Disposal of Consumer Report Information and Records, 52846-52848 [2017-24728]
Download as PDF
52846
Federal Register / Vol. 82, No. 219 / Wednesday, November 15, 2017 / Rules and Regulations
(5) You may view this service information
that is incorporated by reference at the
National Archives and Records
Administration (NARA). For information on
the availability of this material at NARA, call
202–741–6030, or go to: https://
www.archives.gov/federal-register/cfr/ibrlocations.html.
(j) Related Information
(1) Refer to Mandatory Continuing
Airworthiness Information (MCAI) Canadian
Airworthiness Directive CF–2017–01, dated
January 6, 2017, for related information for
related information. This MCAI may be
found in the AD docket on the Internet at
https://www.regulations.gov by searching for
and locating Docket No. FAA–2017–0528.
(2) For more information about this AD,
contact Assata Dessaline, Aerospace
Engineer, Avionics and Administrative
Services Section, FAA, New York ACO
Branch, 1600 Stewart Avenue, Suite 410,
Westbury, NY 11590; telephone: 516–228–
7301; fax: 516–794–5531.
(3) Service information identified in this
AD that is not incorporated by reference is
available at the addresses specified in
paragraphs (k)(3) and (k)(4) of this AD.
sradovich on DSK3GMQ082PROD with RULES
request to your principal inspector or local
Flight Standards District Office, as
appropriate. If sending information directly
to the manager of the certification office,
send it to ATTN: Program Manager,
Continuing Operational Safety, FAA, New
York ACO Branch, 1600 Stewart Avenue,
Suite 410, Westbury, NY 11590; telephone:
516–228–7300; fax: 516–794–5531. Before
using any approved AMOC, notify your
appropriate principal inspector, or lacking a
principal inspector, the manager of the local
flight standards district office/certificate
holding district office.
(2) Contacting the Manufacturer: For any
requirement in this AD to obtain corrective
actions from a manufacturer, the action must
be accomplished using a method approved
by the Manager, New York ACO Branch,
FAA; or Transport Canada Civil Aviation
(TCCA); or Bombardier Inc.’s TCCA Design
Approval Organization (DAO). If approved by
the DAO, the approval must include the
DAO-authorized signature.
Disposal of Consumer Report
Information and Records
(k) Material Incorporated by Reference
(1) The Director of the Federal Register
approved the incorporation by reference
(IBR) of the service information listed in this
paragraph under 5 U.S.C. 552(a) and 1 CFR
part 51.
(2) You must use this service information
as applicable to do the actions required by
this AD, unless this AD specifies otherwise.
(i) Bombardier Challenger 604 Airplane
Flight Manual (AFM), Publication No. CH
604 AFM, Revision 103, dated November 28,
2016.
(ii) Bombardier Challenger 605 AFM,
Publication No. CH 605 AFM, Revision 41,
dated November 28, 2016.
(iii) Bombardier Challenger 650 AFM,
Publication No. CH 650 AFM, Revision 6,
dated November 28, 2016.
(3) For service information identified in
ˆ
this AD, contact Bombardier, Inc., 400 Cote´
Vertu Road West, Dorval, Quebec H4S 1Y9,
Canada; telephone: 514–855–5000; fax: 514–
855–7401; email: thd.crj@
aero.bombardier.com; Internet: https://
www.bombardier.com.
(4) You may view this service information
at the FAA, Transport Standards Branch,
1601 Lind Avenue SW., Renton, WA. For
information on the availability of this
material at the FAA, call 425–227–1221.
VerDate Sep<11>2014
15:48 Nov 14, 2017
Jkt 244001
Issued in Renton, Washington, on October
20, 2017.
Dionne Palermo,
Acting Director, System Oversight Division,
Aircraft Certification Service.
[FR Doc. 2017–23996 Filed 11–14–17; 8:45 am]
BILLING CODE 4910–13–P
FEDERAL TRADE COMMISSION
16 CFR Part 314
[RIN 3084–AB41]
Federal Trade Commission.
Confirmation of rule.
AGENCY:
ACTION:
The Federal Trade
Commission has completed its
regulatory review of its rule regarding
Disposal of Consumer Report
Information and Records as part of the
Commission’s systematic review of all
current Commission rules and guides,
and has determined to retain the Rule in
its current form.
DATES: This action is effective on
November 15, 2017.
ADDRESSES: Relevant portions of the
proceeding, including this document,
are available at www.ftc.gov.
FOR FURTHER INFORMATION CONTACT:
Tiffany George, (202) 326–3040,
Attorney, Division of Privacy and
Identity Protection, Federal Trade
Commission, Washington, DC 20580.
SUPPLEMENTARY INFORMATION:
SUMMARY:
I. Introduction
In September 2016, the Federal Trade
Commission (‘‘FTC’’ or ‘‘Commission’’)
requested comments on its rule
regarding Disposal of Consumer Report
Information and Records (‘‘Disposal
Rule’’ or ‘‘Rule’’), as part of its
comprehensive regulatory review
program. Specifically, the Commission
sought comments on the Rule’s costs
and benefits, and on whether it should
modify the Rule to account for changes
in technology or information
destruction standards.
After considering the comments, the
Commission has determined to retain
the Rule without amendment. Most of
the commenters who addressed the
issue supported the Rule’s current
PO 00000
Frm 00024
Fmt 4700
Sfmt 4700
provisions. A few commenters
recommended expanding the Rule’s
provisions. Because the Commission has
not seen any evidence of problematic
acts or practices that any proposed
modification would address, it has
determined not to amend the Rule at
this time.
This document provides background,
analyzes the comments, and further
explains the Commission’s decision.
II. Background
The Fair and Accurate Credit
Transactions Act (‘‘FACTA’’ or ‘‘Act’’)
was enacted in 2003. In part, the Act
amended the Fair Credit Reporting Act
(‘‘FCRA’’) by requiring that any person
that maintains or otherwise possesses
consumer information, or any
compilation of consumer information,
derived from consumer reports for a
business purpose, properly dispose of
any such information or compilation.
The Act also required the Commission
and other federal agencies to promulgate
rules regarding the proper disposal of
consumer report information and
records.
Pursuant to the Act’s directive, the
Commission promulgated the Disposal
Rule in 2004, which became effective on
June 1, 2005.1 The Disposal Rule
requires that persons over which the
FTC has jurisdiction who maintain or
otherwise possess consumer
information for a business purpose
properly dispose of such information by
taking reasonable measures to protect
against unauthorized access to or use of
the information in connection with its
disposal. The Rule defines ‘‘consumer
information’’ as ‘‘any record about an
individual, whether in paper, electronic,
or other form, that is a consumer report
or is derived from a consumer report.
Consumer information also means a
compilation of such records. Consumer
information does not include
information that does not identify
individuals, such as aggregate
information or blind data.’’ 2
The Rule includes several examples of
what the Commission believes
constitute reasonable measures to
protect consumer information in
connection with its disposal, including
policies and procedures that require (1)
the burning, pulverizing, or shredding
of papers or (2) the destruction or
erasure of electronic media containing
consumer information so that the
information cannot practicably be read
or reconstructed. These examples are
intended to provide covered entities
with guidance on how to comply with
1 See
2 See
E:\FR\FM\15NOR1.SGM
69 FR 68690 (Nov. 24, 2004); 16 CFR 682.
16 CFR 682.1(b).
15NOR1
Federal Register / Vol. 82, No. 219 / Wednesday, November 15, 2017 / Rules and Regulations
the Rule, but are not intended to be safe
harbors or exclusive methods for
compliance. In promulgating the Rule,
the FTC noted that there are few
foolproof methods of record destruction
and that entities covered by the Rule
must consider their own unique
circumstances when determining how
to best comply with the Rule.
In September 2016, the Commission
published a Notice seeking comment on
the Rule as part of the Commission’s
ongoing comprehensive regulatory
review program.3 The Notice sought
comment on the Rule’s overall costs,
benefits, necessity, and regulatory and
economic impact. The Notice also asked
for comment on whether the
Commission should modify the Rule in
light of changes in technology and
industry standards and practices.
III. Regulatory Review Comments and
Analysis
sradovich on DSK3GMQ082PROD with RULES
The Commission received 11
comments in response to the Notice
during the comment period.4 Comments
were filed by individuals, trade
associations, and research organizations.
The Commission received comments
from such diverse organizations as the
National Automobile Dealers
Association (‘‘NADA’’), Data &
Marketing Association (‘‘DMA’’),
National Association for Information
Destruction (‘‘NAID’’), Consumer Data
Industry Association (‘‘CDIA’’),
Electronic Transactions Association
(‘‘ETA’’), and Electronic Privacy
Information Center (‘‘EPIC’’).
All of the commenters addressing the
issue supported the Rule overall.
Indeed, none of the commenters
advocated repealing the Rule or
narrowing its scope. For example,
NADA stated that ‘‘the Disposal Rule is
well-established and working effectively
and we do not believe it needs to be
changed or amended in any significant
way.’’ 5 In addition, ETA noted that ‘‘the
Disposal Rule as currently written
effectively promotes consumer
information security.’’ 6
Commenters differed on whether the
Commission should expand the Rule’s
3 Federal Trade Commission: Disposal of
Consumer Report Information: Request for
Comments, 81 FR 63435 (Sept. 15, 2016).
4 The comments are posted at: https://
www.ftc.gov/policy/public-comments/initiative-672.
The Commission has assigned each comment a
number appearing after the name of the commenter
and the date of submission. This notice cites
comments using the last name of the individual
submitter or the name of the organization, followed
by the number assigned by the Commission.
5 See National Automobile Dealers Association
(Comment #00013).
6 See Electronic Transactions Association
(Comment #00011).
VerDate Sep<11>2014
15:48 Nov 14, 2017
Jkt 244001
scope. Two organizations supported
expanding the Rule. For example, NAID
recommended that the Commission
‘‘add provisions and clarity to provide
direction (and enforcement) related to
. . . emerging issues’’ caused by
advances in technology, such as the
applicability of the Rule to third-party
hardware providers (e.g., digital copier
manufacturers who might retain a copy
of consumer information) or cloud
providers that may maintain consumer
information. NAID also recommended
expanding the definition of consumer
information ‘‘as broadly as possible’’
because most covered entities already
have considerably broad policies in
place.7 EPIC supported expanding the
definition of consumer information ‘‘to
include information that is linked or
linkable to an individual’’ because it
‘‘represents a more flexible, technology
neutral approach that is consistent with
the reality of modern business
practices.’’ 8
Most trade associations argued against
expansion of the Rule, asserting that
laws and guidance currently in place
sufficiently protect consumers. For
instance, CDIA stated ‘‘[t]here is no net
benefit in requiring consumer reporting
agencies to incur the additional costs
and burdens of applying the Disposal
Rule to aggregate information, blind
data, or otherwise de-identified data
when such a change would not address
any identified consumer harm or
provide consumers with additional
protection.’’ 9 DMA commented that
‘‘[e]xpanding the scope of the Disposal
Rule could unnecessarily risk stifling an
innovative sector that has created
enormous job opportunities and
provides consumers with robust
benefits.’’ 10
The Commission agrees with the
commenters who stated that the Rule
should continue as it is and that it is not
necessary to expand the Rule. No
commenter who supported expansion of
the Rule provided any evidence of
problematic acts or practices that
remain unaddressed with the scope of
the current Rule.
As to NAID’s comment requesting
clarity on emerging issues relating to
advances in technology including the
applicability of the Rule to third-party
service providers, the Commission notes
that the Rule already applies to ‘‘[a]ny
person who maintains or otherwise
7 See National Association for Information
Destruction (Comment #00009).
8 See Electronic Privacy Information Center
(Comment #00015).
9 See Consumer Data Industry Association
(Comment #00010).
10 See Data & Marketing Association (Comment
#00012).
PO 00000
Frm 00025
Fmt 4700
Sfmt 4700
52847
possesses consumer information for a
business purpose’’ and requires
‘‘reasonable measures to protect against
unauthorized access to or use of the
information in connection with its
disposal.’’ 11 Thus, the Commission
does not believe a Rule change is
needed to address this issue.
As to the commenters that were
concerned that the definition of
‘‘consumer information’’ is too limiting,
the Commission notes that the
definition—which excludes ‘‘aggregate
information’’ and ‘‘blind data’’—is not
limited to information that identifies a
consumer by name only. The Statement
of Basis and Purpose to the final Rule
noted that the terms ‘‘aggregate
information’’ and ‘‘blind data’’ are
intended to have the same meaning as
in the Commission’s Gramm-LeachBliley Act Rule regarding the Privacy of
Consumer Financial Information, 16
CFR part 313 (the ‘‘GLB Privacy Rule’’).
The GLB Privacy Rule in turn defines
aggregate information or blind data as
information ‘‘that does not contain
personal identifiers such as account
numbers, names, or addresses.’’ 12 In
addition, in the Statement of Basis and
Purpose for the Disposal Rule, the
Commission stated that there are ‘‘a
variety of personal identifiers beyond
simply a person’s name that would
bring information within the scope of
the Rule, including, but not limited to,
a social security number, driver’s
license number, phone number,
physical address, and email address.’’ 13
The Commission did not include a rigid
definition in the final Rule because it
noted that, depending upon the
circumstances, data elements that are
not inherently identifying can, in
combination, identify particular
individuals.14
Thus, the rulemaking record makes
clear that the definition of ‘‘consumer
information’’ is not unduly limited. It
may include other information that can
be used to identify an individual. The
Commission does not believe it is
necessary to amend the Rule on this
point.
In light of the comments received, the
Commission concludes that a
continuing need exists for the Rule and
that costs imposed on businesses are
reasonable. The Commission has
determined to retain the Rule without
amendment at this time. The
Commission will continue to monitor
changes in technology and industry
11 See
16 CFR 682.3(a).
69 FR at 68692; 16 CFR 313.3(o)(2)(ii).
13 69 FR at 68692.
14 Id.
12 See
E:\FR\FM\15NOR1.SGM
15NOR1
52848
Federal Register / Vol. 82, No. 219 / Wednesday, November 15, 2017 / Rules and Regulations
standards and practices to determine if
it should take action in the future.
Paragraph 1. The authority citation
for part 1 continues to read in part as
follows:
■
By direction of the Commission.
Donald S. Clark,
Secretary.
Authority: 26 U.S.C. 7805 * * *
[FR Doc. 2017–24728 Filed 11–14–17; 8:45 am]
Par. 2. Section 1.367(a)–1 is amended
by adding paragraph (e) to read as
follows:
■
BILLING CODE 6750–01–P
§ 1.367(a)–1 Transfers to foreign
corporations subject to section 367(a): In
general.
DEPARTMENT OF THE TREASURY
Internal Revenue Service
*
26 CFR Part 1
[TD 9803]
RIN 1545–BL87
Treatment of Certain Transfers of
Property to Foreign Corporations;
Correction
Internal Revenue Service (IRS),
Treasury.
ACTION: Correcting amendment.
AGENCY:
This document contains
corrections to final regulations (TD
9803) that were published in the
Federal Register on Friday, December
16, 2016. The final regulations are
related to certain transfers of property
by United States persons to foreign
corporations.
SUMMARY:
This correction is effective on
November 15, 2017 and is applicable on
or after December 16, 2016.
FOR FURTHER INFORMATION CONTACT:
Lynlee Baker at (202) 317–6937 (not a
toll-free number).
SUPPLEMENTARY INFORMATION:
DATES:
Background
The final regulations (TD 9803) that
are the subject of this correction are
issued under section 367 of the Internal
Revenue Code.
Need for Correction
sradovich on DSK3GMQ082PROD with RULES
List of Subjects in 26 CFR Part 1
Income taxes, Reporting and
recordkeeping requirements.
Correction of Publication
Accordingly, 26 CFR part 1 is
corrected by making the following
correcting amendment:
15:48 Nov 14, 2017
*
*
*
*
(e) Close of taxable year in certain
section 368(a)(1)(F) reorganizations. If a
domestic corporation is the transferor
corporation in a reorganization
described in section 368(a)(1)(F) after
March 30, 1987, in which the acquiring
corporation is a foreign corporation,
then the taxable year of the transferor
corporation shall end with the close of
the date of the transfer and the taxable
year of the acquiring corporation shall
end with the close of the date on which
the transferor’s taxable year would have
ended but for the occurrence of the
transfer. With regard to the
consequences of the closing of the
taxable year, see section 381 and the
regulations thereunder.
*
*
*
*
*
Martin V. Franks,
Chief, Publications and Regulations Branch,
Legal Processing Division, Associate Chief
Counsel (Procedure and Administration).
[FR Doc. 2017–24687 Filed 11–14–17; 8:45 am]
BILLING CODE 4830–01–P
PENSION BENEFIT GUARANTY
CORPORATION
29 CFR Part 4022
Benefits Payable in Terminated SingleEmployer Plans; Interest Assumptions
for Paying Benefits
Pension Benefit Guaranty
Corporation.
ACTION: Final rule.
AGENCY:
As published, the final regulations
published in the Federal Register on
Friday, December 16, 2016 (81 FR
91012) (TD 9803) contain an error that
needs to be corrected. Specifically,
paragraph (e) was inadvertently omitted
from the final regulations.
VerDate Sep<11>2014
FOR FURTHER INFORMATION CONTACT:
PART 1—INCOME TAXES
Jkt 244001
This final rule amends the
Pension Benefit Guaranty Corporation’s
regulation on Benefits Payable in
Terminated Single-Employer Plans to
prescribe interest assumptions under
the regulation for valuation dates in
December 2017. The interest
assumptions are used for paying
benefits under terminating singleemployer plans covered by the pension
insurance system administered by
PBGC.
SUMMARY:
DATES:
PO 00000
Effective December 1, 2017.
Frm 00026
Fmt 4700
Sfmt 4700
Daniel S. Liebman (liebman.daniel@
pbgc.gov), Acting Assistant General
Counsel for Regulatory Affairs, Pension
Benefit Guaranty Corporation, 1200 K
Street NW., Washington, DC 20005,
202–326–4400 ext. 6510. (TTY/TDD
users may call the Federal relay service
toll-free at 1–800–877–8339 and ask to
be connected to 202–326–4400, ext.
6510.)
PBGC’s
regulation on Benefits Payable in
Terminated Single-Employer Plans (29
CFR part 4022) prescribes actuarial
assumptions—including interest
assumptions—for paying plan benefits
under terminated single-employer plans
covered by title IV of the Employee
Retirement Income Security Act of 1974.
The interest assumptions in the
regulation are also published on PBGC’s
Web site (https://www.pbgc.gov).
PBGC uses the interest assumptions in
appendix B to part 4022 to determine
whether a benefit is payable as a lump
sum and to determine the amount to
pay. Appendix C to part 4022 contains
interest assumptions for private-sector
pension practitioners to refer to if they
wish to use lump-sum interest rates
determined using PBGC’s historical
methodology. Currently, the rates in
appendices B and C of the benefit
payment regulation are the same.
The interest assumptions are intended
to reflect current conditions in the
financial and annuity markets.
Assumptions under the benefit
payments regulation are updated
monthly. This final rule updates the
benefit payments interest assumptions
for December 2017.1
The December 2017 interest
assumptions under the benefit payments
regulation will be 0.75 percent for the
period during which a benefit is in pay
status and 4.00 percent during any years
preceding the benefit’s placement in pay
status. In comparison with the interest
assumptions in effect for November
2017, these assumptions are unchanged.
PBGC has determined that notice and
public comment on this amendment are
impracticable and contrary to the public
interest. This finding is based on the
need to determine and issue new
interest assumptions promptly so that
the assumptions can reflect current
market conditions as accurately as
possible.
SUPPLEMENTARY INFORMATION:
1 Appendix B to PBGC’s regulation on Allocation
of Assets in Single-Employer Plans (29 CFR part
4044) prescribes interest assumptions for valuing
benefits under terminating covered single-employer
plans for purposes of allocation of assets under
ERISA section 4044. Those assumptions are
updated quarterly.
E:\FR\FM\15NOR1.SGM
15NOR1
Agencies
[Federal Register Volume 82, Number 219 (Wednesday, November 15, 2017)]
[Rules and Regulations]
[Pages 52846-52848]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2017-24728]
=======================================================================
-----------------------------------------------------------------------
FEDERAL TRADE COMMISSION
16 CFR Part 314
[RIN 3084-AB41]
Disposal of Consumer Report Information and Records
AGENCY: Federal Trade Commission.
ACTION: Confirmation of rule.
-----------------------------------------------------------------------
SUMMARY: The Federal Trade Commission has completed its regulatory
review of its rule regarding Disposal of Consumer Report Information
and Records as part of the Commission's systematic review of all
current Commission rules and guides, and has determined to retain the
Rule in its current form.
DATES: This action is effective on November 15, 2017.
ADDRESSES: Relevant portions of the proceeding, including this
document, are available at www.ftc.gov.
FOR FURTHER INFORMATION CONTACT: Tiffany George, (202) 326-3040,
Attorney, Division of Privacy and Identity Protection, Federal Trade
Commission, Washington, DC 20580.
SUPPLEMENTARY INFORMATION:
I. Introduction
In September 2016, the Federal Trade Commission (``FTC'' or
``Commission'') requested comments on its rule regarding Disposal of
Consumer Report Information and Records (``Disposal Rule'' or
``Rule''), as part of its comprehensive regulatory review program.
Specifically, the Commission sought comments on the Rule's costs and
benefits, and on whether it should modify the Rule to account for
changes in technology or information destruction standards.
After considering the comments, the Commission has determined to
retain the Rule without amendment. Most of the commenters who addressed
the issue supported the Rule's current provisions. A few commenters
recommended expanding the Rule's provisions. Because the Commission has
not seen any evidence of problematic acts or practices that any
proposed modification would address, it has determined not to amend the
Rule at this time.
This document provides background, analyzes the comments, and
further explains the Commission's decision.
II. Background
The Fair and Accurate Credit Transactions Act (``FACTA'' or
``Act'') was enacted in 2003. In part, the Act amended the Fair Credit
Reporting Act (``FCRA'') by requiring that any person that maintains or
otherwise possesses consumer information, or any compilation of
consumer information, derived from consumer reports for a business
purpose, properly dispose of any such information or compilation. The
Act also required the Commission and other federal agencies to
promulgate rules regarding the proper disposal of consumer report
information and records.
Pursuant to the Act's directive, the Commission promulgated the
Disposal Rule in 2004, which became effective on June 1, 2005.\1\ The
Disposal Rule requires that persons over which the FTC has jurisdiction
who maintain or otherwise possess consumer information for a business
purpose properly dispose of such information by taking reasonable
measures to protect against unauthorized access to or use of the
information in connection with its disposal. The Rule defines
``consumer information'' as ``any record about an individual, whether
in paper, electronic, or other form, that is a consumer report or is
derived from a consumer report. Consumer information also means a
compilation of such records. Consumer information does not include
information that does not identify individuals, such as aggregate
information or blind data.'' \2\
---------------------------------------------------------------------------
\1\ See 69 FR 68690 (Nov. 24, 2004); 16 CFR 682.
\2\ See 16 CFR 682.1(b).
---------------------------------------------------------------------------
The Rule includes several examples of what the Commission believes
constitute reasonable measures to protect consumer information in
connection with its disposal, including policies and procedures that
require (1) the burning, pulverizing, or shredding of papers or (2) the
destruction or erasure of electronic media containing consumer
information so that the information cannot practicably be read or
reconstructed. These examples are intended to provide covered entities
with guidance on how to comply with
[[Page 52847]]
the Rule, but are not intended to be safe harbors or exclusive methods
for compliance. In promulgating the Rule, the FTC noted that there are
few foolproof methods of record destruction and that entities covered
by the Rule must consider their own unique circumstances when
determining how to best comply with the Rule.
In September 2016, the Commission published a Notice seeking
comment on the Rule as part of the Commission's ongoing comprehensive
regulatory review program.\3\ The Notice sought comment on the Rule's
overall costs, benefits, necessity, and regulatory and economic impact.
The Notice also asked for comment on whether the Commission should
modify the Rule in light of changes in technology and industry
standards and practices.
---------------------------------------------------------------------------
\3\ Federal Trade Commission: Disposal of Consumer Report
Information: Request for Comments, 81 FR 63435 (Sept. 15, 2016).
---------------------------------------------------------------------------
III. Regulatory Review Comments and Analysis
The Commission received 11 comments in response to the Notice
during the comment period.\4\ Comments were filed by individuals, trade
associations, and research organizations. The Commission received
comments from such diverse organizations as the National Automobile
Dealers Association (``NADA''), Data & Marketing Association (``DMA''),
National Association for Information Destruction (``NAID''), Consumer
Data Industry Association (``CDIA''), Electronic Transactions
Association (``ETA''), and Electronic Privacy Information Center
(``EPIC'').
---------------------------------------------------------------------------
\4\ The comments are posted at: https://www.ftc.gov/policy/public-comments/initiative-672. The Commission has assigned each
comment a number appearing after the name of the commenter and the
date of submission. This notice cites comments using the last name
of the individual submitter or the name of the organization,
followed by the number assigned by the Commission.
---------------------------------------------------------------------------
All of the commenters addressing the issue supported the Rule
overall. Indeed, none of the commenters advocated repealing the Rule or
narrowing its scope. For example, NADA stated that ``the Disposal Rule
is well-established and working effectively and we do not believe it
needs to be changed or amended in any significant way.'' \5\ In
addition, ETA noted that ``the Disposal Rule as currently written
effectively promotes consumer information security.'' \6\
---------------------------------------------------------------------------
\5\ See National Automobile Dealers Association (Comment
#00013).
\6\ See Electronic Transactions Association (Comment #00011).
---------------------------------------------------------------------------
Commenters differed on whether the Commission should expand the
Rule's scope. Two organizations supported expanding the Rule. For
example, NAID recommended that the Commission ``add provisions and
clarity to provide direction (and enforcement) related to . . .
emerging issues'' caused by advances in technology, such as the
applicability of the Rule to third-party hardware providers (e.g.,
digital copier manufacturers who might retain a copy of consumer
information) or cloud providers that may maintain consumer information.
NAID also recommended expanding the definition of consumer information
``as broadly as possible'' because most covered entities already have
considerably broad policies in place.\7\ EPIC supported expanding the
definition of consumer information ``to include information that is
linked or linkable to an individual'' because it ``represents a more
flexible, technology neutral approach that is consistent with the
reality of modern business practices.'' \8\
---------------------------------------------------------------------------
\7\ See National Association for Information Destruction
(Comment #00009).
\8\ See Electronic Privacy Information Center (Comment #00015).
---------------------------------------------------------------------------
Most trade associations argued against expansion of the Rule,
asserting that laws and guidance currently in place sufficiently
protect consumers. For instance, CDIA stated ``[t]here is no net
benefit in requiring consumer reporting agencies to incur the
additional costs and burdens of applying the Disposal Rule to aggregate
information, blind data, or otherwise de-identified data when such a
change would not address any identified consumer harm or provide
consumers with additional protection.'' \9\ DMA commented that
``[e]xpanding the scope of the Disposal Rule could unnecessarily risk
stifling an innovative sector that has created enormous job
opportunities and provides consumers with robust benefits.'' \10\
---------------------------------------------------------------------------
\9\ See Consumer Data Industry Association (Comment #00010).
\10\ See Data & Marketing Association (Comment #00012).
---------------------------------------------------------------------------
The Commission agrees with the commenters who stated that the Rule
should continue as it is and that it is not necessary to expand the
Rule. No commenter who supported expansion of the Rule provided any
evidence of problematic acts or practices that remain unaddressed with
the scope of the current Rule.
As to NAID's comment requesting clarity on emerging issues relating
to advances in technology including the applicability of the Rule to
third-party service providers, the Commission notes that the Rule
already applies to ``[a]ny person who maintains or otherwise possesses
consumer information for a business purpose'' and requires ``reasonable
measures to protect against unauthorized access to or use of the
information in connection with its disposal.'' \11\ Thus, the
Commission does not believe a Rule change is needed to address this
issue.
---------------------------------------------------------------------------
\11\ See 16 CFR 682.3(a).
---------------------------------------------------------------------------
As to the commenters that were concerned that the definition of
``consumer information'' is too limiting, the Commission notes that the
definition--which excludes ``aggregate information'' and ``blind
data''--is not limited to information that identifies a consumer by
name only. The Statement of Basis and Purpose to the final Rule noted
that the terms ``aggregate information'' and ``blind data'' are
intended to have the same meaning as in the Commission's Gramm-Leach-
Bliley Act Rule regarding the Privacy of Consumer Financial
Information, 16 CFR part 313 (the ``GLB Privacy Rule''). The GLB
Privacy Rule in turn defines aggregate information or blind data as
information ``that does not contain personal identifiers such as
account numbers, names, or addresses.'' \12\ In addition, in the
Statement of Basis and Purpose for the Disposal Rule, the Commission
stated that there are ``a variety of personal identifiers beyond simply
a person's name that would bring information within the scope of the
Rule, including, but not limited to, a social security number, driver's
license number, phone number, physical address, and email address.''
\13\ The Commission did not include a rigid definition in the final
Rule because it noted that, depending upon the circumstances, data
elements that are not inherently identifying can, in combination,
identify particular individuals.\14\
---------------------------------------------------------------------------
\12\ See 69 FR at 68692; 16 CFR 313.3(o)(2)(ii).
\13\ 69 FR at 68692.
\14\ Id.
---------------------------------------------------------------------------
Thus, the rulemaking record makes clear that the definition of
``consumer information'' is not unduly limited. It may include other
information that can be used to identify an individual. The Commission
does not believe it is necessary to amend the Rule on this point.
In light of the comments received, the Commission concludes that a
continuing need exists for the Rule and that costs imposed on
businesses are reasonable. The Commission has determined to retain the
Rule without amendment at this time. The Commission will continue to
monitor changes in technology and industry
[[Page 52848]]
standards and practices to determine if it should take action in the
future.
By direction of the Commission.
Donald S. Clark,
Secretary.
[FR Doc. 2017-24728 Filed 11-14-17; 8:45 am]
BILLING CODE 6750-01-P