[Federal Register Volume 67, Number 42 (Monday, March 4, 2002)]
[Notices]
[Pages 9737-9739]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 02-5128]


=======================================================================
-----------------------------------------------------------------------

FEDERAL TRADE COMMISSION


Agency Information Collection Activities; Proposed Collection; 
Comment Request; Extension

AGENCY: Federal Trade Commission (``FTC'').

ACTION: Notice.

-----------------------------------------------------------------------

SUMMARY: The FTC is seeking public comments on its proposal to extend 
through June 30, 2005, the current Paperwork Reduction Act (``PRA'') 
clearance for information collection requirements contained in its 
Gramm-Leach-Bliley Act Privacy Rule (``GLBA Rule'' or ``Rule''). That 
clearance expires on June 30, 2002.

DATES: Comments must be submitted on or before May 3, 2002.

ADDRESSES: Send written comments to Secretary, Federal Trade 
Commission, Room H-159, 600 Pennsylvania Ave., NW., Washington, DC 
20580. All comments should be captioned ``GLBA Rule: Paperwork 
Comment.'' Comments in electronic form should be sent to: 
[email protected], as prescribed below.

FOR FURTHER INFORMATION CONTACT: Requests for additional information or 
copies of the proposed information requirements should be addressed to 
Loretta Garrison, Attorney, Division of Financial Practices, Bureau of 
Consumer Protection, Federal Trade Commission, Room S-4429, 601 
Pennsylvania Ave., NW, Washington, DC 20580, (202) 326-3043.

SUPPLEMENTARY INFORMATION: Under the PRA (44 U.S.C. 3501-3520), Federal 
agencies must obtain approval from OMB for each collection of 
information they conduct or sponsor. ``Collection of information'' 
means agency request or requirements that members of the public submit 
reports, keep records, or provide information to a third party. (44 
U.S.C. 3502(3), 5 CFR 1320.3(c)). As required by section 3506(c)(2)(A) 
of the PRA, the FTC is providing this opportunity for public comment 
before requesting that OMB extend the existing paperwork clearance for 
the GLBA Rule, 16 CFR Part 313 (OMB Control Number 3084-0121).

[[Page 9738]]

    The FTC invites comments on: (1) Whether the proposed collection of 
information is necessary for the proper performance of the functions of 
the agency, including whether the information will have practical 
utility; (2) the accuracy of the agency's estimate of the burden of the 
proposed collection of information, including the validity of the 
methodology and assumptions used; (3) ways to enhance the quality, 
utility, and clarity of the information to be collected; and (4) ways 
to minimize the burden of the collection of information on those who 
are to respond, including through the use of appropriate automated, 
electronic, mechanical, or other technological collection techniques or 
other forms of information technology, e.g., permitting electronic 
submission of responses.
    If a comment contains nonpublic information, it must be filed in 
paper form, and the first page of the document must be clearly label 
``confidential.'' Comments that do not contain any nonpublic 
information may instead be filed in electronic form (in ASCII format, 
WordPerfect, or Microsoft Word) as part of or as an attachment to email 
messages directed to the following e-mail box: [email protected]. 
Such comments will be considered by the Commission and will be 
available for inspection and copying at its principal office in 
accordance with Section 4.9(b)(6)(ii) of the Commission's Rules of 
Practice, 16 CFR section 4.9(b)(6)(ii)).
    The GLBA Rule is designed to ensure that customers and consumers, 
subject to certain exceptions, will have access to the privacy policies 
of the financial institutions with which they conduct business. As 
mandated by the GLBA, 15 U.S.C. 6801-6809, the Rule requires financial 
institutions to disclose to consumers: (1) Initial notice of the 
financial institution's privacy policy when establishing a customer 
relationship with a consumer and/or before sharing a consumer's non-
public personal information with certain nonaffiliated third parties; 
(2) notice of the consumer's right to opt out of information sharing 
with such parties; (3) annual notice of the institution's privacy 
policy to any continuing customer; and (4) notice of changes in the 
institution's practices on information sharing. These requirements are 
subject to the PRA. The Rule does not require recordkeeping.
    Estimated annual hours burden: Estimating the paperwork burden of 
the GLBA Rule's disclosure requirements is very difficult because of 
the highly diverse group of affected entities, consisting of financial 
institutions not regulated by a federal financial regulatory agency. 
Under section 505(a)((7) of the GLBA, the Commission has jurisdiction 
over the entities that are not specifically subject to another agency's 
jurisdiction (see sections 505(a)(1)-(6) of the GLBA). Because of the 
types of disclosures at issue and the requirements of the regulations, 
the frequency of responses, and the volume of respondents, cannot be 
determined with certainty.
    The burden estimates represent the FTC staff's best assessment, 
based on its knowledge and expertise relating to the financial 
institutions subject to the Commission's jurisdiction under this law. 
To derive these estimates, staff considered the wide variations in 
covered entities. In some instances, covered entities may make the 
required disclosures in the ordinary course of business, apart from the 
GLBA Rule. In addition, some entities may use highly automated means of 
providing the required disclosures, while others may rely on methods 
requiring more manual effort. The burden estimates shown below include 
the time necessary to train staff to comply with the regulations. These 
figures are averages based on staff's best estimate of the burden 
incurred over the broad spectrum of covered entities.
    Start-up hours and labor costs for new entities: While staff 
believes its prior estimate of the number of entities subject to the 
Rule (100,000) remains reasonable, it also estimates that, on average, 
no more than approximately 5,000 new entities each year will address 
the GLBA Rule for the first time. The prior amount recognized the 
newness of the Rule and the many existing business entities that would 
be subject to it for the first time. The estimates regarding already 
established entities are reflected in the second table below, and 
retain the larger population estimate as the base for further 
calculations.\1\
---------------------------------------------------------------------------

    \1\ While the existing population affected would increase with 
the inflow of new entrants, staff will retain its estimate of 
overall population affected, allowing, in part, for businesses that 
will close in any given year, and the difficulty of establishing a 
more precise estimate.

----------------------------------------------------------------------------------------------------------------
                                          Number of hours/costs
                                           per event and labor    Approx. number  Approx. annual   Approx. total
                 Event                       category * (per      of respondents       hours           costs
                                               respondent)                          (millions)      (millions)
----------------------------------------------------------------------------------------------------------------
Reviewing internal policies and         Managerial/professional            5,000           0.1                $5
 developing GLBA-implementing            time: 20 hrs/$1,000.
 instructions **.
Creating actual disclosure document or  Clerical: 5 hrs/$50;               5,000            .075            1.25
 electronic disclosure (including        skilled labor: 10 hrs/
 initial, annual, and opt out            $200.
 disclosures).
Disseminating initial disclosure        Clerical: 15 hrs/$150;             5,000            .125            1.75
 (including opt out notices).            skilled labor: 10 hrs/
                                         $200.
                                       -------------------------------------------------------------------------
      Total...........................  ........................  ..............            .300           8.00
----------------------------------------------------------------------------------------------------------------
* Staff calculated labor costs by applying appropriate hourly cost figures to burden hours. The hourly rates
  used were $50 for managerial/professional time (e.g., compliance evaluation and/or planning), $20 for skilled
  technical time (e.g., designing and producing notices, reviewing and updating information systems), and $10
  for clerical time (e.g., reproduction tasks, filing, and, where applicable to the given event, typing or
  mailing). Labor cost totals reflect solely that of the commercial entities affected. Staff assumes that the
  time required of consumers to respond affirmatively to respondents' opt-out programs (be it manually or
  electronically) would be minimal.
** Reviewing instructions includes all efforts performed by or for the respondent to: determine whether and to
  what extent the respondent is covered by an agency collection of information, understand the nature of the
  request, and determine the appropriate response (including the creation and dissemination of document and/or
  electronic disclosures).

    Burden hours and costs for established entities: Burden 
forestablished entities already familiar with the Rule would 
predictably be lessthan for start-up entities since start-up costs, 
such as crafting a privacy policy,

[[Page 9739]]

are generally one-time costs and have already been incurred. Staff's 
best estimate of the average burden for these entities is as follows:

----------------------------------------------------------------------------------------------------------------
                                          Number of hours/costs
                                           per event and labor    Approx. Number  Approx. annual   Approx. total
                 Event                       category * (per      of respondents       hours           costs
                                               respondent)                          (millions)      (millions)
----------------------------------------------------------------------------------------------------------------
Reviewing GLBA-implementing policies    Managerial/professional           70,000             .28           $14.0
 and practices.                          time: 4 hrs/$200.
Disseminating annual disclosure.......  Clerical: 15 hrs/$150;            70,000            1.40            17.5
                                         skilled labor: 5 hrs/
                                         $100.
Changes to privacy policies and         Clerical: 15 hrs/$150;             1,000             .02             .25
 related disclosures.                    skilled: 5 hrs/$100.
                                       -------------------------------------------------------------------------
      Total...........................  ........................  ..............            1.70          31.75
----------------------------------------------------------------------------------------------------------------
* Staff calculated labor costs by applying appropriate hourly cost figures to burden hours. The hourly rates
  used were $50 for managerial/professional time (e.g., compliance evaluation and/or planning), $20 for skilled
  technical time (e.g., designing and producing notices, reviewing and updating information systems), and $10
  for clerical time (e.g., reproduction tasks, filing, and, where applicable to the given event, typing or
  mailing). Consumers have a continuing right to opt-out, as well as a right to revoke their opt-out at any
  time. When a respondent changes its information sharing practices, consumers are again given the opportunity
  to opt-out. Again, staff assumes that the time required of consumers to respond affirmatively to respondents'
  opt-out programs (be it manually or electronically) would be minimal.
** The estimate of respondents is based on the following assumptions: (1) 100,000 respondents, approximately 70%
  of whom maintain customer relationships exceeding one year, (2) no more than 1% (1,000) of whom make
  additional changes to privacy policies at any time other than the occasion of the annual notice; and (3) such
  changes will occur no more often than once per year.

    As calculated above, the average PRA burden for all affected 
entities in a given year would be 1,000,000 hours and $19,875,000.
    Estimated Capital/Other Non-Labor Costs Burden: Staff estimates 
that the capital or other non-labor costs associated with the document 
requests are minimal. Covered entities will already be equipped to 
provide written notices (e.g., computers with word processing programs, 
typewriters, copying machines, mailing capabilities.) Most likely, only 
entities that already have on-line capabilities will offer consumers 
the choice to receive notices via electronic format. As such, these 
entities will already be equipped with the computer equipment and 
software necessary to disseminate the required disclosures via 
electronic means.

John D. Graubert,
Acting General Counsel.
[FR Doc. 02-5128 Filed 3-02; 8:45 am]
BILLING CODE 6750-01-M