Privacy of Consumer Financial Information; Conforming Amendments Under Dodd-Frank Act, 43874-43879 [2011-17710]

Agencies

• Commodity Futures Trading Commission

[Federal Register Volume 76, Number 141 (Friday, July 22, 2011)]
[Rules and Regulations]
[Pages 43874-43879]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: 2011-17710]


-----------------------------------------------------------------------

COMMODITY FUTURES TRADING COMMISSION

17 CFR Part 160

RIN 3038-AD13


Privacy of Consumer Financial Information; Conforming Amendments 
Under Dodd-Frank Act

AGENCY: Commodity Futures Trading Commission.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: The Commodity Futures Trading Commission (``Commission'' or 
``CFTC'') is amending its rules implementing new statutory provisions 
enacted by titles VII and X of the Dodd-Frank Wall Street Reform and 
Consumer Protection Act (the ``Dodd-Frank Act''). Section 1093 of the 
Dodd-Frank Act provides for certain amendments to title V of the Gramm-
Leach-Bliley Act (the ``GLB Act''). The GLB Act sets forth certain 
protections for the privacy of consumer financial information and was 
amended by the Dodd-Frank Act to affirm the Commission's jurisdiction 
in this area. The Commission's amendments to its regulations, inter 
alia, broaden the scope of part 160 to cover two new entities created 
by title VII of the Dodd-Frank Act: swap dealers and major swap 
participants.

DATES: Effective date: September 20, 2011.
    Compliance dates: Futures commission merchants, commodity pool 
operators, commodity trading advisors, introducing brokers, and retail 
foreign exchange dealers shall be in compliance with these rules not 
later than November 21, 2011. Swap dealers and major swap participants 
shall be in compliance with these rules not later than 60 days after 
the effective date of the final entities definition rulemaking, which 
the Commission will publish in the Federal Register at a future date.

FOR FURTHER INFORMATION CONTACT: Carl E. Kennedy, Counsel, Office of 
General Counsel, (202) 418-6625, e-mail: c_kennedy@cftc.gov, Commodity 
Futures Trading Commission, Three Lafayette Centre, 1155 21st Street, 
NW., Washington, DC 20581.

SUPPLEMENTARY INFORMATION:

I. Background

    Section 5g(b) of the CEA provides the Commission with the authority 
to

[[Page 43875]]

prescribe regulations that establish appropriate standards for 
financial institutions subject to its jurisdiction to safeguard 
customer records and information in accordance with title V of the GLB 
Act.\1\ Pursuant to this authority, the Commission promulgated part 160 
of its regulations to require certain CFTC-regulated entities \2\ to 
adopt appropriate policies and procedures that address safeguards to 
customer records and information, including initial and annual privacy 
notice requirements, opt-out provisions to the extent that these 
registrants wish to share such records and information with non-
affiliates, and other measures to protect nonpublic consumer 
information.\3\
---------------------------------------------------------------------------

    \1\ See Gramm-Leach-Bliley Act, Public Law 106-102, 113 Stat. 
1338 (1999) (codified in scattered sections of 12 U.S.C. and 15 
U.S.C.). As enacted, title V of the GLB Act limits the instances in 
which a financial institution may disclose nonpublic personal 
information about a consumer to nonaffiliated third parties, and 
requires a financial institution to disclose to all of its customers 
the institution's privacy policies and practices with respect to 
information sharing with both affiliates and nonaffiliated third 
parties. Section 5g(b) of the CEA treats the Commission as a Federal 
functional regulator within the meaning of title V of the GLB Act.
    \2\ The Commission did not become subject to title V of the GLB 
Act until 2000. Section 5g of the CEA was added by the Commodity 
Futures Modernization Act of 2000 (7 U.S.C. 7b-2) to make the 
Commission a ``Federal functional regulator'' subject to the GLB Act 
Title V. Section 5g provides that the following entities are subject 
to the Commission's jurisdiction for the purposes of title V of the 
GLB Act: futures commission merchants (``FCMs''), commodity trading 
advisors (``CTAs''), commodity pool operators (``CPOs''), and 
introducing brokers (``IBs''). The scope of the part 160 rules 
mirrors this list of entities.
    The Commission jointly promulgated final rules with the Office 
of the Comptroller of the Currency, the Board of Governors of the 
Federal Reserve System, the Federal Depository Insurance 
Corporation, the Office of Thrift Supervision, the National Credit 
Union Administration, and the Securities and Exchange Commission 
(collectively, the ``Agencies'') on April 27, 2001. See 66 FR 21236, 
Apr. 27, 2001. On September 10, 2010, the Commission expanded the 
scope of entities subject to the part 160 rules to include retail 
foreign exchange dealers (``RFEDs'').
    \3\ Section 160.3(h)(1) of the Commission's regulations defines 
the term consumer to mean ``an individual who obtains or has 
obtained a financial product or service from [a financial 
institution] that is to be used primarily for personal, family or 
household purposes, or that individual's legal representative.''
---------------------------------------------------------------------------

    On October 27, 2010, the Commission published for comment in the 
Federal Register proposed amendments to part 160 of its regulations 
(the ``Proposal'') \4\ to implement certain provisions in titles VII 
and X of the Dodd-Frank Wall Street Financial Reform and Consumer 
Protection Act (the ``Dodd-Frank Act'').\5\
---------------------------------------------------------------------------

    \4\ See 75 FR 66014, Oct. 27, 2010.
    \5\ See Public Law 111-203, 124 Stat. 1376 (2010). The text of 
the Dodd-Frank Act may be accessed at https://www.cftc.gov. Title X 
of the Dodd-Frank Act creates a new consumer financial services 
regulator, the Bureau of Consumer Financial Protection (the 
``Bureau''), that will assume most of the consumer financial 
services regulatory responsibilities currently spread among numerous 
agencies. However, these rules will continue to apply to financial 
institutions that are subject to the Commission's jurisdiction. In 
addition, the Commission will continue to have plenary oversight 
authority over such institutions.
---------------------------------------------------------------------------

    In the Proposal, the Commission sought comments on proposed 
amendments to part 160 in accordance with section 1093 \6\ and title 
VII of the Dodd-Frank Act to, inter alia, broaden the types of entities 
that are subject to the Commission's jurisdiction \7\ to provide 
certain privacy protections for consumer financial information to 
include swap dealers (SDs) and major swap participants (MSPs). In 
addition, the Commission proposed: (1) in accordance with the transfer 
of authority in title X, changing all references in part 160 from the 
FTC to the Bureau; and (2) renaming part 160 to ``Privacy of Consumer 
Financial Information under the Gramm-Leach-Bliley Act'' to harmonize 
the title of part 160 with a new part of the Commission's 
regulations.\8\
---------------------------------------------------------------------------

    \6\ Specifically, section 1093 of the Dodd-Frank Act amends 
section 504 of the GLB Act by providing that ``the [CFTC] shall have 
the authority to prescribe such regulations as may be necessary to 
carry out the purposes of [title V of the GLB Act] with respect to 
any financial institutions and other persons subject to the 
jurisdiction of the [CFTC] under section 5g of the [CEA].'' As 
discussed in the proposing release, the Commission has determined 
that section 1093 simply reaffirms its authority to prescribe 
regulations under title V of the GLB Act.
    \7\ Title VII of the Dodd-Frank Act creates two new entities 
over which the Commission has jurisdiction: swap dealers (``SDs'') 
and major swap participants (``MSPs''). The terms ``SD'' and ``MSP'' 
as used in this final rule refer to the statutory definitions of 
such terms as defined in title VII of the Dodd-Frank Act, and as may 
be further defined by the Commission in a future final rulemaking. 
See section 721(b) of the Dodd-Frank Act, which provides that the 
Commission has the authority to adopt rules further defining any 
term in the CEA in a manner that is consistent with the Dodd-Frank 
Act. See also section 721(c) which provides that the Commission is 
required to adopt a rule to further define, inter alia, the terms 
``swap dealer'' and ``major swap participant'' to include 
transactions and entities that have been structured to evade 
provisions in the Dodd-Frank Act.
    \8\ In a forthcoming release, the Commission plans to promulgate 
a new part 162, which provides privacy protections under the Fair 
Credit Reporting Act, 15 U.S.C. 1681 et seq. (``FCRA'').
---------------------------------------------------------------------------

    The 60-day public comment period on the Proposal expired on 
December 27, 2010. In response to the Proposal, the Commission received 
a total of six comments: Two substantive comments and four other 
comments that did not address the merits or substance of the Proposal.
    The Securities Industry and Financial Markets Association 
(``SIFMA'') commented on the following aspects of the proposal: (1) The 
proposed compliance date; (2) the annual burden estimate for the 
purpose of the Paperwork Reduction Act analysis and cost-benefit 
analysis; and (3) the appropriate standard applicable with regard to 
state laws.
    The International Swaps and Derivatives Association, Inc. 
(``ISDA'') and the Financial Services Roundtable (``FSR'') jointly 
submitted a comment letter generally in support of the Proposal. That 
is, ISDA and the FSR did not provide specific comments in response to 
the Proposal. ISDA and the FSR, however, encouraged the Commission to 
work collaboratively with other agencies to decrease duplication in 
regulation and increase efficiency industry-wide.
    The Commission's final rules, the specific comments noted above and 
the Commission's responses to those specific comments are discussed in 
greater detail below.\9\
---------------------------------------------------------------------------

    \9\ This final rule incorporates technical revisions to its 
proposed amendments to add clarity. These revisions are not 
substantive and are not of the nature for which notice and comment 
must be provided under the Administrative Procedure Act. For 
example, in Sec.  160.3(x)(7), the Commission deleted the language 
``subject to the jurisdiction of the Commission'' after the term 
``Any swap dealer,'' since the Commission believes that the 
inclusion of such language was redundant and unnecessary.
---------------------------------------------------------------------------

II. Rule Amendments

A. Renaming the Title of Part 160

    The Commission is renaming the title of part 160 to reflect the 
scope of the part 160 regulations. The Commission's part 160 
regulations implement certain protections for the privacy of consumer 
financial information under the GLB Act. To harmonize the title of part 
160 with the new part 162 being adopted under a separate 
rulemaking,\10\ Part 160 is renamed ``Privacy of Consumer Financial 
Information under the Gramm-Leach-Bliley Act.''
---------------------------------------------------------------------------

    \10\ In a forthcoming release titled ``Business Affiliate 
Marketing and Disposal of Consumer Information Rules,'' the 
Commission will adopt a new part 162 of its regulations.
---------------------------------------------------------------------------

B. Scope of 17 CFR 160.1(b)

    Regulation 160.1(b) sets out the scope of the Commission's rules 
and identifies the financial institutions covered by the rules that 
include CFTC registrants regardless of whether they are required to 
register with the Commission. As referenced above, the Commission is 
amending the scope of part 160 to add SDs and MSPs.

C. Section 160.3--Definitions

    Since the scope of the regulations extends to SDs and MSPs, the 
Commission amends Sec.  160.3 to add the definitions of SDs and MSPs to 
the list

[[Page 43876]]

of defined terms under Sec.  160.3. Specifically, the Commission 
defines ``major swap participant'' to have the same meaning as in 
section 1a(33) of the CEA, as further defined by the Commission's 
regulations, and includes any person registered as such thereunder. The 
Commission defines ``swap dealer'' to have the same meaning as in 
section 1a(49) of the CEA, as further defined by the Commission's 
regulations, and includes any person registered as such thereunder.
    There are existing definitions and related provisions under part 
160 that are amended to include these new registrants. Specifically, 
the definitions of ``financial institution'', ``affiliate'', and 
``you'' are amended to include swap dealers and major swap 
participants.

D. Section 160.15--Other Exceptions to Notice and Opt-out Requirements

    As noted above, title X of the Dodd-Frank Act transferred certain 
authority from the FTC to the Bureau. Accordingly, the Commission is 
changing the reference from the FTC to the Bureau in Sec.  160.15 to 
reflect that the Bureau is now a Federal functional regulator.

E. Section 160.17(b)--Relation to State Laws

    Existing Sec.  160.17(b) of the Commission's regulations clarifies 
the relationship of title V to state consumer protection laws. As a 
result of the creation of the Bureau and the transfer of certain 
authority from the FTC to the Bureau, the Commission proposed to amend 
Sec.  160.17(b) by replacing it with the standard set out in section 
1041(a)(2) of the Dodd-Frank Act. In the Commission's view, while the 
language of the standard in section 1041(a)(2) is structured slightly 
different from the existing standard in Sec.  160.17(b), the Commission 
believed that the proposed language was nearly identical in substance 
to the current standard in Sec.  160.17(b).
    SIFMA commented that the standard for relation to state laws should 
be the same as the standard under section 507(b) of the GLB Act. SIFMA 
asserted that the appropriate standard should more closely follow 
section 507(b)--not section 1041 of the Dodd-Frank Act--because the 
former standard would achieve maximum consistency with the rules of the 
Office of the Comptroller of the Currency, the Board of Governors of 
the Federal Reserve System, the Federal Depository Insurance 
Corporation, the Office of Thrift Supervision, the National Credit 
Union Administration, and the Securities and Exchange Commission 
(collectively, the ``Agencies'') and would maintain the settled 
expectations of the market participants, which have complied with the 
standards of GLB Act for several years.
    The Commission has carefully considered SIFMA's comment and has 
amended Sec.  160.17(b) to use the language of section 507(b) of the 
GLB Act, as amended by section 1093(6) of the Dodd-Frank Act. The 
Commission recognizes that market participants are familiar with the 
standard in section 507(b) of the GLB Act, and therefore, changing the 
language of the standard ever so slightly from what is in section 
507(b) may create unnecessary and unintended confusion.

F. Section 160.30--Procedures to Safeguard Customer Records and 
Information

    Section 160.30 requires CFTC registrants to adopt policies and 
procedures that, among other things, address administrative, technical 
and physical safeguards for the protection of customer records and 
information. The Commission amends the introductory sentence of Sec.  
160.30 to add SDs and MSPs to the list of CFTC registrants that must 
comply with this requirement.

III. Effective Date

    In the Proposal, the Commission proposed to adopt the amendments to 
part 160 on July 21, 2011, which coincides with the designated transfer 
date when various Federal agencies transfer their consumer protection 
authority to the Consumer Financial Protection Bureau pursuant to 
section 1100H of the Dodd-Frank Act.\11\ In response to the proposed 
effective date, SIFMA expressed concern that this timeframe would not 
provide covered entities with a reasonable amount of time to address 
and implement the new rules. To address this concern, SIFMA requested 
that the Commission extend the effective date of the final rules to 
commence nine months from the date of the rules' publication in the 
Federal Register to ensure a reasonable time for compliance.
---------------------------------------------------------------------------

    \11\ See 75 FR 57252-02, Sept. 20, 2010.
---------------------------------------------------------------------------

    The Commission partly agrees with SIFMA's comment in that SDs and 
MSPs may need a reasonable amount of time to comply with the amendments 
to part 160 since these are two new types of Commission-regulated 
entities. The Commission, however, believes that nine months is more 
time than is necessary for these new regulated entities to comply with 
part 160. The Commission has decided to establish staggered compliance 
dates for its regulated entities that fall within the scope of part 
160.\12\ Specifically, with respect to those Commission-regulated 
entities that were previously complying with part 160--FCMs, IBs, CPOs, 
CTA, and RFEDs--the amendments to part 160 will not require that these 
entities materially alter their compliance programs. Accordingly, in 
the Commission's view, the appropriate compliance date for these 
entities is 120 days from the date of publication in the Federal 
Register. With respect to SDs and MSPs, the compliance date for these 
entities is 60 days from the date of publication of the Commission's 
final entities definitional rulemaking, which shall be published in the 
Federal Register at a date in the future.\13\
---------------------------------------------------------------------------

    \12\ The effective date of the amendments to part 160 shall be 
60 days from the date of publication in the Federal Register.
    \13\ See the Commission's proposed entities definitional 
rulemaking at 75 FR 80174, Dec. 21, 2010.
---------------------------------------------------------------------------

IV. Related Matters

A. Cost-Benefit Considerations.

    Section 15(a) of the CEA explicitly requires the Commission to 
consider the costs and benefits of its actions before issuing a rule or 
order under the CEA. By its terms, section 15(a) neither requires the 
Commission to quantify the costs and benefits of amendments to 
regulations, nor does it require the Commission to determine whether 
the benefits of the amendments outweigh its costs. Section 15(a) 
specifies that the costs and benefits shall be evaluated in light of 
five broad areas of market and public concern: (1) Protection of market 
participants and the public; (2) efficiency, competitiveness and 
financial integrity of futures markets; (3) price discovery; (4) sound 
risk management practices; and (5) other public interest 
considerations. The Commission may in its discretion give greater 
weight to any one of the five enumerated areas and could in its 
discretion determine that, notwithstanding its costs, a particular 
amendment is necessary or appropriate to protect the public interest or 
to effectuate any of the provisions or accomplish any of the purposes 
of the CEA.
    Promulgated in 2001, part 160 of the Commission's regulations 
currently applies to several types of Commission-regulated entities, 
including FCMs, IBs, CTAs, CPOs and RFEDs. The Commission proposed and 
later promulgated the rules in part 160 in concert with the Agencies in 
order to broadly protect individual customers from all types of 
regulated businesses

[[Page 43877]]

(including businesses that are regulated with the Commission) that have 
access to nonpublic personal information. Part 160 imposes disclosure 
and procedural requirements that are either mandated by or fully 
consistent with the privacy provisions of the GLB Act and section 5g of 
the CEA.
    The Dodd-Frank Act created two new entities over which the 
Commission has jurisdiction (i.e., SDs and MSPs), and specifically 
mandated that the Commission has the authority to prescribe regulations 
as necessary to carry out the purposes of title V of the GLB Act for 
entities under its jurisdiction. In its Proposal, the Commission 
primarily sought to expand the scope of part 160 to cover these new 
entities because the Commission believes that, like FCMs, IBs, CTAs, 
CPOs and RFEDs, these new entities are more likely to have access to 
nonpublic personal information. The cost-benefit discussion in the 
Proposal analyzed the costs and benefits of extending the existing 
regulatory regime in part 160 to these new entities.
    The Commission has considered the costs and benefits of the final 
rule in light of comments received and the specific areas of concern 
identified in section 15(a). An analysis of the section 15(a) factors 
is set out immediately below, followed by a discussion of the comments 
received in response to the Commission's cost-benefit discussion in the 
Proposal.
    1. Protection of market participants and the public. The 
requirements to provide opt out notices and to protect customer 
information will benefit market participants and the public by 
protecting the privacy of their nonpublic personal information. The 
Commission believes that extending these requirements to SDs and MSPs 
will further ensure the protection of nonpublic personal information. 
The Commission further believes that the costs, which will be placed on 
these new entities will not exceed those costs currently placed on 
FCMs, IBs, CTAs, CPOs and RFEDs. In the Commission's view, SDs and MSPs 
will likely have similar resources and administrative infrastructure to 
comply with the part 160 requirements. Moreover, while these new 
entities will likely incur some incremental costs in complying with 
part 160, the privacy protection benefits that will accrue to the 
general public far outweigh those costs.
    2. Efficiency and competition. The requirements to provide initial 
and annual privacy notices will benefit efficiency and competition by 
allowing customers to compare the privacy policies of financial 
institutions. The Commission's final rules also will benefit efficiency 
and competition by allowing SDs and MSPs flexibility to distribute 
notices and to adopt policies and procedures to protect customer 
information that are best suited to the institution's business and 
needs. As noted above, the Commission believes that the costs, which 
will be placed on these new entities will not exceed those costs 
currently placed on FCMs, IBs, CTAs, CPOs and RFEDs. Indeed, SDs and 
MSPs will likely have similar resources and administrative 
infrastructure to comply with the part 160 requirements.
    3. Price discovery and financial integrity of futures and swaps 
markets, price discovery and sound risk management practices. The final 
rules should have no effect, from the standpoint of imposing costs or 
creating benefits, on the price discovery function or financial 
integrity of the futures and swaps markets or on the risk management 
practices of SDs or MSPs.
    4. Other public interest considerations. In the same manner that 
part 160 was designed to minimize the costs of compliance on FCMs, IBs, 
CTAs, CPOs and RFEDs, part 160 will similarly provide SDs and MSPs with 
maximum flexibility, consistent with legal requirements, to design 
their own compliance systems. Ultimately, the Commission believes that 
extending the scope of part 160 to SDs and MSPs will harmonize privacy 
protections for individual customers across the futures and swaps 
markets.
    5. Response to comments. In its Proposal, the Commission solicited 
comment on its consideration of these costs and benefits. The 
Commission received one comment with respect to costs and benefits of 
the Proposal. Specifically, SIFMA argued that the Commission also 
should consider anticipated additional costs associated with monitoring 
the privacy and opt-out notice process, addressing consumer issues, and 
adjusting records to comport with consumer requests. SIFMA did not 
provide specific cost information to support its comments.
    Despite SIFMA's argument that the Commission did not consider the 
additional costs identified above, there are several Commission-
regulated entities that already comply with part 160, and the final 
rule simply extends this protection to new registrants, SDs and MSPs. 
As noted above, the Commission believes that the costs, which will be 
placed on these new entities will be no greater than those costs 
currently placed on FCMs, IBs, CTAs, CPOs and RFEDs. In the 
Commission's view, there is no reason why SDs and MSPs should be 
excluded from these requirements to the extent that they conduct 
business with a natural person. SDs and MSPs will likely have similar 
resources and administrative infrastructure to comply with the part 160 
requirements. The additional costs that SIFMA raised (but did not 
articulate with specificity) were subsumed within the considerations 
discussed in the Proposal.\14\
---------------------------------------------------------------------------

    \14\ See the Commission's cost-benefit discussion and Paperwork 
Reduction Act analysis at 75 FR at 66016-17.
---------------------------------------------------------------------------

    In line with Section 15(a) of the CEA, the Commission believes that 
extending these provisions to SDs and MSPs is in the public interest 
and will further protect market the general public, promote efficiency 
and competition, and address other public interest considerations such 
as the harmonization of regulation across the futures and swaps 
markets. In the Commission's view, these benefits far outweigh the 
additional costs that SIFMA cited.

B. Paperwork Reduction Act.

    This rule contains information collection requirements. As required 
by the Paperwork Reduction Act of 1995, 44 U.S.C. 3501 et seq., the 
Commission submitted a copy of the Proposal to the Office of Management 
and Budget (``OMB'') for review. The Commission may not sponsor, and a 
person is not required to respond to an information collection unless 
it displays a currently valid OMB control number.
    The final rule, affecting part 160, titled ``Privacy of Consumer 
Financial Information,'' OMB Control Number 3038-0055, expands the 
scope of this part to cover SDs and MSPs, two new classes of 
registrants, now subject to Commission jurisdiction. The final rule 
imposes mandatory requirements for these entities. SDs and MSPs must 
provide initial and annual privacy and opt-out notices to all customers 
that are natural persons.
    In response to the Commission's request in the notice of proposed 
rulemaking for comments on any potential paperwork burden associated 
with this regulation, only one commenter provided a substantive comment 
addressing the merits of the Commission's proposed PRA calculations. In 
particular, SIFMA proposed that the burden estimate should be refined 
to reflect anticipated additional burden hours associated with 
monitoring the privacy and opt-out notice process, addressing consumer 
issues, and adjusting records to comport with consumer requests.

[[Page 43878]]

    Based on this comment, the Commission estimates that the 
approximately 300 SDs and MSPs may incur additional burden hours. 
Consequently, it is anticipated the 300 SDs and MSPs may incur an 
additional aggregate of 1440 burden hours than what was stated in the 
Proposal, monitoring an average of 20 notices per year, with an average 
monitoring time of .24 hours per notice. Accordingly, the Commission 
has submitted to the OMB an amended calculation of the annual burden 
hours for SDs and MSPs. OMB has approved a revision to Control Number 
3038-0055 to cover the revision in the Commission's annual burden 
calculation.

C. Regulatory Flexibility Act.

    The Regulatory Flexibility Act, 5 U.S.C. 601 et seq., requires that 
Federal agencies consider whether their proposed regulations will have 
a significant economic impact on a substantial number of small 
entities. The rule amendments adopted herein now will affect SDs and 
MSPs, in addition to the certain Commission regulated entities that are 
currently subject to Commission's regulations under part 160. These 
regulations require periodic notice to be provided to individuals who 
obtain financial products or services primarily for personal, family, 
or household purposes from the institutions, and may be satisfied by 
the use of a model notice developed by the Commission and other 
regulatory agencies to minimize the burden of compliance. The 
Commission certified in the Proposal that these rules will not have a 
significant economic impact on a substantial number of small entities. 
Accordingly, because the Commission received no substantive comments 
from the public addressing the merits of the proposed rule, nothing 
alters the Commission's determination that the obligations created by 
these rule amendments will not create a significant economic impact on 
a substantial number of small entities.

D. Regulatory Text.

List of Subjects in 17 CFR Part 160

    Brokers, Dealers, Consumer protection, Privacy, Reporting and 
recordkeeping requirements.

    For the reasons articulated in the preamble, the Commission amends 
part 160 of title 17 of the Code of Federal Regulations as follows:

0
1. The authority citation for part 160 is revised to read as follows:

    Authority:  7 U.S.C. 7b-2 and 12a(5); 15 U.S.C 6801, et seq., 
and sec. 1093, Pub. L. 111-203, 124 Stat. 1376.

0
2. The heading for part 160 is revised to read as follows:

PART 160--PRIVACY OF CONSUMER FINANCIAL INFORMATION UNDER TITLE V 
OF THE GRAMM-LEACH-BLILEY ACT

0
3. Amend section 160.1 by revising paragraph (b) to read as follows:


Sec.  160.1  Purpose and scope.

* * * * *
    (b) Scope. This part applies only to nonpublic personal information 
about individuals who obtain financial products or services primarily 
for personal, family, or household purposes from the institutions 
listed below. This part does not apply to information about companies 
or about individuals who obtain financial products or services 
primarily for business, commercial, or agricultural purposes. This part 
applies to all futures commission merchants, retail foreign exchange 
dealers, commodity trading advisors, commodity pool operators, 
introducing brokers, major swap participants and swap dealers that are 
subject to the jurisdiction of the Commission, regardless whether they 
are required to register with the Commission. These entities are 
hereinafter referred to in this part as ``you.'' This part does not 
apply to foreign (non-resident) futures commission merchants, retail 
foreign exchange dealers, commodity trading advisors, commodity pool 
operators, introducing brokers, major swap participants and swap 
dealers that are not registered with the Commission.

0
4. Amend Sec.  160.3 as follows:
0
a. Revise paragraphs (a), (n)(1)(i), (n)(1)(ii), and (o)(1)(i);
0
b. Redesignating paragraphs (w) and (x) as paragraphs (y) and (z);
0
c. Redesignating paragraphs (s) through (v) as paragraphs (t) through 
(w);
0
d. Adding new paragraphs (s) and (x);
0
e. Revising new designated paragraphs (y)(4) and (y)(5); and
0
f. Adding new paragraph (y)(6) and (7) to read as follows:


Sec.  160.3  Definitions.

* * * * *
    (a) Affiliate of a futures commission merchant, retail foreign 
exchange dealer, commodity trading advisor, commodity pool operator, 
introducing broker, major swap participant, or swap dealer means any 
company that controls, is controlled by, or is under common control 
with a futures commission merchant, retail foreign exchange dealer, 
commodity trading advisor, commodity pool operator, introducing broker, 
major swap participant, or swap dealer that is subject to the 
jurisdiction of the Commission. In addition, a futures commission 
merchant, retail foreign exchange dealer, commodity trading advisor, 
commodity pool operator, introducing broker, major swap participant, or 
swap dealer subject to the jurisdiction of the Commission will be 
deemed an affiliate of a company for purposes of this part if:
    (1) That company is regulated under title V of the GLB Act by the 
Bureau of Consumer Financial Protection or by a Federal functional 
regulator other than the Commission; and
    (2) Rules adopted by the Bureau of Consumer Financial Protection or 
another Federal functional regulator under title V of the GLB Act treat 
the futures commission merchant, retail foreign exchange dealer, 
commodity trading advisor, commodity pool operator, introducing broker, 
major swap participant, or swap dealer as an affiliate of that company.
* * * * *
    (n)(1) * * *
    (i) Any futures commission merchant, retail foreign exchange 
dealer, commodity trading advisor, commodity pool operator, introducing 
broker, major swap participant, or swap dealer that is registered with 
the Commission as such or is otherwise subject to the Commission's 
jurisdiction; and
* * * * *
    (2) * * *
    (i) Any person or entity, other than a futures commission merchant, 
retail foreign exchange dealer, commodity trading advisor, commodity 
pool operator, introducing broker, major swap participant, or swap 
dealer that, with respect to any financial activity, is subject to the 
jurisdiction of the Commission under the Act.
* * * * *
    (o)(1) * * *
    (i) Any product or service that a futures commission merchant, 
retail foreign exchange dealer, commodity trading advisor, commodity 
pool operator, introducing broker, major swap participant, or swap 
dealer could offer that is subject to the Commission's jurisdiction; 
and
* * * * *
    (s) Major swap participant. The term ``major swap participant'' has 
the same meaning as in section 1a(33) of the Commodity Exchange Act, 7 
U.S.C. 1 et seq., as may be further defined by this title, and includes 
any person registered as such thereunder.
* * * * *

[[Page 43879]]

    (x) Swap dealer. The term ``swap dealer'' has the same meaning as 
in section 1a(49) of the Commodity Exchange Act, 7 U.S.C. 1 et seq., as 
may be further defined by this title, and includes any person 
registered as such thereunder.
* * * * *
    (y) * * *
    (4) Any commodity pool operator;
    (5) Any introducing broker;
    (6) Any major swap participant; and
    (7) Any swap dealer.
* * * * *

0
5. Revise Sec.  160.15(a)(4) to read as follows:


Sec.  160.15  Other exceptions to notice and opt out requirements.

* * * * *
    (4) To the extent specifically permitted or required under other 
provisions of law and in accordance with the Right to Financial Privacy 
Act of 1978, 12 U.S.C. 3401 et seq., to law enforcement agencies 
(including a Federal functional regulator, the Secretary of the 
Treasury, with respect to 31 U.S.C. Chapter 53, Subchapter II (Records 
and Reports on Monetary Instruments and Transactions) and 12 U.S.C. 
Chapter 21 (Financial Recordkeeping), a State insurance authority, with 
respect to any person domiciled in that insurance authority's state 
that is engaged in providing insurance, and the Bureau of Consumer 
Financial Protection), self-regulatory organizations, or for an 
investigation on a matter related to public safety;
* * * * *

0
6. Amend Sec.  160.17 by revising paragraph (b) to read as follows:


Sec.  160.17  Relation to state laws.

* * * * *
    (b) Greater protection under state law. For purposes of this 
section, a state statute, regulation, order or interpretation is not 
inconsistent with the provisions of this part if the protection such 
statute, regulation, order or interpretation affords any person is 
greater than the protection provided under this part, as determined by 
the Bureau of Consumer Financial Protection, after consultation with 
the Commission, on its own motion or upon the petition of any 
interested party.

0
7. Revise Sec.  160.30 to read as follows:


Sec.  160.30  Procedures to safeguard customer records and information.

    Every futures commission merchant, retail foreign exchange dealer, 
commodity trading advisor, commodity pool operator, introducing broker, 
major swap participant, and swap dealer subject to the jurisdiction of 
the Commission must adopt policies and procedures that address 
administrative, technical and physical safeguards for the protection of 
customer records and information.

    Issued in Washington, DC on July 7, 2011 by the Commission.
David A. Stawick,
Secretary of the Commission.

Appendices to Privacy of Consumer Financial Information; Conforming 
Amendments Under Dodd-Frank Act--Commission Voting Summary and 
Statements of Commissioners

    Note:  The following appendices will not appear in the Code of 
Federal Regulations.

Appendix 1--Commission Voting Summary

    On this matter, Chairman Gensler and Commissioners Dunn, 
Sommers, O'Malia and Chilton voted in the affirmative; no 
Commissioner voted in the negative.

Appendix 2--Statement of Chairman Gary Gensler

    I support the final rulemaking to expand the scope of privacy 
protections for consumer financial information under the Gramm-
Leach-Bliley Act. The rulemaking expands the scope of the 
Commission's existing privacy protections afforded to consumers' 
information--under the Commission's Part 160 rules--to swap dealers 
and major swap participants.

[FR Doc. 2011-17710 Filed 7-21-11; 8:45 am]
BILLING CODE 6351-01-P