[Federal Register Volume 79, Number 179 (Tuesday, September 16, 2014)]
[Notices]
[Pages 55489-55492]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2014-22054]
=======================================================================
-----------------------------------------------------------------------
FEDERAL TRADE COMMISSION
Agency Information Collection Activities; Submission for OMB
Review; Comment Request
AGENCY: Federal Trade Commission.
ACTION: Notice and request for comment.
-----------------------------------------------------------------------
SUMMARY: In compliance with the Paperwork Reduction Act (PRA) of 1995,
the Federal Trade Commission (``FTC'' or ``Commission'') is seeking
public comments on its request to the Office of Management and Budget
(``OMB'') for a three-year extension of the current PRA clearance for
the information collection requirements contained in the Gramm-Leach-
Bliley Financial Privacy Rule (GLB Privacy Rule), 16 CFR part 313. That
clearance expires on September 30, 2014.
DATES: Comments must be received by October 16, 2014.
ADDRESSES: Interested parties may file a comment online or on paper, by
following the instructions in the Request for Comment part of the
SUPPLEMENTARY INFORMATION section below. You may file your comment
online at https://ftcpublic.commentworks.com/ftc/glbfinancialrulepra2
by following the instructions on the Web-based form. If you prefer to
file your comment on paper, mail or deliver your comment to the
following address: Federal Trade Commission, Office of the Secretary,
600 Pennsylvania Avenue NW., Suite CC-5610 (Annex J), Washington, DC
20580, or deliver your comment to the following address: Federal Trade
Commission, Office of the Secretary, Constitution Center, 400 7th
Street SW., 5th Floor, Suite 5610 (Annex J), Washington, DC 20024.
Comments on the information collection requirements subject to
review under the PRA should also be submitted to OMB. If sent by U.S.
mail, address comments to: Office of Information and Regulatory
Affairs, Office of Management and Budget, Attention: Desk Officer for
the Federal Trade Commission, New Executive Office Building, Docket
Library, Room 10102, 725 17th Street NW., Washington, DC 20503.
Comments sent to OMB by U.S. postal mail, however, are subject to
delays due to heightened security precautions. Thus, comments instead
should be sent by facsimile to (202) 395-5167.
FOR FURTHER INFORMATION CONTACT: Requests for additional information or
copies of the proposed information requirements should be addressed to
Jessica Lyon, Attorney, Division of Privacy and Identity Protection,
Bureau of Consumer Protection, Federal Trade Commission, 600
Pennsylvania Avenue NW., Drop Box 8232, Washington, DC 20580, (202)
326-2344.
SUPPLEMENTARY INFORMATION:
Title: GLB Privacy Rule (officially titled Privacy of Consumer
Financial Information Rule), 16 CFR part 313.
OMB Control Number: 3084-0121.
Type of Review: Extension of a currently approved collection.
Abstract: The GLB Privacy Rule is designed to ensure that customers
and consumers, subject to certain exceptions, will have access to the
privacy policies of the financial institutions with which they conduct
business. As mandated by the Gramm-Leach-Bliley Act, 15 U.S.C. 6801-
6809, the Rule implements consumer disclosure requirements that are
subject to the provisions of the PRA. The Rule requires financial
institutions to disclose to consumers: (1) Initial notice of the
financial institution's privacy policy when establishing a customer
relationship with a consumer and/or before sharing a consumer's non-
public personal information with certain nonaffiliated third parties;
(2) notice of the consumer's right to opt out of information sharing
with such parties; (3) annual notice of the institution's privacy
policy to any continuing customer; \1\ and (4) notice of changes in the
institution's practices on information sharing. The Rule does not
require recordkeeping. For PRA burden calculations the FTC has
attributed to itself the burden for all motor vehicle dealers and then
shares equally the remaining PRA burden with the Consumer Financial
Protection Bureau (CFPB) for other types of financial institutions for
which both agencies have enforcement authority regarding the GLB
Privacy Rule.
---------------------------------------------------------------------------
\1\ The Consumer Financial Protection Bureau has proposed
amending Regulation P, to create an alternative delivery method for
this annual disclosure, which financial institutions would be able
to use under certain conditions. See 79 FR 27214 (May 13, 2014).
Specifically, the CFPB proposes allowing financial institutions that
do not engage in certain types of information-sharing activities to
stop mailing an annual disclosure if they post the annual notices on
their Web sites and meet certain other criteria. A financial
institution would still be required to mail a disclosure if the
institution, among other things, has changed its privacy practices
or engages in information-sharing activities for which customers
have a right to opt out.
---------------------------------------------------------------------------
On June 19, 2014, the Commission sought comment on the Rule's
information collection requirements.\2\ The Commission did not receive
any comments. As required by OMB regulations, 5 CFR 1320, the FTC is
providing this second opportunity for public comment.
---------------------------------------------------------------------------
\2\ See 79 FR 35158 (60-Day Federal Register Notice).
---------------------------------------------------------------------------
Estimated annual hours burden: 1,515,050 annual hours (FTC
portion).
As noted in previous burden estimates for the GLB Privacy Rule,
determining the PRA burden of the Rule's disclosure requirements is
very
[[Page 55490]]
difficult because of the highly diverse group of affected entities,
consisting of financial institutions not regulated by a Federal
financial regulatory agency. See 15 U.S.C. 6805 (committing to the
Commission's jurisdiction entities that are not specifically subject to
another agency's jurisdiction).
The burden estimates represent the FTC staff's best assessment,
based on its knowledge and expertise relating to the financial
institutions subject to the Commission's jurisdiction under this law.
To derive these estimates, staff considered the wide variations in
covered entities. In some instances, covered entities may make the
required disclosures in the ordinary course of business, apart from the
GLB Privacy Rule. In addition, some entities may use highly automated
means to provide the required disclosures, while others may rely on
methods requiring more manual effort. The burden estimates shown below
include the time that may be necessary to train staff to comply with
the regulations. These figures are averages based on staff's best
estimate of the burden incurred over the broad spectrum of covered
entities.
Staff estimates that the number of entities each year that will
address the GLB Privacy Rule for the first time will be 5,000 and the
number of established entities already familiar with the Rule will be
100,000. While the number of established entities familiar with the
Rule would theoretically increase each year with the addition of new
entrants, staff retains its estimate of established entities for each
successive year given that a number of the established entities will
close in any given year, and also given the difficulty of establishing
a more precise estimate.
Staff believes that the usage of the model privacy form and the
availability of the form builder simplify and automate much of the work
associated with creating the disclosure documents for new entrants.
Staff thus estimates 1 hour of clerical time and 2 hours of
professional/technical time per new entrant.
For established entities, staff similarly believes that the usage
of the model privacy form and the availability of the Online Form
Builder reduces the time associated with the modification of the
notices. Staff thus estimates 7 hours of clerical time and 3 hours of
professional/technical time per respondent. Staff estimates that no
more than 1% of the estimated 100,000 established-entity respondents
would make additional changes to privacy policies at any time other
than the occasion of the annual notice.
The complete burden estimates for new entrants and established
entities are detailed in the charts below.
Annual Start-Up Hours and Labor Costs for all New Entrants
[Table IA]
----------------------------------------------------------------------------------------------------------------
Hourly wage and Hours per Approx. number Approx. total Approx. total
Event labor category * respondent of respondents annual hrs. labor costs
----------------------------------------------------------------------------------------------------------------
Reviewing internal policies $41.82 20 5,000 100,000 $4,182,000
and developing GLBA- Professional/
implementing instructions **. Technical.
Creating disclosure document $16.78 Clerical. 1 5,000 5,000 83,900
or electronic disclosure $41.82 2 5,000 10,000 418,200
(including initial, annual, Professional/
and opt-out disclosures). Technical.
Disseminating initial $16.78 Clerical. 15 5,000 75,000 1,258,500
disclosure (including opt-out $41.82 10 5,000 50,000 2,091,000
notices). Professional/
Technical.
---------------------------------------------------------------
Total..................... ................ .............. .............. 240,000 $8,033,600
----------------------------------------------------------------------------------------------------------------
*Staff calculated labor costs by applying appropriate hourly cost figures to burden hours. The hourly rates used
were based on mean wages for Financial Examiners and for Office and Administrative Support, corresponding to
professional/technical time (e.g., compliance evaluation and/or planning, designing and producing notices,
reviewing and updating information systems), and clerical time (e.g., reproduction tasks, filing, and, where
applicable to the given event, typing or mailing) respectively. See BLS Occupational Employment and Wages, May
2013, Table 1 at http://www.bls.gov/news.release/pdf/ocwage.pdf. Labor cost totals reflect solely that of the
commercial entities affected. Staff estimates that the time required of consumers to respond affirmatively to
respondents' opt-out programs (be it manually or electronically) would be minimal.
**Reviewing instructions includes all efforts performed by or for the respondent to: Determine whether and to
what extent the respondent is covered by an agency collection of information, understand the nature of the
request, and determine the appropriate response (including the creation and dissemination of documents and/or
electronic disclosures).
Burden for established entities already familiar with the Rule
predictably would be less than for new entrants because start-up costs,
such as crafting a privacy policy, are generally one-time costs and
have already been incurred. Staff's best estimate of the average burden
for these entities is as follows:
Burden Hours and Costs for All Established Entities
[Table IB]
----------------------------------------------------------------------------------------------------------------
Approx. number
Event Hourly wage and Hours per of Approx. total Approx. total
labor category* respondent respondents** annual hrs. labor costs
----------------------------------------------------------------------------------------------------------------
Reviewing GLBA-implementing $41.82 4 70,000 280,000 $11,709,600
policies and practices. Professional/
Technical.
Disseminating annual $16.78 Clerical. 15 70,000 1,050,000 17,619,000
disclosure. $41.82 5 70,000 350,000 14,637,000
Professional/
Technical.
Changes to privacy policies $16.78 Clerical. 7 1,000 7,000 117,460
and related disclosures. $41.82 3 1,000 3,000 125,460
Professional/
Technical.
---------------------------------------------------------------
[[Page 55491]]
Total..................... ................ .............. .............. 1,690,000 $44,208,520
----------------------------------------------------------------------------------------------------------------
*Staff calculated labor costs by applying appropriate hourly cost figures to burden hours. The hourly rates used
were based on mean wages for Financial Examiners and for Office and Administrative Support, corresponding to
professional/technical time (e.g., compliance evaluation and/or planning, designing and producing notices,
reviewing and updating information systems), and clerical time (e.g., reproduction tasks, filing, and, where
applicable to the given event, typing or mailing) respectively. See BLS Occupational Employment and Wages, May
2013, Table 1 at http://www.bls.gov/news.release/pdf/ocwage.pdf. Labor cost totals reflect solely that of the
affected commercial entities. Consumers have a continuing right to opt out, as well as a right to revoke their
opt-out at any time. When a respondent changes its information sharing practices, consumers are again given
the opportunity to opt out. Again, staff assumes that the time required of consumers to respond affirmatively
to respondents' opt-out programs (be it manually or electronically) would be minimal.
**The estimate of respondents is based on the following assumptions: (1) 100,000 established respondents,
approximately 70% of whom maintain customer relationships exceeding one year, (2) no more than 1% (1,000) of
whom make additional changes to privacy policies at any time other than the occasion of the annual notice; and
(3) such changes will occur no more often than once per year.
As calculated above, the total annual PRA burden hours and labor
costs for all affected entities in a given year would be 1,930,000
hours and $52,242,120, respectively.
The FTC now carves out from these overall figures the burden hours
and labor costs associated with motor vehicle dealers. This is because
the CFPB does not enforce the GLB Privacy Rule for those types of
entities. We estimate the following:
Annual Start-Up Hours and Labor Costs for New Entrants--Motor Vehicle Dealers Only
[Table IIA]
----------------------------------------------------------------------------------------------------------------
Approx. number
Hourly wage and Hours per of respondents Approx. total Approx. total
Event labor category respondent (Table IA annual hrs. labor costs
inputs x 0.57)
----------------------------------------------------------------------------------------------------------------
Reviewing internal policies $41.82 20 2,850 57,000 $2,383,740
and developing GLBA- Professional/
implementing instructions **. Technical.
Creating disclosure document $16.78 Clerical. 1 2,850 2,850 47,823
or electronic disclosure $41.82 2 2,850 5,700 238,374
(including initial, annual, Professional/
and opt out disclosures). Technical.
Disseminating initial $16.78 Clerical. 15 2,850 42,750 717,345
disclosure (including opt out $41.82 10 2,850 28,500 1,191,870
notices). Professional/
Technical.
---------------------------------------------------------------
Total..................... 136,800 $4,579,152
----------------------------------------------------------------------------------------------------------------
**Multiply the number of respondents from the comparable table above on all new entrants by the following
allocation (60,000/105,000) = 0.57. The number in the denominator represents the total of the FTC's existing
GLB Rule estimates for new entrants (5,000) and established entities (100,000). The numerator represents an
estimate of motor vehicle respondents. For this category, Commission staff relied on the following industry
estimates: 17,635 new car dealers per National Automobile Dealers Association data (2013) and 35,000
independent/used car dealers per National Independent Automobile Dealers Association data (2012),
respectively, multiplied by an added factor of 1.10 to cover for an unknown quantity of additional motor
vehicle dealer types (motorcycles, boats, other recreational vehicles) also covered within the definition of
``motor vehicle dealer'' under section 1029(a) of the Dodd-Frank Act.
Annual Burden Hours and Labor Costs for all Established Entities--Motor Vehicle Dealers Only
[Table IIB]
----------------------------------------------------------------------------------------------------------------
Approx. number
Hourly wage of
Event andlabor Hours per respondents** Approx. total Approx. total
category* respondent (Table IB annual hrs. labor costs
inputs x 0.57)
----------------------------------------------------------------------------------------------------------------
Reviewing GLBA-implementing $41.82 4 39,900 159,600 $6,674,472
policies and practices. Professional/
Technical.
Disseminating annual $16.78 Clerical. 15 39,900 598,500 10,042,830
disclosure. $41.82 5 39,900 199,500 8,343,090
Professional/
Technical.
Changes to privacy policies $16.78 Clerical. 7 570 3,990 66,952
and related disclosures. $41.82 3 570 1,710 71,512
Professional/
Technical.
---------------------------------------------------------------
Total..................... 963,300 $25,198,856
----------------------------------------------------------------------------------------------------------------
[[Page 55492]]
The FTC's portion of the annual hourly burden would be 1,100,100
hours + ((1,930,000 - 1,100,100)/2) = 1,515,050 annual hours. The FTC's
portion of the annual cost burden would be $29,778,008 + $((52,242,120
- 29,778,008)/2) = $41,010,064.
Estimated Capital/Other Non-Labor Costs Burden
Staff believes that capital or other non-labor costs associated
with the document requests are minimal. Please see the 60-Day Federal
Register notice for more details.
Request for Comments
You can file a comment online or on paper. For the Commission to
consider your comment, we must receive it on or before October 16,
2014. Write ``Paperwork Comment: FTC File No. P085405'' on your
comment. Your comment--including your name and your state--will be
placed on the public record of this proceeding, including, to the
extent practicable, on the public Commission Web site, at http://www.ftc.gov/os/publiccomments.shtm. As a matter of discretion, the
Commission tries to remove individuals' home contact information from
comments before placing them on the Commission Web site.
Because your comment will be made public, you are solely
responsible for making sure that your comment does not include any
sensitive personal information, such as anyone's Social Security
number, date of birth, driver's license number or other state
identification number or foreign country equivalent, passport number,
financial account number, or credit or debit card number. You are also
solely responsible for making sure that your comment does not include
any sensitive health information, like medical records or other
individually identifiable health information. In addition, do not
include any ``[t]rade secret or any commercial or financial information
which is . . . privileged or confidential,'' as discussed in Section
6(f) of the FTC Act, 15 U.S.C. 46(f), and FTC Rule 4.10(a)(2), 16 CFR
4.10(a)(2). In particular, do not include competitively sensitive
information such as costs, sales statistics, inventories, formulas,
patterns, devices, manufacturing processes, or customer names.
If you want the Commission to give your comment confidential
treatment, you must file it in paper form, with a request for
confidential treatment, and you are required to follow the procedure
explained in FTC Rule 4.9(c), 16 CFR 4.9(c). Your comment will be kept
confidential only if the FTC General Counsel grants your request in
accordance with the law and the public interest.
Postal mail addressed to the Commission is subject to delay due to
heightened security screening. As a result, we encourage you to submit
your comment online, or to send it to the Commission by courier or
overnight service. To make sure that the Commission considers your
online comment, you must file it at https://ftcpublic.commentworks.com/ftc/glbfinancialrulepra2, by following the instructions on the web-
based form. If this Notice appears at http://www.regulations.gov, you
also may file a comment through that Web site.
If you prefer to file your comment on paper, mail or deliver your
comment to the following address: Federal Trade Commission, Office of
the Secretary, 600 Pennsylvania Avenue NW., Suite CC-5610 (Annex J),
Washington, DC 20580, or deliver your comment to the following address:
Federal Trade Commission, Office of the Secretary, Constitution Center,
400 7th Street SW., 5th Floor, Suite 5610 (Annex J), Washington, DC
20024.
The FTC Act and other laws that the Commission administers permit
the collection of public comments to consider and use in this
proceeding as appropriate. The Commission will consider all timely and
responsive public comments that it receives on or before October 16,
2014. You can find more information, including routine uses permitted
by the Privacy Act, in the Commission's privacy policy, at http://www.ftc.gov/ftc/privacy.shtm.
Comments on the information collection requirements subject to
review under the PRA should also be submitted to OMB. If sent by U.S.
mail, address comments to: Office of Information and Regulatory
Affairs, Office of Management and Budget, Attention: Desk Officer for
the Federal Trade Commission, New Executive Office Building, Docket
Library, Room 10102, 725 17th Street NW., Washington, DC 20503.
Comments sent to OMB by U.S. postal mail, however, are subject to
delays due to heightened security precautions. Thus, comments instead
should be sent by facsimile to (202) 395-5167.
Christian S. White,
Deputy General Counsel.
[FR Doc. 2014-22054 Filed 9-15-14; 8:45 am]
BILLING CODE 6750-01-P