enabled, possibly your personal identity.  Google also acknowledges that it can track which links you click from its search results.  In short, Google may have several years’ worth of your search activity stored in its databases, and it may be able to connect much or all of this activity back to you.

New Phishing Scams

by Jeff Sovern

Phishing scams depend on consumers recognizing the name of an institution where they might have an account or that might possibly owe them money so the consumers will be deceived into providing personal information useful to the phishers.  Consequently, I wasn't surprised recently to receive phishing emails purporting to be from Paypal, where I don't have an account, but of course many consumers do.  But now the Office of the Comptroller of the Currency has issued an alert describing what sounds like a phishing scheme using its name.  Probably few consumers have heard of the OCC and so we can hope that their ignorance will prevent them from falling into the trap.  The use of the OCC's name suggests a different level of sophistication by phishers, but is it a higher or lower level?  I wonder what other institutions will be impersonated by phishers--who seem to be identity thieves who pretend to be institutions rather than individuals. 

Anti-Pretexting Bill Passes Senate, Expected to Become Law

    By Brian Wolfman

    Over at U.S. PIRG's Consumer Blog, Ed Mierzwinski explains that last night the U.S. Senate agreed to a bill earlier passed unanimously by the House that criminalizes pretexting for the purpose of obtaining the phone records of a private individual.  Ed points out both that "pretexting" is a euphemism for lying and that the bill, which is expected to be signed by the President, is weaker than legislation favored by consumer advocates.  The bill does not preempt state law, however, as did some versions of the legislation.  The legislation may not be enforced vigorously, as it does not create an express private right of action.  A House Judiciary Committee Report on the legislation appears here.    

Times Reports Bad News for Consumers: More Spam and HIgher Interest Rates on Subprime Loans

Today's New York Times has two articles relevant to consumer law.  The first article reports on an increase in the amount of spam getting through spam filters; at the moment, in the seesaw battle between the senders and blockers of spam, it appears that the senders are winning.  It will hardly come as a surprise that the federal CANSPAM statute has not solved the problem.  The second article describes the problems caused subprime borrowers by the rise in interest rates.

The Movie Industry Killed California's Pretexting Legislation

by Greg Beck

According to Wired Magazine, a "tough California bill that would have prohibited companies and individuals from using deceptive 'pretexting' ruses to steal private information about consumers was killed after determined lobbying by the motion picture industry." 

S.B. 1666 would have barred the practice of using false representations to obtain private customer data, going far beyond phone records to cover any sort of personal information kept in business records.  It would also have provided a civil cause of action, including a provision for attorneys' fees and statutory damages of $500 per violation (or $3000 per violation in willful cases).

After passing the California Senate 30-0, Wired reports that the bill met last-minute resistance from the Motion Picture Association of America and was voted down 33-27 in the assembly.  Apparently, the MPAA was worried that the bill would hamstring its investigations into movie piracy.

The California legislature instead passed S.B. 202, which creates criminal liability for the acquisition of telephone records through pretexting but does not cover other forms of personal information.  It also does not include a civil remedy.

The Precydent Search Engine and the Web of Law

My colleague at USD Tom Smith has a fascinating study on lately legal citation networks. In his paper The Web of Law he researches the structure of citation of nearly four million American legal precedents to shed light on how the legal system evolves, demonstrating that the American case law network has the overall structure that network theory predicts it would, with clusters, node and patterned aging.

Now Tom and his co-author Antonio Tomarchio, a mathematics graduate student at the Polytechnic of Milan and the Ecole Centrale Paris, have launched http://www.precydent.com. Tom desribes it as “a new kind of legal search engine…Unlike the search engines at Westlaw, Lexis and other legal research services, the Precydent search engine is based on the legal citation network and various Web 3.0 technologies.  Like Google's PageRank algorithm, Precydent's algorithm traces its intellectual ancestry to important discoveries about networks made by Cornell computer scientist Jon Kleinberg, who also generously assisted Antonio in his academic research on the legal citation network.  The algorithm and its many innovative features are the creations of the Precydent team. The search engine does use sophisticated techniques to analyze click streams in order to adapt to users' individual and collective preferences.  While I do not think this raises any privacy concerns, I should at least note this feature of the technology.  Analyzing user behavior is an important part of Web 3.0 technology.” When the founders compared the performance of the Precydent search engine to that of the natural language search engines of Westlaw and Lexis, they found that “Precydent does a much better job in returning relevant and authoritative US Supreme Court cases (as judged by human experts) than do the natural language engines of Westlaw and Lexis.”

(cross posted on Prawfsblawg)

Cellphone Tracking and Privacy

by Jeff Sovern

An article in today's New York Times, "Cellphone as Tracker: X Marks Your Doubts," is noteworthy for at least two reasons: first, it reports on the use of cellphones to track and report people's locations for social purposes, and second, it describes how the cell phone industry petitioned the FCC to draft rules guaranteeing privacy protections, and the FCC refused.  Apparently the industry thought that consumers would feel more comfortable purchasing their services if regulations protected consumer privacy.  It's unusual for a business to ask government to protect its customers from the business.

FTC Proposes to Ban Most Prerecorded Telemarketing Messages

    By Brian Wolfman

    In an October 4, 2006, Federal Register notice, 71 Fed. Reg. 58,176, the Federal Trade Commission has proposed to prohibit all prerecorded telemarketing messages to consumers except where the seller has obtained the consumer's written consent to receive such prerecorded calls. 

Interestingly, the FTC's proposed rule was issued in response to a petition (which the agency denied) from the Voice Mail Broadcasting Corp. (VMBC) urging the FTC to permit all prerecorded messages to consumers with whom the seller had an "established business relationship."  According to the FTC, about 13,600 consumers responded to the petition, with over 13,000 opposing VMBC's position.  The FTC cited the overwhelming consumer opposition to VMBC's petition as one reason for the proposed rule.  Comments on the proposed rule are due by November 6, 2006.  An FTC synopsis of the proposal appears here.