THIS SEARCH     THIS DOCUMENT     THIS CR ISSUE     GO TO
Next Hit        Forward           Next Document     New CR Search
Prev Hit        Back              Prev Document     HomePage
Hit List        Best Sections     Daily Digest      Help
                Doc Contents
STATEMENTS ON INTRODUCED BILLS AND JOINT RESOLUTIONS -- (Senate - November 10, 1999)

r bill would provide that consumers have (1) notice of the categories 

[Page: S14548]  GPO's PDF
of nonpublic personal inf ormation tha t institutions collect, as well as the practices and policies of that institution with respect to disclosing nonpublic information; (2 ) access to the nonpublic personal inf ormation col lected and shared; (3) affirmative consent, that is that the financial institution must receive the affirmative consent of the consumer, also referred to as an opt-in, in order to share such information wit h third parties and affiliates. Lastly, my provision would require that this federal law not preempt stronger state privacy law s. This bill is drafted largely after the amendment Senator BRYAN and I offered in the Conference on Financial Services Modernization, but failed to get adopted due to the Conference's rush to pass a financial modernization bill, no matter what the cost.

   I know some think that opt-in is extreme, but I have to tell you that is what the American people want. Over the past year I have learned a great deal about the activities of institutions sharing sensitive personal inf ormation. Ma ny may not be aware, but it had become a common practice for state department of motor vehicles to sell the drivers license information, in cluding name, height, weight, social security number, vehicle identification number, motor vehicle record and more. Some states even sold the digital photo image of each driver's license.

   I was not aware of this practice going on. When I learned about it and studied it a little closer, I found several groups who were outraged by this practice. One such group was Eagle Forum. Another such group was the ACLU. Still another group was the Free Congress Foundation. Before I knew it, there was an ad hoc coalition of groups not only supporting the issue of driver's license privacy, bu t demanding it.

   Thanks to the hard work of these groups, I was able to include an opt-in provision for people applying for drivers licenses at their state department of motor vehicles. That provision sailed through the Senate and then the House. That bill was signed into law by President Clinton. Despite significant lobbying by the direct marketing industry, not one member of the House or Senate took to the floor and said, ``I believe we should not allow consumers to choose whether or not their drivers license information, in cluding their picture, should be sold or traded

   away like an old suit.'' No, no one objected to the opt-in. As a result, I believe very strongly that Congress has already set the bar on this issue. Opt-in is not just reasonable, it is the right thing to do.

   Meanwhile, the ad hoc coalition, which is continuing to grow and includes every ideology from conservative to liberal, has signed on to four basic principles with regard to financial privacy. Th e principles include notice, access and consent, but also a requirement that weak federal laws not preempt stronger state laws. Our amendment incorporates those four basic principles.

   Now my basic question is this, why would anyone oppose this bill? Only if you believe the financial services industry cannot make money by doing business above the table and on the level for everyone to see in the ``sunshine'' if you will. If you believe that financial institutions make money only by deceiving their customers or leaving those customers in the dark, then maybe you should oppose this bill. I do not subscribe to such a belief.

   Industry will tell you that if they are required to include an opt-in, consumers will not, and therefore business will shut down. What does that tell you that consumers won't choose to opt-in? It means people don't want their information sha red. If that is such a problem, it seems to me the business would spend more time educating the consumer as to the benefits of information sha ring. That is where the burden to convince the consumer to buy the product should be--on the business.

   During the financial modernization debate, the financial industry, along with Citigroup communicated to Congress that they would not be able to operate or function appropriately with an opt-in requirement. I find that very difficult to comprehend, seeing as Citibank signed an agreement with their German affiliates in 1995 affording German citizens the opportunity to tell Citibank ``no,'' they did not want their personal dat a shared with third parties. I have a copy of the contract to prove it.

   Entitled, Agreement on ``Interterritorial Data Protection'' one can see this is an agreement on the sharing of customer information bet ween Citibank (South Dakota), referred in the document as CNA, and its German affiliates. On page two paragraph 4, entitled, Use of Subcontractors, Transmission of Data to Third Parties, number 2 reads:

   For marketing purposes, the transfer of personal dat a to third parties provided by the Card Service Companies (that is Citicorp of Germany and Citicorp Card Operations of Germany) is prohibited, except in those cases where such personal dat a is transferred to affiliated companies engaged in banking business in order to market financial services; the transfer of such data beyond the aforementioned scope to third parties, shall require the Card Service Companies' express approval. Such approval is limited to the scope of the Card Customers' consent as obtained on the application form.

   That ladies and gentlemen, is an opt-in to operate in Germany, by none other than Citigroup, the number one proponent of financial modernization. Now if they can offer financial privacy to individuals in Germany, why on God's green earth can't they agree to an opt-in here in America? Do Germans have special rights over Americans? I should hope not.

   Mr. President, simply put, this bill is what Americans want. This bill is workable as proven in the Citicorp agreement. The truth is that the American people do not understand the intricacies of banking law or securities regulation. They probably do not know or care much about affiliates or operating subsidiaries. What I do know, is that if you walked outside and polled people from New York City to Los Angeles, CA, and everywhere in between, they would not only understand financial privacy, 90 percent of them would demand financial privacy and the ability to tell an institution ``no.''

   Mr. President, in passing the financial modernization bill, Congress gave mammoth financial services companies significant expanded powers and unprecedented ability to collect, share, buy and sell a consumers nonpublic personal fin ancial information. Du ring the debate, many members promised they would address privacy, bu t only in a separate bill at a later time. Well, Mr. President, the time is now and the bill is the ``Consumer's Right to Financial Privacy Act .''

   The financial industry may have won the battle by keeping stronger financial privacy pro visions out of the financial modernization bill. But I assure you they have not won the war. They cannot win the war on financial privacy bec ause the American people just won't allow it.

   Mr. President, I ask unanimous consent that the agreement on ``International Data Protection'' be printed in the RECORD.

   There being no objection, the material was ordered to be printed in the RECORD, as follows:

   Agreement on Interterritorial Data Protection

   BY AND BETWEEN
1..Citicorp Kartenservice GmbH, Wilhelm-Leuschner-Str. 32, 60329 Frankfurt/M, Germany (CKS)
2..Citicorp Card Operations GmbH, Bentheimer Stra be 118, 48529 Nordhorn, Germany (CCO)

   (CKS and CCO hereinafter collectively referred to as: Card Service Companies)


3..Citibank (South Dakota), N.A., Attn.: Office of the President, 701 E. 60th Street North, Sioux Falls, South Dakota 57117 (CNA)
4..Citibank Privatkunden AG, Kasernenstra be 10, 40213 Du 4sseldorf, Germany (CIP)

   RECITAL

   1. CIP has unrestricted authority to engage in banking transactions. As a license of VISA International, CIP issues the Citibank Visa Card''. Additionally, since July 1st, 1995, CIP has been cooperating with the Deutsche Bahn AG in issuing the ``DB/Citibank BahnCard'' with a cash-free payment function--hereinafter referred to as ``DB/Citibank-BahnCard''--on the basis of a Co-Branding Agreement concluded between Deutsche Bahn AG and CIP on November 18th, 1994. After the conclusion of the Agreement, the co-branding business was extended to include the issuance of the DB/Citibank BahnCard without a cash-free payment function, known as BahnCard ``pure''.

   2. CIP transferred to CKS the operations of the Citibank Visa credit card business, including accounting and electronic data processing, on the basis of the terms of a Service Agreement (non-gratuitous contract for services) dated March 24, 1998, supplemented as of June 1, 1989 and November 30, 1989. Details are contained in the ``CKS Service 

[Page: S14549]  GPO's PDF
Agreement'', according to which CKS performs for CIP all services pertaining to the Citibank Visa card business. Concurrent with the application for a Citibank Visa Card, the Citibank Visa Card customers agree to the transfer of their personal dat a to CKS and to those companies entrusted by CKS with such data processing.

   3. In the Co-Branding Agreement with the Deutsche Bahn AG dated November 18, 1994, CIP assumed responsibility for the issuance of the DB/Citibank BahnCard as well as for the entire management and operations associated with this business.

   4. On the basis of a Service Agreement dated April 1, 1995, CIP transferred the entire operations of the DB/Citibank-BahnCard business, including data processing and accounting, to the Card Service Companies. Details are contained in the ``BahnCard Service Agreement''. Concurrent with the application for issuing a DB/Citibank BahnCard, the BahnCard customers agree to the transfer of their personal dat a to CCO and to those companies entrusted by CCO with such data processing.

   5. Due to reasons of efficiency, service and centralization, the Card Service Companies have entrusted CNA with the processing of the Citibank Visa card business and of the DB/Citibank BahnCard business as of July 1, 1995. In light of such considerations, the Card Service Companies--as principals--and CNA--as contractors--concluded the ``CNA Service Agreement'', to which CIP expressly consented.

   6. The performance of the CNA Service Agreement requires the Card Service Companies to transfer the personal dat a of the Citibank Visa card customers and the DB/Citibank BahnCard customers--hereinafter collectively referred to as ``Card Customers''--to CNA and further requires CNA to process and use these data.

   In order to protect the Card Customers' rights with respect to both the data protection law, as well as the banking secrecy, and in order to comply with the banking supervisory and data protection requirements.

   The contractual parties agree and covenant as follows:

   §1 BASIC PRINCIPLES

   The parties hereto undertake to safeguard the Card Customers' right to protection against unauthorized capture, storage and use of their personal dat a and their right to informational self-determination. The scope of such protection shall be governed by the standards as laid down in the German Federal Data Protection Law (Bundesdatenschutzgesetz, abbreviated to ``BDSG''). The parties hereto additionally agree to comply with the banking secrecy regulations.

   §2 INSTRUCTIONS OF THE CARD SERVICE COMPANIES

   1. CNA shall process the data provided by the Card Service Companies solely in accordance with the Card Service Companies' instructions and rules, and the provisions contained in this Agreement. CNA undertakes to process and use the data only for the purpose for which the data have been provided by the Card Service Companies to CNA, said purposes including those as described in the CNA Service Agreement. The use of such data for purposes other than described above requires the Card Service Companies' express written consent.

   2. At any time, the Card Service Companies may make inquiries to CNA about the personal dat a transferred by the Card Service Companies and stored at CNA, and the Card Service Companies may require CNA to perform corrections, deletions or blockings of such personal dat a transferred by the Card Service Companies to CNA.

   §3 INSPECTION RIGHTS OF THE CARD SERVICE COMPANIES

   At regular intervals, an (joint) agent appointed by the Card Service Companies shall verify whether CNA complies with the terms and conditions of this Agreement, and in particular with the data protection law as well as the banking secrecy regulations. CNA shall grant the Card Service Companies' agent supervised unimpeded access to the extent necessary to accomplish the inspection and review of all data processing facilities, data files and other documentation needed for processing and utilizing the personal dat a transferred by the Card Service Companies in a fashion which is consistent with the CNA Operational Policies. CNA shall provide the agent with all such information as deemed necessary to perform this inspection function.

   §4 USE OF SUBCONTRACTORS, TRANSMISSION OF DATA TO THIRD PARTIES

   1. CNA may not appoint non-affiliated third parties, in particular subcontractors, to perform and fulfill CNA's commitments and obligations under this Agreement.

   2. For marketing purposes, the transfer of personal dat a to third parties provided by the Card Service Companies is prohibited, except in those cases where such personal dat a is transferred to affiliated companies engaged in the banking business in order to market financial services; the transfer of such data beyond the aforementioned scope to third parties shall require the Card Service Companies' express approval. Such approval is limited to the scope of the Card Customers' consent as obtained on the application form. The personal dat a of customers having obtained a BahnCard ``pure'' may only be used or transferred for BahnCard marketing purposes.

   CNA and the Card Service Companies undertake to institute and maintain the following data protection measures:

   1. Access control of persons

   CNA shall implement suitable measures in order to prevent unauthorized persons from gaining access to the data processing equipment where the data transferred by the Card Service Companies are processed.

   This shall be accomplished by:

   a. Establishing security areas;

   b. Protection and restriction of access paths;

   c. Securing the decentralized data processing equipment and personal com puters;

   d. Establishing access authorizations for employees and third parties, including the respective documentation;

   e. Identification of the persons having access authority;

   f. Regulations on key-codes;

   g. Restriction on keys;

   h. Code card passes;

   i. Visitors books;

   j. Time recording equipment;

   k. Security alarm system or other appropriate security measures.

   2. Data media control

   CNA undertake to implement suitable measures to prevent the unauthorized reading, copying, alteration or removal of the data media used by CNA and containing personal dat a of the Card Customers.

   This shall be accomplished by:

   a. Designating the areas in which data media may/must be located;

   b. Designating the persons in such areas who are authorized to remove data media;

   c. Controlling the removal of data media;

   d. Securing the areas in which data media are located;

   e. Release of data media to only authorized persons;

   f. Control of files, controlled and documented destruction of data media;

   g. Policies controlling the production of back-up copies.

   3. Data memory control

   CNA undertakes to implement suitable measures to prevent unauthorized input into the data memory and the unauthorized reading, alteration or deletion of the stored data on Card Customers.

   This shall be accomplished by:

   a. An authorization policy for the input of data into memory, as well as for the reading, alteration and deletion of stored data;

   b. Authentication of the authorized personnel;

   c. Protective measures for the data input into memory, as well as for the reading, alteration and deletion of stored data,

   d. Utilization of user codes (passwords);

   e. Use of encryption for critical security files.

   f. Specific access rules for procedures, control cards, process control methods, program cataloging authorization;

   g. Guidelines for data file organization;

   h. Keeping records of data file use;

   i. Separation of production and test environment for libraries and data files

   j. Providing that entries to data processing facilities (the rooms housing the computer hardware and related equipment) are capable of being locked,

   k. Automatic log-off of user ID's that have not been used for a substantial period of time.

   4. User control

   CNA shall implement suitable measures to prevent its data processing systems from being used by unauthorized persons by means of data transmission equipment.

   This shall be accomplished by:

   a. Identification of the terminal and/or the terminal user to the DP system;

   b. Automatic turn-off of the user ID when several erroneous passwords are entered, log file of events, (monitoring of break-in-attempts);

   c. Issuing and safeguarding of identification codes;

   d. Dedication of individual terminals and/or terminal users, identification characteristics exclusive to specific functions;

   e. Evaluation of records.

   5 Personnel control

   Upon request, CNA shall provide the Card Service Companies with a list of the CNA employees entrusted with processing the personal dat a transferred by the Card Service Companies, together with a description of their access rights.

   6. Access control to data

   CNA commits that the persons entitled to use CNA's data processing system are only able to access the data within the scope and to the extent covered by the irrespective access permission (authorization).

   This shall be accomplished by:

   a. Allocation of individual terminals and/or terminal user, and identification characteristics exclusive to specific functions; 

THIS SEARCH     THIS DOCUMENT     THIS CR ISSUE     GO TO
Next Hit        Forward           Next Document     New CR Search
Prev Hit        Back              Prev Document     HomePage
Hit List        Best Sections     Daily Digest      Help
                Doc Contents