Those Other Laws

1. 2006 NCHELP FALL TRAINING CONFERENCE Those Other Laws Dino Tsibouris Attorney at Law dino@tsibouris.com

2. 2006 NCHELP FALL TRAINING CONFERENCE It’s all so regulated… • Licensing requirements to do business • Limits to interest rates and loan fees • Privacy and information security

3. 2006 NCHELP FALL TRAINING CONFERENCE Licensing • National banks and thrifts don’t need a license from the state • Non-bank lenders and purchasers of loans may need a license to make or enforce a loan

4. 2006 NCHELP FALL TRAINING CONFERENCE Licensing • A common test: Are you in the “business of lending?” • NJ includes companies that purchase loans from others • OH includes the original lender only • MN excludes loans under other state law

5. 2006 NCHELP FALL TRAINING CONFERENCE Licensing • Physical location concerns • Limits on assignment • Specific rates of interest and permissible fees

6. 2006 NCHELP FALL TRAINING CONFERENCE Loan Pricing • State license lender laws establish permitted rates and fees • Interest rates • Late fees • Loan origination fees of 1-2% • Prepayment fees • Refund of unearned charges

7. 2006 NCHELP FALL TRAINING CONFERENCE Loan Pricing • National Bank Act (12 USC 85) • A national bank located in a state may charge interest at the maximum rate permitted to any state-chartered or licensed lending institution by the law of that state

8. 2006 NCHELP FALL TRAINING CONFERENCE Loan Pricing • National Bank Act (12 USC 85) “Interest" includes any payment compensating a creditor for: • An extension of credit • Making available of a line of credit • Any default or breach by a borrower

9. 2006 NCHELP FALL TRAINING CONFERENCE Loan Pricing • National Bank Act 12 USC 85 • “Interest" includes, among other things: • Numerical periodic rates • Late fees • Creditor-imposed NSF fees

10. 2006 NCHELP FALL TRAINING CONFERENCE Loan Pricing • National Bank Act 12 USC 85 • “Interest" does not ordinarily include: • Premiums/commissions for insurance guaranteeing repayment of any extension of credit • Document preparation • Fees incurred to obtain credit reports

11. 2006 NCHELP FALL TRAINING CONFERENCE Loan Pricing – Tied to State Law • Ohio Revised Code 1109.20 • Interest/finance charges not exceeding APR of twenty-five per cent • Also may charge, as interest, other fees and charges that are agreed upon by the bank and the borrower

12. 2006 NCHELP FALL TRAINING CONFERENCE Loan Pricing – Tied to State Law • RC 1109.20 “Interest” • Charges for late payments • NSF fees • Application, processing, origination fees • Guarantee fees • Prepayment fees

13. 2006 NCHELP FALL TRAINING CONFERENCE Loan Pricing – Tied to State Law • RC 1109.20 “Interest” • Any fees and charges shall not be included in the computation of the annual percentage rate or the rates of interest or finance charges for purposes of applying the twenty-five per cent limitation

14. 2006 NCHELP FALL TRAINING CONFERENCE Loan Pricing – Tied to State Law • 12 CFR 7.4001The term “interest” as used in 12 U.S.C. 85 includes … includes, among other things,… • RC 1109.20 A bank may charge… as interest, other fees and charges that are agreed upon … including, but not limited to,… • Many possibilities; uncertain outcomes

15. 2006 NCHELP FALL TRAINING CONFERENCE Important Considerations • Make sure rates and fees are properly structured • Within legal limits • Business case for each fee • Challenges to the relationship between lenders those who buy their loans

16. 2006 NCHELP FALL TRAINING CONFERENCE Privacy • GLB • Contract management • State privacy law • FTC • Breach notification

17. 2006 NCHELP FALL TRAINING CONFERENCE Privacy – GLB Permitted Sharing • Third party with notice and opt-out • Permitted disclosure without consent • Service providers (notice, contract) • Joint marketing agreements (contract) • Express consent from consumer

18. 2006 NCHELP FALL TRAINING CONFERENCE Privacy – Consent • GLB: “Clear and Conspicuous” • Reasonably understandable and designed to call attention to the nature and significance of the information contained • May combine with other clear and conspicuous notices • FCRA: “Clear and Conspicuous” • Small type on back of mailer in a paragraph of type about other matters inadequate (Use different type, color - Cole v. U.S. Capital)

19. 2006 NCHELP FALL TRAINING CONFERENCE Privacy – Scope of Consent I authorize the release of information pertinent to my loans: (i) by the school, the lender, and the guarantor, or theiragents, to the references on the applicable loans and to members of my immediate family unless I submit written directions otherwise; and, (ii) by and among my schools, lenders, guarantors, the Department of Education, and theiragents. Source: FFELP MPN

20. 2006 NCHELP FALL TRAINING CONFERENCE Privacy – Scope of Consent • Agent: A person authorized to act for and under the direction of another person when dealing with third parties. Can enter into binding agreements on the principal's behalf and may even create liability for the principal if the agent causes harm while carrying out his or her duties. Source: www.nolo.com

21. Security • 88,348,579+ persons had their PFI improperly accessed/stolen between February 15, 2005 and June 16, 2006 (Privacy Rights Clearinghouse) • A consumer calling the FTC helpline reported that in one day thieves used her stolen PFI to open 9 credit card accounts and charged $15,000

22. Technical Security • Hackers • Unprotected Wireless Access • Compromised Passwords • Unencrypted Data Storage and/or Transmissions

23. Physical Security • CDs/Files Lost/Stolen During Transport • Files Lost/Stolen from Storage • Improper Destruction of Files • Lost/Stolen Laptops

24. Humans, Contractors, and Vendors • Dishonest Persons • Failure to Follow Corporate Security Regulations • Mistakes/Errors

25. 2006 NCHELP FALL TRAINING CONFERENCE Privacy – Contract Management • Privacy Agreements • Limits on use • Audit rights • Notice if breached • Indemnity for claims and losses • No limit on liability

26. 2006 NCHELP FALL TRAINING CONFERENCE If a Breach Occurs • Key steps • Identify the information lost • Identify “affected persons” • Notify law enforcement • Prepare customer and media response plan • Notify affected persons

27. State Laws • Consumer protection and deceptive trade statutes • State AGs offices are pursuing loss or breach of consumer personal information through traditional consumer protection and deceptive trade practices statutes

28. Federal Laws • Federal Trade Commission Act (FTC Act) prohibits “unfair or deceptive acts or practices.” • Gramm Leach Bliley Act governs the collection and disclosure of NPI (Privacy Rule); requires design, application, and maintenance of safeguards to protect NPI (Safeguards Rule)

29. DSW, Inc. Both state and federal cases were filed against DSW, Inc. • DSW is based in Ohio and sells shoes in 206 stores nationwide • Ohio Attorney General filed suit under Ohio Consumer Sales Practices Act • Federal Trade Commission filed suit under FTC Act

30. DSW, Inc. • DSW retained consumers’ names, credit/debit card numbers, checking account information and drivers’ license numbers • March 8, 2005 DSW learns that the data it retained from some 1.4M sales transactions was removed from its custody

31. State of Ohio v. DSW, Inc. • Attorney General suit claimed DSW’s failure to notify all affected consumers was “unfair or deceptive” act under Ohio’s Consumer Sales Practices Act • Asked court to order DSW to send written notice to all affected consumers

32. State of Ohio v. DSW, Inc. • DSW: Difficult to contact all customers because it did not keep detailed information on all customers' addresses • DSW SEC filing: Set aside $6.5 million to handle claims from the case and indicated total exposure could reach $9.5 million

33. In re DSW, Inc. FTC: DSW violated FTC Act when it “failed to provide reasonable and appropriate security for personal information collected at its stores”

34. In re DSW, Inc. • Alleged violations: • Storing data it didn’t need to keep • Not using available security measures to limit wireless access to computer networks • Storing data in unencrypted files, accessed via a well known user ID and password • Failing to employ sufficient measures to detect unauthorized access

35. In re DSW, Inc. Settlement DSW must establish a comprehensive information security program: • Reasonably designed to protect the security, confidentiality, and integrity of personal information collected from or about consumers • Fully documented in writing • Contain administrative, technical, and physical safeguards appropriate to DSW’s size and complexity

36. In re DSW, Inc. Settlement • “Security Program” Requires: • Designated employee(s) to coordinate and be accountable for IS program • Identify internal/external risks to NPI that could result in unauthorized disclosure or misuse • Assessment of the sufficiency of any safeguards used to control risks

37. In re DSW, Inc. Settlement • “Security Program” Requires: • Regular testing of the key controls, systems, and procedures • Evaluation and adjustment of the program based on results of testing, material changes to operations or business arrangements

38. In re DSW, Inc. Settlement • “Security Program” Requires: • Initial/biennial assessments and reports from independent third-party professional, using industry procedures and standards for a period of twenty (20) years

39. Gramm Leach Bliley Act • Violations of the G-L-B Act’s Privacy and Safeguards Rules are an “unfair or deceptive act or practice” in violation of the FTC Act • Privacy Rule mainly concerns drafting and delivery of “Privacy Notices” to consumers • Safeguards Rule mainly concerns security protection for NPI

40. In re NATIONWIDE MTGE GRP, INC. • FTC complaint alleged Nationwide and its owner collected NPI and failed to protect it • Violation of Privacy Rule is an unfair and deceptive practice under the FTC Act • Violation of Safeguards Rule is an unfair and deceptive practice under the FTC Act

41. In re NATIONWIDE MTGE GRP, INC. Security Rule settlement requirements: • Assign employee(s) to oversee program; • Conduct a risk assessment; • Put safeguards in place to control the risks identified and regularly test them; • Require service providers, by written contract, to protect NPI; and • Periodically update its security program

42. In re NATIONWIDE MTGE GRP, INC. • Additional requirements: • Nationwide must obtain an assessment on its safeguards from a qualified, independent third-party • Must use industry procedures and standards • biennially for ten (10) years

43. Guin v. Brazos Higher Education Service Corp., Inc. • NO duty under GLB to encrypt; Brazos acted with “reasonable care” • Laptop containing unencrypted NPI stolen from employee’s home office • Guin alleged Brazos’ failure to encrypt violated duty under GLB Act to protect security and confidentiality of NPI

44. 2006 NCHELP FALL TRAINING CONFERENCE Questions? Dino Tsibouris dino@tsibouris.com