Cal. Fin. Code §§4052 & 4053 prohibit a financial institution from disclosing or sharing a consumer’s nonpublic personal information with either an affiliate of the institution or a nonaffiliated third party, unless the financial institution has provided the consumer with a privacy notice and the consumer has subsequently consented to the sharing of their information.
Due to Federal case law, there has been some ambiguity as to what extent the subsections concerning the sharing of nonpublic information to affiliates under Ibid. §4053 is pre-empted by the Federal Fair Credit Reporting Act (“FCRA”; 15 USCA §§1681 et seq.), subsequently leading to ambiguity as to whether the use of the Federal FCRA disclosures are sufficient for fulfilling California’s privacy notice requirements.
The United States 9th Circuit Court of Appeals has ruled that certain aspects of California’s privacy laws concerning affiliates are preempted by FCRA (see Am. Bankers Ass’n. v. Gould, 412 F.3d 1081 [9th Cir. 2005]) , but other aspects are not (see Am. Bankers Ass’n v. Lockyer, 541 F.3d 1214 [9th Cir. 2008]). The dictum of these cases have left a large question mark as to what aspects are and are not pre-empted and whether the FCRA disclosures are sufficient for compliance purposes.
In order to ensure the highest level of compliance for loan packages, DocuTech has chosen to take a conservative approach and provide a California-specific privacy notice in addition to the FCRA disclosures. Cal. Fin. Code §4053(d)(2)(A), as well as the California Office of Privacy Protection (http://www.privacy.ca.gov/privacy_laws/sb1.shtml), set forth a standard notice that may be used (the form is commonly referred to as the “SB1 Form”). DocuTech has duplicated this SB1 Form (Cx16539) and will have it available to print in Closing packages, upon request, for any interested clients.
However, Ibid. (d)(2)(D) implicitly requires a financial institution to provide the notice via mail and, explicitly, in a certain manner, depending on whether the notice is mailed singularly or with other documents. Furthermore, Ibid. (d)(6) requires that a financial institution with assets of more than $25 million to include a self-addressed, first class business reply return envelope with the notice (or they may provide a simple self-addressed return envelope with at least two alternative cost-free means for consumers to indicate their choice). Financial institutions with fewer assets need only provide a self-addressed return envelope.
DocuTech is unable to mail Cx16539 for clients, nor provide any required envelopes. Therefore, if a client elects to print Cx16539, they will be responsible for ensuring that this document is provided to their consumers according to the above mentioned requirements.
This change will take effect June 4, 2012. If you have any questions or concerns about this change, please contact Client Support at 1.800.497.3584.
June 4, 2012
DR 124711