67 FR 42 pgs. 9737-9739 - Agency Information Collection Activities; Proposed Collection; Comment Request; Extension
Type: NOTICEVolume: 67Number: 42Pages: 9737 - 9739
FR document: [FR Doc. 02-5128 Filed 3-02; 8:45 am]
Agency: Federal Trade Commission
Official PDF Version: PDF Version
FEDERAL TRADE COMMISSION
Agency Information Collection Activities; Proposed Collection; Comment Request; Extension
AGENCY:
Federal Trade Commission ("FTC").
ACTION:
Notice.
SUMMARY:
The FTC is seeking public comments on its proposal to extend through June 30, 2005, the current Paperwork Reduction Act ("PRA") clearance for information collection requirements contained in its Gramm-Leach-Bliley Act Privacy Rule ("GLBA Rule" or "Rule"). That clearance expires on June 30, 2002.
DATES:
Comments must be submitted on or before May 3, 2002.
ADDRESSES:
Send written comments to Secretary, Federal Trade Commission, Room H-159, 600 Pennsylvania Ave., NW., Washington, DC 20580. All comments should be captioned "GLBA Rule: Paperwork Comment." Comments in electronic form should be sent to: GLBpaperwork@ftc.gov, as prescribed below.
FOR FURTHER INFORMATION CONTACT:
Requests for additional information or copies of the proposed information requirements should be addressed to Loretta Garrison, Attorney, Division of Financial Practices, Bureau of Consumer Protection, Federal Trade Commission, Room S-4429, 601 Pennsylvania Ave., NW, Washington, DC 20580, (202) 326-3043.
SUPPLEMENTARY INFORMATION:
Under the PRA (44 U.S.C. 3501-3520), Federal agencies must obtain approval from OMB for each collection of information they conduct or sponsor. "Collection of information" means agency request or requirements that members of the public submit reports, keep records, or provide information to a third party. (44 U.S.C. 3502(3), 5 CFR 1320.3(c)). As required by section 3506(c)(2)(A) of the PRA, the FTC is providing this opportunity for public comment before requesting that OMB extend the existing paperwork clearance for the GLBA Rule, 16 CFR Part 313 (OMB Control Number 3084-0121).
The FTC invites comments on: (1) Whether the proposed collection of information is necessary for the proper performance of the functions of the agency, including whether the information will have practical utility; (2) the accuracy of the agency's estimate of the burden of the proposed collection of information, including the validity of the methodology and assumptions used; (3) ways to enhance the quality, utility, and clarity of the information to be collected; and (4) ways to minimize the burden of the collection of information on those who are to respond, including through the use of appropriate automated, electronic, mechanical, or other technological collection techniques or other forms of information technology, e.g., permitting electronic submission of responses.
If a comment contains nonpublic information, it must be filed in paper form, and the first page of the document must be clearly label "confidential." Comments that do not contain any nonpublic information may instead be filed in electronic form (in ASCII format, WordPerfect, or Microsoft Word) as part of or as an attachment to email messages directed to the following e-mail box: GLBpaperwork@ftc.gov. Such comments will be considered by the Commission and will be available for inspection and copying at its principal office in accordance with Section 4.9(b)(6)(ii) of the Commission's Rules of Practice, 16 CFR section 4.9(b)(6)(ii)).
The GLBA Rule is designed to ensure that customers and consumers, subject to certain exceptions, will have access to the privacy policies of the financial institutions with which they conduct business. As mandated by the GLBA, 15 U.S.C. 6801-6809, the Rule requires financial institutions to disclose to consumers: (1) Initial notice of the financial institution's privacy policy when establishing a customer relationship with a consumer and/or before sharing a consumer's non-public personal information with certain nonaffiliated third parties; (2) notice of the consumer's right to opt out of information sharing with such parties; (3) annual notice of the institution's privacy policy to any continuing customer; and (4) notice of changes in the institution's practices on information sharing. These requirements are subject to the PRA. The Rule does not require recordkeeping.
Estimated annual hours burden: Estimating the paperwork burden of the GLBA Rule's disclosure requirements is very difficult because of the highly diverse group of affected entities, consisting of financial institutions not regulated by a federal financial regulatory agency. Under section 505(a)((7) of the GLBA, the Commission has jurisdiction over the entities that are not specifically subject to another agency's jurisdiction ( see sections 505(a)(1)-(6) of the GLBA). Because of the types of disclosures at issue and the requirements of the regulations, the frequency of responses, and the volume of respondents, cannot be determined with certainty.
The burden estimates represent the FTC staff's best assessment, based on its knowledge and expertise relating to the financial institutions subject to the Commission's jurisdiction under this law. To derive these estimates, staff considered the wide variations in covered entities. In some instances, covered entities may make the required disclosures in the ordinary course of business, apart from the GLBA Rule. In addition, some entities may use highly automated means of providing the required disclosures, while others may rely on methods requiring more manual effort. The burden estimates shown below include the time necessary to train staff to comply with the regulations. These figures are averages based on staff's best estimate of the burden incurred over the broad spectrum of covered entities.
Start-up hours and labor costs for new entities: While staff believes its prior estimate of the number of entities subject to the Rule (100,000) remains reasonable, it also estimates that, on average, no more than approximately 5,000 new entities each year will address the GLBA Rule for the first time. The prior amount recognized the newness of the Rule and the many existing business entities that would be subject to it for the first time. The estimates regarding already established entities are reflected in the second table below, and retain the larger population estimate as the base for further calculations.1
Footnotes:
1 While the existing population affected would increase with the inflow of new entrants, staff will retain its estimate of overall population affected, allowing, in part, for businesses that will close in any given year, and the difficulty of establishing a more precise estimate.
| Event | Number of hours/costs per event and labor category * (per respondent) | Approx. number of respondents | Approx. annual hours (millions) | Approx. total costs (millions) |
|---|---|---|---|---|
| Reviewing internal policies and developing GLBA-implementing instructions ** | Managerial/professional time: 20 hrs/$1,000 | 5,000 | 0.1 | $5 |
| Creating actual disclosure document or electronic disclosure (including initial, annual, and opt out disclosures) | Clerical: 5 hrs/$50; skilled labor: 10 hrs/$200 | 5,000 | .075 | 1.25 |
| Disseminating initial disclosure (including opt out notices) | Clerical: 15 hrs/$150; skilled labor: 10 hrs/$200 | 5,000 | .125 | 1.75 |
| Total | .300 | 8.00 | ||
| * Staff calculated labor costs by applying appropriate hourly cost figures to burden hours. The hourly rates used were $50 for managerial/professional time (e.g., compliance evaluation and/or planning), $20 for skilled technical time (e.g., designing and producing notices, reviewing and updating information systems), and $10 for clerical time (e.g., reproduction tasks, filing, and, where applicable to the given event, typing or mailing). Labor cost totals reflect solely that of the commercial entities affected. Staff assumes that the time required of consumers to respond affirmatively to respondents' opt-out programs (be it manually or electronically) would be minimal. | ||||
| ** Reviewing instructions includes all efforts performed by or for the respondent to: determine whether and to what extent the respondent is covered by an agency collection of information, understand the nature of the request, and determine the appropriate response (including the creation and dissemination of document and/or electronic disclosures). | ||||
Burden hours and costs for established entities: Burden for
established entities already familiar with the Rule would predictably be lessthan for start-up entities since start-up costs, such as crafting a privacy policy, are generally one-time costs and have already been incurred. Staff's best estimate of the average burden for these entities is as follows:
| Event | Number of hours/costs per event and labor category * (per respondent) | Approx. Number of respondents | Approx. annual hours (millions) | Approx. total costs (millions) |
|---|---|---|---|---|
| Reviewing GLBA-implementing policies and practices | Managerial/professional time: 4 hrs/$200 | 70,000 | .28 | $14.0 |
| Disseminating annual disclosure | Clerical: 15 hrs/$150; skilled labor: 5 hrs/$100 | 70,000 | 1.40 | 17.5 |
| Changes to privacy policies and related disclosures | Clerical: 15 hrs/$150; skilled: 5 hrs/$100 | 1,000 | .02 | .25 |
| Total | 1.70 | 31.75 | ||
| * Staff calculated labor costs by applying appropriate hourly cost figures to burden hours. The hourly rates used were $50 for managerial/professional time (e.g., compliance evaluation and/or planning), $20 for skilled technical time (e.g., designing and producing notices, reviewing and updating information systems), and $10 for clerical time (e.g., reproduction tasks, filing, and, where applicable to the given event, typing or mailing). Consumers have a continuing right to opt-out, as well as a right to revoke their opt-out at any time. When a respondent changes its information sharing practices, consumers are again given the opportunity to opt-out. Again, staff assumes that the time required of consumers to respond affirmatively to respondents' opt-out programs (be it manually or electronically) would be minimal. | ||||
| ** The estimate of respondents is based on the following assumptions: (1) 100,000 respondents, approximately 70% of whom maintain customer relationships exceeding one year, (2) no more than 1% (1,000) of whom make additional changes to privacy policies at any time other than the occasion of the annual notice; and (3) such changes will occur no more often than once per year. | ||||
As calculated above, the average PRA burden for all affected entities in a given year would be 1,000,000 hours and $19,875,000.
Estimated Capital/Other Non-Labor Costs Burden: Staff estimates that the capital or other non-labor costs associated with the document requests are minimal. Covered entities will already be equipped to provide written notices ( e.g., computers with word processing programs, typewriters, copying machines, mailing capabilities.) Most likely, only entities that already have on-line capabilities will offer consumers the choice to receive notices via electronic format. As such, these entities will already be equipped with the computer equipment and software necessary to disseminate the required disclosures via electronic means.
John D. Graubert,
Acting General Counsel.
[FR Doc. 02-5128 Filed 3-02; 8:45 am]
BILLING CODE 6750-01-M