Banks Push Privacy Policies out the Door Early

Although compliance with the privacy provisions of the Gramm-Leach-Bliley Act is not required until July 1, 2001, many banks have completed their privacy policy development and are mailing the mandatory notices to account holders. Tens of millions of consumers have already begun receiving a description of how their financial institutions use personal information and, when appropriate, those customers are being offered a choice as to whether their data can be shared with unaffiliated companies. The table below was compiled by the American Banker and provides and update of mailings for several large banks.

Many of the banks who have mailed privacy notices are giving their customers an opportunity to block more information transfer than the law requires. First Union and Bank of America are giving customers a choice about how the bank will contact them for marketing purposes. A First Union spokesman told the American Banker, "we recognize that our customers may have preferences about how we let them know about products and services, so we're giving them more choices about how we contact them." In the past, customers faced an "all or nothing" choice in which they could opt out of all contact. Now, for example, First Union customers can choose to be contacted only by mail but not by phone or email.

Crafting an appropriate privacy policy has been a monumental task for most financial institutions. One prominent privacy attorney in an interview with the American Banker, L. Richard Fischer (Morrison & Foerster, Washington, DC) said "They are sweating blood over their privacy policies. . . They are spending not hundreds but thousands of person-hours putting these things together. The exposure from a reputation standpoint, the exposure from a risk standpoint, makes every word critically important." Simply identifying all the ways customer information is used within a corporation has been a huge challenge. Cliff Bussard, VP and direct marketing manager at SunTrust Banks said "the biggest learning experience we had was uncovering how many areas of the company were touched by this activity. It was broader and more expansive than what we had anticipated." Bank One's Chief Privacy Officer, Julie F. Johnson called the process a "cultural change." As a result, Bank One is changing its account-opening processes and installing new data processing systems that will cross-match all customer accounts so that customers will only get one mailing.

No company yet has tried to build a marketing campaign around the privacy policy in order to distinguish themselves from the competition. However, as noted in the preceding article, several companies have elected not to share data with third-parties, thereby eliminating the need to keep track of customer opt-out choices. Privacy as a competitive edge may yet evolve. According to John Byrne, senior counsel at the American Bankers Association, "It's up to the institutions that decide to continue to share information to explain clearly how they are doing it and why. . . There will be tremendous benefits for customers, but it's up to the institutions to explain it."

Source: American Banker, January 16, 2001, p. 4.