E8-6821. Agency Information Collection Activities; Proposed Collection; Comment Request; Extension

AGENCY:

Federal Trade Commission (“Commission” or “FTC”).

ACTION:

Notice.

SUMMARY:

The information collection requirements described below will be submitted to the Office of Management and Budget (“OMB”) for review, as required by the Paperwork Reduction Act (“PRA”). The FTC is seeking public comments on its proposal to extend through July 31, 2011, the current PRA clearance for information collection requirements contained in the Commission’s Gramm-Leach-Bliley Financial Privacy Rule (“GLB Privacy Rule” or “Rule”). The current clearance expires on July 31, 2008.

DATES:

Comments must be submitted on or before June 2, 2008.

ADDRESSES:

Interested parties are invited to submit written comments. Comments should refer to “Paperwork Comment: FTC File No. P085405” and may be submitted by any of the following methods. If, however, the comment contains any material for which confidential treatment is requested, it must be filed in paper form, and the first page of the document must be clearly labeled “Confidential.”^[1]

1. Web Site: Comments filed in electronic form should be submitted by clicking on the following web link: https://secure.commentworks.com/​ftc-glbprivacyrulepra and following the instructions on the web-based form. To ensure that the Commission considers an electronic comment, you must file it on the web-based form at: https://secure.commentworks.com/​ftc-glbprivacyrulepra.

2. Mail or Hand Delivery: A comment filed in paper form should include “Paperwork Comment: FTC File No. P085405” both in the text and on the envelope and should be mailed or delivered to the following address: Federal Trade Commission/Office of the Secretary, Room H-135 (Annex J), 600 Pennsylvania Avenue, N.W., Washington, D.C. 20580. The Commission is requesting that any comment filed in paper form be sent by courier or overnight service, if possible.

The FTC Act and other laws the Commission administers permit the collection of public comments to consider and use in this proceeding as appropriate. All timely and responsive public comments will be considered by the Commission and will be available to the public on the FTC website, to the extent practicable, at www.ftc.gov. As a matter of discretion, the FTC makes every effort to remove home contact information for individuals from the public comments it receives before placing those comments on the FTC website. More information, including routine uses permitted by the Privacy Act, may be found in the FTC's privacy policy at http://www.ftc.gov/​ftc/​privacy.shtm.

FOR FURTHER INFORMATION CONTACT:

Kellie Cosgrove Riley, Senior Attorney, Division of Privacy and Identity Protection, Bureau of Consumer Protection, [phone], Federal Trade Commission, 600 Pennsylvania Avenue, N.W., Washington D.C. 20580.

SUPPLEMENTARY INFORMATION:

Under the PRA, 44 U.S.C. 3501-3521, federal agencies must obtain approval from OMB for each collection of information they conduct or sponsor. “Collection of information” means agency requests or requirements that members of the public submit reports, keep records, or provide information to a third party. 44 U.S.C. 3502(3), 5 CFR 1320.3(c). As required by section 3506(c)(2)(A) of the PRA, the FTC is providing this opportunity for public comment before requesting that OMB extend the existing paperwork clearance for the GLB Privacy Rule, 16 CFR Part 313 (OMB Control Number 3084-0121).

The FTC invites comments on: (1) whether the proposed collection of information is necessary for the proper performance of the functions of the agency, including whether the information will have practical utility; (2) the accuracy of the agency’s estimate of the burden of the proposed collection of information, including the validity of the methodology and assumptions used; (3) ways to enhance the quality, utility, and clarity of the information to be collected; and (4) ways to minimize the burden of the collection of information on those who are to respond, including through the use of appropriate automated, electronic, mechanical, or other technological collection techniques or other forms of information technology, e.g., permitting electronic submission of responses.

The GLB Privacy Rule is designed to ensure that customers and consumers, subject to certain exceptions, will have access to the privacy policies of the financial institutions with which they conduct business. As mandated by the Gramm-Leach-Bliley Act, 15 U.S.C. 6801-6809, the Rule requires financial institutions to disclose to consumers: (1) initial notice of the financial institution’s privacy policy when establishing a customer relationship with a consumer and/or before sharing a consumer’s non-public personal information with certain nonaffiliated third parties; (2) notice of the consumer’s right to opt out of information sharing with such parties; (3) annual notice of the institution’s privacy policy to any continuing customer; and (4) notice of changes in the institution’s practices on information sharing. These requirements are subject to the PRA. The Rule does not require recordkeeping.

Estimated annual hours burden: As noted in the original burden estimate for the GLB Privacy Rule, determining the paperwork burden of the Rule’s disclosure requirements is very difficult because of the highly diverse group of affected entities, consisting of financial institutions not regulated by a federal financial regulatory agency. See 15 U.S.C. 6805 (committing to the Commission's jurisdiction entities that are not specifically subject to another agency’s jurisdiction).

The burden estimates represent the FTC staff’s best assessment, based on its knowledge and expertise relating to the financial institutions subject to the Commission's jurisdiction under this law. To derive these estimates, staff considered the wide variations in covered entities. In some instances, covered entities may make the required disclosures in the ordinary course of business, apart from the GLB Privacy Rule. In addition, some entities may use highly automated means to provide the required disclosures, while others may rely on methods requiring more manual effort. The burden estimates shown below include the time that may be necessary to train staff to comply with the regulations. These figures are averages based on staff’s best estimate of the burden incurred over the broad spectrum of covered entities.

Staff retains its prior estimate of the number of entities each year that will address the GLB Privacy Rule for the first time (5,000) and its estimate of established entities already familiar with the Rule (100,000). While the number of established entities familiar with the Rule would theoretically increase each year with the addition of new entrants, staff retains its previous estimate of established entities given that a number of the established entities will close in any given year, and also given the difficulty of establishing a more precise estimate. Staff’s burden estimates for new entrants and established entities are detailed in the charts below.

Start-up hours and labor costs for new entrants:

Event	Hourly wage and labor category*	Hours per Respondent	Approx. Number of Respondents	Approx. Total Annual Hrs.	Approx. Total Labor Costs
Reviewing internal policies and developing GLBA-implementing instructions**	$31.66 managerial/professional	20	5,000	100,000	$3,166,000
Creating disclosure document or electronic disclosure (including initial, annual, and opt out disclosures)	$14.71 clerical	5	5,000	25,000	$367,750
	$32.82 professional/technical	10		50,000	$1,641,000
Disseminating initial disclosure (including opt out notices)	$14.71 clerical	15	5,000	75,000	$1,103,250
	$32.82 professional/technical	10		50,000	$1,641,000
Total				300,000	$7,919,000
* Staff calculated labor costs by applying appropriate hourly cost figures to burden hours. The hourly rates used were based on mean wages for managerial/professional time (e.g., compliance evaluation and/or planning), professional/technical time (e.g., designing and producing notices, reviewing and updating information systems), and clerical time (e.g., reproduction tasks, filing, and, where applicable to the given event, typing or mailing). See BLS National Compensation Survey, June 2006, Table 1, available at http://www.bls.gov/​ncs/​ocs/​sp/​ncbl0910.pdf (Management, professional, and related; office and administrative support) and BLS Occupational Employment and Wages 2006,Table 2, available at http://www.bls.gov/​news.release/​pdf/​ocwage.pdf (professional, scientific, and technical services - business and financial operations). Labor cost totals reflect solely that of the commercial entities affected. Staff assumes that the time required of consumers to respond affirmatively to respondents’ opt-out programs (be it manually or electronically) would be minimal.
** Reviewing instructions includes all efforts performed by or for the respondent to: determine whether and to what extent the respondent is covered by an agency collection of information, understand the nature of the request, and determine the appropriate response (including the creation and dissemination of document and/or electronic disclosures).

Burden hours and costs for established entities:

Burden for established entities already familiar with the Rule predictably would be less than for start-up entities because start-up costs, such as crafting a privacy policy, are generally one-time costs and have already been incurred. Staff’s best estimate of the average burden for these entities is as follows:

Event	Hourly wage and labor category*	Hours per Respondent	Approx. Number of Respondents**	Approx. Total Annual Hrs.	Approx. Total Labor Costs
Reviewing GLBA-implementing policies and practices	$31.66 managerial/professional	4	70,000	280,000	$8,864,800
Disseminating annual disclosure	$14.71 clerical	15	70,000	1,050,000	$15,445,500
	$32.82 professional/technical	5		350,000	$11,487,000
Changes to privacy policies and related disclosures	$14.71 clerical	15	1,000	15,000	$220,650
	$32.82 professional/technical	10		50,000	$164,100
Total				1,700,000	$36,182,050
* Staff calculated labor costs by applying appropriate hourly cost figures to burden hours; labor cost totals reflect solely that of the commercial entities affected. The hourly rates used were based on mean wages for managerial/professional time (e.g., compliance evaluation and/or planning), professional/technical time (e.g., designing and producing notices, reviewing and updating information systems), and clerical time (e.g., reproduction tasks, filing, and, where applicable to the given event, typing or mailing). See BLS National Compensation Survey, June 2006, Table 1, available at http://www.bls.gov/​ncs/​ocs/​sp/​ncbl0910.pdf (Management, professional, and related; office and administrative support) and BLS Occupational Employment and Wages 2006,Table 2, available at http://www.bls.gov/​news.release/​pdf/​ocwage.pdf (professional, scientific, and technical services - business and financial operations). Consumers have a continuing right to opt-out, as well as a right to revoke their opt-out at any time. When a respondent changes its information sharing practices, consumers are again given the opportunity to opt-out. Again, staff assumes that the time required of consumers to respond affirmatively to respondents’ opt-out programs (be it manually or electronically) would be minimal.
** The estimate of respondents is based on the following assumptions: (1) 100,000 respondents, approximately 70% of whom maintain customer relationships exceeding one year, (2) no more than 1% (1,000) of whom make additional changes to privacy policies at any time other than the occasion of the annual notice; and (3) such changes will occur no more often than once per year.

As calculated above, the total annual PRA burden hours and labor costs for all affected entities in a given year would be 2,000,000 hours and $44,101,000, respectively.

Estimated Capital/Other Non-Labor Costs Burden: Staff believes that capital or other non-labor costs associated with the document requests are minimal. Covered entities will already be equipped to provide written notices (e.g., computers with word processing programs, typewriters, copying machines, mailing capabilities). Most likely, only entities that already have on-line capabilities will offer consumers the choice to receive notices via electronic format. As such, these entities will already be equipped with the computer equipment and software necessary to disseminate the required disclosures via electronic means.

William Blumenthal

General Counsel

Footnotes

1. Commission Rule 4.2(d), 16 CFR 4.2(d). The comment must be accompanied by an explicit request for confidential treatment, including the factual and legal basis for the request, and must identify the specific portions of the comment to be withheld from the public record. The request will be granted or denied by the Commission’s General Counsel, consistent with applicable law and the public interest. See Commission Rule 4.9(c), 16 CFR 4.9(c).