[Federal Register Volume 67, Number 95 (Thursday, May 16, 2002)]
[Notices]
[Pages 34929-34931]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 02-12265]


-----------------------------------------------------------------------

FEDERAL TRADE COMMISSION


Agency Information Collection Activities; Proposed Collection; 
Comment Request; Extension

AGENCY: Federal Trade Commission (``FTC'').

ACTION: Notice.

-----------------------------------------------------------------------

SUMMARY: The FTC has submitted to the Office of Management and Budget 
(OMB) for review under the Paperwork Reduction Act (PRA) information 
collection requirements contained in its Gramm-Leach-Bliley Act Privacy 
Rule (``GLBA Rule'' or ``Rule''). The FTC is seeking public comments on 
its proposal to extend through June 30, 2005 the current PRA clearance 
for information collection requirements contained in the Rule.

DATES: Comments must be submitted on or before June 17, 2002.

ADDRESSES: Send written comments to the Office of Information and 
Regulatory Affairs, Office of Management and Budget, New Executive 
Office Building, Room 10202, Washington, DC 20503, ATTN.: Desk Officer 
for the Federal Trade Commission (comments in electronic form should be 
sent to [email protected]), and to Secretary, Federal Trade 
Commission, Room H-159, 600 Pennsylvania Ave., NW., Washington, DC 
20580 (comments in electronic form should be sent to 
[email protected]). All comments should be captioned ``GLBA Rule: 
Paperwork Comment,'' as prescribed below.

FOR FURTHER INFORMATION CONTACT: Requests for additional information or 
copies of the proposed information requirements should be addressed to 
Loretta Garrison, Attorney, Division of Financial Practices, Bureau of 
Consumer Protection, Federal Trade Commission, Room S-4429, 601 
Pennsylvania Ave., NW., Washington, DC 20580, (202) 326-3043.

SUPPLEMENTARY INFORMATION: Under the PRA (44 U.S.C. 3501-3520), Federal 
agencies must obtain approval from OMB for each collection of 
information they conduct or sponsor. On March 4, 2002, the FTC sought 
comments on the information collection requirements associated with the 
Rule, 16 CFR part 313 (OMB Control Number: 3084-0121). See 67 FR 9737 
(March 4, 2002); 67 FR 11745 (March 15, 2002) (correction notice). No 
comments were received. Pursuant to the OMB regulations that implement 
the PRA (5 CFR part 1320), the FTC is providing this second opportunity 
for public comment while seeking OMB approval to extend the existing 
paperwork clearance for the Rule.
    If a comment contains nonpublic information, it must be filed in 
paper form, and the first page of the document must be clearly labeled 
``confidential.'' Comments that do not contain any nonpublic 
information may instead be filed in electronic form (in ASCII format, 
WordPerfect, or Microsoft Word) as part of or as an attachment to email 
messages directed to the following email box: [email protected]. 
Such

[[Page 34930]]

comments will be considered by the Commission and will be available for 
inspection and copying at its principal office in accordance with 
Section 4.9(b)(6)(ii) of the Commission's rules of practice, 16 CFR 
section 4.9(b)(6)(ii).
    The GLBA Rule is designed to ensure that customers and consumers, 
subject to certain exceptions, will have access to the privacy policies 
of the financial institutions with which they conduct business. As 
mandated by the GLBA, 15 U.S.C. 6801-6809, the Rule requires financial 
institutions to disclose to consumers: (1) Initial notice of the 
financial institution's privacy policy when establishing a customer 
relationship with a consumer and/or before sharing a consumer's non-
public personal information with certain nonaffiliated third parties; 
(2) notice of the consumer's right to opt out of information sharing 
with such parties; (3) annual notice of the institution's privacy 
policy to any continuing customer; and (4) notice of changes in the 
institution's practices on information sharing. These requirements are 
subject to the PRA. The Rule does not require recordkeeping.
    Estimated annual hours burden: Estimating the paperwork burden of 
the GLBA Rule's disclosure requirements is very difficult because of 
the highly diverse group of affected entities, consisting of financial 
institutions not regulated by a federal financial regulatory agency. 
Under section 505(a)(7) of the GLBA, the Commission has jurisdiction 
over the entities that are not specifically subject to another agency's 
jurisdiction (see sections 505(a)(1)-(6) of the GLBA). Because of the 
types of disclosures at issue and the requirements of the regulations, 
the frequency of responses and the volume of respondents cannot be 
determined with certainty.
    The burden estimates represent the FTC staff's best assessment, 
based on its knowledge and expertise relating to the financial 
institutions subject to the Commission's jurisdiction under this law. 
To derive these estimates, staff considered the wide variations in 
covered entities. In some instances, covered entities may make the 
required disclosures in the ordinary course of business, apart from the 
GLBA Rule. In addition, some entities may use highly automated means of 
providing the required disclosures, while others may rely on methods 
requiring more manual effort. The burden estimates shown below include 
the time necessary to train staff to comply with the regulations. These 
figures are averages based on staff's best estimate of the burden 
incurred over the broad spectrum of covered entities.

Start-Up Hours and Labor Costs for New Entities

    Staff estimates that, on average, no more than approximately 5,000 
new entities each year will address the GLBA rule for the first time. 
These entities are accounted for in the table immediately below. At the 
time of the Rule's inception, staff's estimate of the number of 
entities newly subject to the Rule included not just start-up entities 
but also the many existing business entities that would be subject to 
it for the first time. The estimates regarding established entities are 
reflected in the second table below.

----------------------------------------------------------------------------------------------------------------
                                          Number of hours/costs
                                           per event and labor        Approx.         Approx.     Approx.  total
                 Event                       category*  (per         number of     annual hours        costs
                                               respondent)          respondents     (millions)      (millions)
----------------------------------------------------------------------------------------------------------------
Reviewing internal policies and         Managerial/professional            5,000           0.1             $5
 developing GLBA-implementing            time: 20 hrs/$1,000.
 instructions **.
Creating actual disclosure document or  Clerical: 5 hrs/$50.....           5,000            .075            1.25
 electronic disclosure (including       Skilled labor: 10 hrs/
 initial, annual, and opt out            $200.
 disclosures).
Disseminating initial disclosure        Clerical: 15 hrs/$150...           5,000            .125            1.75
 (including opt out notices).           Skilled labor: 10 hrs/
                                         $200.
                                       -------------------------------------------------------------------------
    Total.............................  ........................  ..............            .300            8.00 
----------------------------------------------------------------------------------------------------------------
* Staff calculated labor costs by applying appropriate hourly cost figures to burden hours. The hourly rates
  used were $50 for managerial/professional time (e.g., compliance evaluation and/or planning), $20 for skilled
  technical time (e.g., designing and producing notices, reviewing and updating information systems), and $10
  for clerical time (e.g., reproduction tasks, filing, and, where applicable to the given event, typing or
  mailing). Labor costs totals reflect solely that of the commercial entities affected. Staff assumes that the
  time required of consumers to respond affirmatively to respondents' opt-out programs (be it manually or
  electronically) would be minimal.
** Reviewing instructions includes all efforts performed by or for the respondent to: determine whether and to
  what extent the respondent is covered by an agency collection of information, understand the nature of the
  request, and determine the appropriate response (including the creation and dissemination of document and/or
  electronic disclosures).

Burden Hours and Costs for Established Entities

    Burden \1\ for established entities already familiar with the Rule 
would predictably be less than for start-up entities since start-up 
costs, such as crafting a privacy plicy, are generally one-time costs 
and have already been incurred. Staff's best estimate of the average 
burden for these entities is as follows:
---------------------------------------------------------------------------

    \1\ While the existing population affected would increase with 
the inflow of new entrants, staff will retain its estimate of 
overall population affected (100,000, but subject to further 
apportionment as detailed in the table below), allowing, in part, 
for businesses that will close in any given year, and the difficulty 
of establishing a more precise estimate.

----------------------------------------------------------------------------------------------------------------
                                          Number of hours/costs
                                           per event and labor        Approx.         Approx.     Approx.  total
                 Event                       category*  (per         number of     annual hours        costs
                                               respondent)         respondents**    (millions)      (millions)
----------------------------------------------------------------------------------------------------------------
Reviewing GLBA-implementing policies    Managerial/professional           70,000             .28           $14.0
 and practices.                          time: 4 hrs/$200.
Disseminating annual disclosure.......  Clerical: 15 hrs/$150...          70,000            1.40            17.5
                                        skilled labor: 5 hrs/
                                         $100.
Changes to privacy policies and         Clerical: 15 hrs/$150...           1,000             .02             .25
 related disclosures.                   skilled: 5 hrs/$100.....

[[Page 34931]]

 
                                                                 -----------------------------------------------
    Total.............................  ........................  ..............            1.70          31.75
----------------------------------------------------------------------------------------------------------------
* Staff calculated labor costs by applying appropriate hourly cost figures to burden hours. The hourly rates
  used were $50 for managerial/professional time (e.g., compliance evaluation and/or planning), $20 for skilled
  technical time (e.g., designing and producing notices, reviewing and updating information systems), and $10
  for clerical time (e.g., reproduction tasks, filing, and, where applicable to the given event, typing or
  mailing). Consumers have a continuing right to opt-out, as well as a right to revoke their opt-out at any
  time. When a respondent changes its information sharing practices, consumers are again given the opportunity
  to opt-out. Again, staff assumes that the time required of consumer to respond affirmatively to respondent's
  opt-out program (be it manually or electronically) would be minimal.
** The estimate of respondents is based on the following assumptions: (1) 100,000 respondents, approximately 70%
  of whom maintain customer relationships exceeding one year (2) no more than 1% (1,000) of whom make additional
  changes to privacy policies at any time other than the occasion of the annual notice; and (3) such changes
  will occur no more often than once per year.

    As calculated above, the average PRA burden for all affected 
entities in a given year would be 1,000,000 hours and $19,875,000.
    Estimated Capital/Other Non-Labor Costs Burden: Staff estimates 
that the capital or other non-labor costs associated with the document 
requests are minimal. Covered entities will already be equipped to 
provide written notices (e.g., computers with word processing programs, 
typewriters, copying machines, mailing capabilities.) Most likely, only 
entities that already have on-line capabilities will offer consumers 
the choice to receive notices via electronic format. As such, these 
entities will already be equipped with the computer equipment and 
software necessary to disseminate the required disclosures via 
electronic means.

William E. Kovacic,
General Counsel.
[FR Doc. 02-12265 Filed 5-15-02; 8:45 am]
BILLING CODE 6750-01-M