Gramm-Leach-Bliley Act

FROM: Robert D. Evans Director, ABA Governmental Affairs Office
SUBJECT: New Privacy Regulations Affect Law Firms
DATE: June 20, 2001

According to the Federal Trade Commission (FTC), a new law requires law firms to comply with privacy notices intended to cover financial institutions. Passed by the 106th Congress, the Gramm-Leach-Bliley Act of 1999 (P.L.106-102) http://www.ftc.gov/privacy/glbact/glbsub1.htm

requires financial institutions to provide current and future clients notice of privacy policies, as well as the opportunity to "opt out" of most disclosures to third parties. On Friday, June 8th the American Bar Association (ABA) Board of Governors passed a Resolution calling for the FTC to exempt the practice of law from the statute's implementing regulations.

Title V of the Gramm-Leach-Bliley Act of 1999 (also known as the Financial Industries Modernization Act) requires financial institutions to provide to their customers notice of their policies for the protection of individually identifiable personal information, as well as opportunity to opt out of most disclosures of such information to third parties. Regulations were promulgated by the FTC pursuant to the Act and implemented on November 30, 2000. Full compliance is required by July 1, 2001. The FTC is authorized to enforce this privacy protection

provision.

The Gramm-Leach-Bliley Act applies to financial institutions that form customer relationships with consumers. The Commission interprets "financial institution" to include businesses

"significantly engaged in financial activities" of the nature described in the Bank Holding Company Act of 1956 (12 U.S.C. 1843(k)) as well as other activities designated and to be designated by the Federal Reserve Board. This broad definition includes such activities as:

Leasing real or personal property or advising in such leasing;

Debt collecting;

Financial advisory activities, including management consulting and counseling activities; and

Tax planning, preparation and advising.

Law firms and sole practitioners "significantly engaged in financial activities" are considered financial institutions by the FTC and are subject to the requirements of the Act.

While institutional or corporate clients are not considered "consumers" under the Act, service to such clients may be counted to determine the level of financial activity a law firm or division within a firm is engaged in and whether notice to persons who are clients is

required.

The American Bar Association opposes the imposition of these rules upon

the legal community:

Attorneys are already bound both by an ethical duty of confidentiality and by contractual agreements that prevent such use of their client's information. Enforcement of these rules would infringe upon the attorney-client relationship and could potentially destroy attorney-client privilege in certain circumstances. These rules would impose an undue burden upon

small firms and sole practitioners. State regulation of the legal profession provides

a higher degree of privacy protection than is afforded by this Act.

Congress's intent in passing this Act is clear. This Act is to prevent the indiscriminate use of personally identifiable information for marketing, profiling and other commercial purposes. While the ABA supports strong consumer protection, this federal regulation will not

enhance privacy protection for consumers vis-à-vis their attorneys.

The FTC has authority under the statute to grant exemptions to these onerous regulations. The ABA believes that the practice of law should be exempted from these requirements. The ABA's

Governmental Affairs Office (GAO) is communicating our views to the Cmmission and will seek an administrative solution to this issue.

We may need your assistance with this effort and will contact you in the near future. In the meantime, should you have any questions, please contact Ellen McBarnette in our office at

McBarneE@staff.abanet.org or (202) 662-1767.