02-12265. Agency Information Collection Activities; Proposed Collection; Comment Request; Extension

AGENCY:

Federal Trade Commission (“FTC”).

ACTION:

Notice.

SUMMARY:

The FTC has submitted to the Office of Management and Budget (OMB) for review under the Paperwork Reduction Act (PRA) information collection requirements contained in its Gramm-Leach-Bliley Act Privacy Rule (“GLBA Rule” or “Rule”). The FTC is seeking public comments on its proposal to extend through June 30, 2005 the current PRA clearance for information collection requirements contained in the Rule.

DATES:

Comments must be submitted on or before June 17, 2002.

ADDRESSES:

Send written comments to the Office of Information and Regulatory Affairs, Office of Management and Budget, New Executive Office Building, Room 10202, Washington, DC 20503, ATTN.: Desk Officer for the Federal Trade Commission (comments in electronic form should be sent to [e-mail]), and to Secretary, Federal Trade Commission, Room H-159, 600 Pennsylvania Ave., NW., Washington, DC 20580 (comments in electronic form should be sent to [e-mail]). All comments should be captioned “GLBA Rule: Paperwork Comment,” as prescribed below.

FOR FURTHER INFORMATION CONTACT:

Requests for additional information or copies of the proposed information requirements should be addressed to Loretta Garrison, Attorney, Division of Financial Practices, Bureau of Consumer Protection, Federal Trade Commission, Room S-4429, 601 Pennsylvania Ave., NW., Washington, DC 20580, [phone].

SUPPLEMENTARY INFORMATION:

Under the PRA (44 U.S.C. 3501-3520), Federal agencies must obtain approval from OMB for each collection of information they conduct or sponsor. On March 4, 2002, the FTC sought comments on the information collection requirements associated with the Rule, 16 CFR part 313 (OMB Control Number: 3084-0121). See 67 FR 9737 (March 4, 2002); 67 FR 11745 (March 15, 2002) (correction notice). No comments were received. Pursuant to the OMB regulations that implement the PRA (5 CFR part 1320), the FTC is providing this second opportunity for public comment while seeking OMB approval to extend the existing paperwork clearance for the Rule.

If a comment contains nonpublic information, it must be filed in paper form, and the first page of the document must be clearly labeled “confidential.” Comments that do not contain any nonpublic information may instead be filed in electronic form (in ASCII format, WordPerfect, or Microsoft Word) as part of or as an attachment to email messages directed to the following email box: [e-mail]. Such comments will be considered by the Commission and will be available for inspection and copying at its principal office in accordance with Section 4.9(b)(6)(ii) of the Commission's rules of practice, 16 CFR section 4.9(b)(6)(ii).

The GLBA Rule is designed to ensure that customers and consumers, subject to certain exceptions, will have access to the privacy policies of the financial institutions with which they conduct business. As mandated by the GLBA, 15 U.S.C. 6801-6809, the Rule requires financial institutions to disclose to consumers: (1) Initial notice of the financial institution's privacy policy when establishing a customer relationship with a consumer and/or before sharing a consumer's non-public personal information with certain nonaffiliated third parties; (2) notice of the consumer's right to opt out of information sharing with such parties; (3) annual notice of the institution's privacy policy to any continuing customer; and (4) notice of changes in the institution's practices on information sharing. These requirements are subject to the PRA. The Rule does not require recordkeeping.

Estimated annual hours burden: Estimating the paperwork burden of the GLBA Rule's disclosure requirements is very difficult because of the highly diverse group of affected entities, consisting of financial institutions not regulated by a federal financial regulatory agency. Under section 505(a)(7) of the GLBA, the Commission has jurisdiction over the entities that are not specifically subject to another agency's jurisdiction (see sections 505(a)(1)-(6) of the GLBA). Because of the types of disclosures at issue and the requirements of the regulations, the frequency of responses and the volume of respondents cannot be determined with certainty.

The burden estimates represent the FTC staff's best assessment, based on its knowledge and expertise relating to the financial institutions subject to the Commission's jurisdiction under this law. To derive these estimates, staff considered the wide variations in covered entities. In some instances, covered entities may make the required disclosures in the ordinary course of business, apart from the GLBA Rule. In addition, some entities may use highly automated means of providing the required disclosures, while others may rely on methods requiring more manual effort. The burden estimates shown below include the time necessary to train staff to comply with the regulations. These figures are averages based on staff's best estimate of the burden incurred over the broad spectrum of covered entities.

Start-Up Hours and Labor Costs for New Entities

Staff estimates that, on average, no more than approximately 5,000 new entities each year will address the GLBA rule for the first time. These entities are accounted for in the table immediately below. At the time of the Rule's inception, staff's estimate of the number of entities newly subject to the Rule included not just start-up entities but also the many existing business entities that would be subject to it for the first time. The estimates regarding established entities are reflected in the second table below.

Event	Number of hours/costs per event and labor category* (per respondent)	Approx. number of respondents	Approx. annual hours (millions)	Approx. total costs (millions)
Reviewing internal policies and developing GLBA-implementing instructions **	Managerial/professional time: 20 hrs/$1,000	5,000	0.1	$5
Creating actual disclosure document or electronic disclosure (including initial, annual, and opt out disclosures)	Clerical: 5 hrs/$50 Skilled labor: 10 hrs/$200	5,000	.075	1.25
Disseminating initial disclosure (including opt out notices)	Clerical: 15 hrs/$150 Skilled labor: 10 hrs/$200	5,000	.125	1.75
Total			.300	8.00
* Staff calculated labor costs by applying appropriate hourly cost figures to burden hours. The hourly rates used were $50 for managerial/professional time (e.g., compliance evaluation and/or planning), $20 for skilled technical time (e.g., designing and producing notices, reviewing and updating information systems), and $10 for clerical time (e.g., reproduction tasks, filing, and, where applicable to the given event, typing or mailing). Labor costs totals reflect solely that of the commercial entities affected. Staff assumes that the time required of consumers to respond affirmatively to respondents' opt-out programs (be it manually or electronically) would be minimal.
** Reviewing instructions includes all efforts performed by or for the respondent to: determine whether and to what extent the respondent is covered by an agency collection of information, understand the nature of the request, and determine the appropriate response (including the creation and dissemination of document and/or electronic disclosures).

Burden Hours and Costs for Established Entities

Burden ^[1] for established entities already familiar with the Rule would predictably be less than for start-up entities since start-up costs, such as crafting a privacy plicy, are generally one-time costs and have already been incurred. Staff's best estimate of the average burden for these entities is as follows:

Event	Number of hours/costs per event and labor category* (per respondent)	Approx. number of respondents**	Approx. annual hours (millions)	Approx. total costs (millions)
Reviewing GLBA-implementing policies and practices	Managerial/professional time: 4 hrs/$200	70,000	.28	$14.0
Disseminating annual disclosure	Clerical: 15 hrs/$150 skilled labor: 5 hrs/$100	70,000	1.40	17.5
Changes to privacy policies and related disclosures	Clerical: 15 hrs/$150 skilled: 5 hrs/$100	1,000	.02	.25
Total			1.70	31.75
* Staff calculated labor costs by applying appropriate hourly cost figures to burden hours. The hourly rates used were $50 for managerial/professional time (e.g., compliance evaluation and/or planning), $20 for skilled technical time (e.g., designing and producing notices, reviewing and updating information systems), and $10 for clerical time (e.g., reproduction tasks, filing, and, where applicable to the given event, typing or mailing). Consumers have a continuing right to opt-out, as well as a right to revoke their opt-out at any time. When a respondent changes its information sharing practices, consumers are again given the opportunity to opt-out. Again, staff assumes that the time required of consumer to respond affirmatively to respondent's opt-out program (be it manually or electronically) would be minimal.
** The estimate of respondents is based on the following assumptions: (1) 100,000 respondents, approximately 70% of whom maintain customer relationships exceeding one year (2) no more than 1% (1,000) of whom make additional changes to privacy policies at any time other than the occasion of the annual notice; and (3) such changes will occur no more often than once per year.

As calculated above, the average PRA burden for all affected entities in a given year would be 1,000,000 hours and $19,875,000.

Estimated Capital/Other Non-Labor Costs Burden: Staff estimates that the capital or other non-labor costs associated with the document requests are minimal. Covered entities will already be equipped to provide written notices (e.g., computers with word processing programs, typewriters, copying machines, mailing capabilities.) Most likely, only entities that already have on-line capabilities will offer consumers the choice to receive notices via electronic format. As such, these entities will already be equipped with the computer equipment and software necessary to disseminate the required disclosures via electronic means.

William E. Kovacic,

General Counsel.

Footnotes

1.  While the existing population affected would increase with the inflow of new entrants, staff will retain its estimate of overall population affected (100,000, but subject to further apportionment as detailed in the table below), allowing, in part, for businesses that will close in any given year, and the difficulty of establishing a more precise estimate.