Regarding the Commissioner of the Department of Banking, Insurance, Securities and Health Care Administration's (BISHCA) authority to promulgate rules related to the privacy of consumer financial and health information. Further questions concern the relationship between the proposed rules and the privacy title of the federal Gramm-Leach-Bliley Financial Modernization Act ("GLB").

October 17, 2001 Senator Ann Cummings Chair Legislative Committee on Administrative Rules Statehouse Montpelier, Vermont Opinion No. 2001-3 Re: BISHCA Proposed Rules B-2001-01, IH-2001-O1, S-2001-01 Privacy of Consumer Financial and Health Information Dear Senator Cummings: At the October 3, 2001 meeting of the Legislative Committee on Administrative Rules, the Committee considered three final proposed rules from the Department of Banking, Insurance, Securities and Health Care Administration. The proposed rules relate to the privacy of consumer financial and health information, in the banking, insurance, and securities industries respectively. After hearing testimony on the proposed rules, the Committee asked the Attorney General to provide an opinion regarding the Commissioner's authority to promulgate the rules. See 3 V.S.A. § 842(b)(1) (committee may object to proposed rule if it is "beyond the authority of the agency"). The Committee also raised questions regarding the relationship between the proposed rules and the privacy title of the federal Gramm-Leach-Bliley Financial Modernization Act ("GLB"). This opinion letter will, first, set forth the Commissioner's general rulemaking authority; second, address the Commissioner's authority to promulgate each of the three proposed rules; and third, discuss the relationship between the proposed rules and GLB. As the following discussion makes clear, it is our opinion that the Commissioner possesses the statutory authority to promulgate these rules. L The Commissioner's General Rulemaking Authority By statute, the Commissioner is charged with supervising "the business of organizations that offer financial services and products." 8 V.S.A. § 10. The Legislature has provided the Commissioner with specific guidance for this task. She must, first, "assure the solvency, liquidity, stability, and efficiency of all such organizations, [and] assure reasonable and orderly competition, thereby encouraging the development, expansion and availability of financial services and products advantageous to the public welfare." Id. § 10(1). The Commissioner must also supervise financial services organizations "in such a way as to protect consumers against unfair and unconscionable practices and to provide consumer education." Id. § 10(2). The Legislature has granted the Commissioner extensive rulemaking authority to carry out her task. In addition to specific statutory grants of authority, the Commissioner has general authority to "adopt rules and issue orders as shall be authorized by or necessary to the administration of ... and to carry out the purposes of the banking and insurance laws. 8 V.S.A. § 15(a). The Vermont Supreme Court has approved this type of general rulemaking authority where the Legislature has provided a "basic standard" for the administrative agency to follow. See Rogers v. Watson, 156 Vt. 483, 493 (1991) (noting that statute giving Board of Health rulemaking authority in "all matters relating to the preservation of the public health" provided a sufficient standard to guide the agency's actions). Here, the standards provided by the Legislature (as quoted above) are similarly sufficient to guide the Commissioner's actions. The Vermont Supreme Court has provided some additional guidance for evaluating exercises of rulemaking by an administrative agency. Generally, "`an agency's regulations must be reasonably related to its enabling legislation in order to withstand judicial scrutiny."' Vermont Assn of Realtors, Inc. v. State, 156 Vt. 525, 530 (1991) (quoting In re Club 107, 152 Vt. 320, 323 (1989)). "There must be some nexus between the agency regulation, the activity it seeks to regulate, and the scope of the agency's grant of authority." Id. Again, the Legislature's directives in 8 V.S.A. § 10, together with other specific provisions of Title 8, provide a clear standard for evaluating whether there is a nexus between the proposed rules and the Commissioner's grant of authority. Thus, the proposed rules are an appropriate exercise of the Commissioner's general rulemaking authority if (1) they are "authorized by or necessary to" the administration of the banking and insurance statutes, or "carry out the purposes of those statutes and (2) there is a nexus between the proposed rules and the activities they regulate and the scope of the Commissioner's grant of authority. (Elements of the proposed rules may also be authorized by other, more specific statutory grants therefore provides a basis for promulgating regulations under the banking privacy law. In addition to falling within the Commissioner's statutory grant of authority, the proposed rule also meets the Vermont Supreme Court's "nexus" test. The rule furthers the legislative directive to protect the privacy of information held by banking institutions by requiring accurate notices to consumers, and by further elucidating the rules for disclosures of consumer information to third parties. The Commissioner is charged with supervising financial services organizations in a manner that provides for consumer protection and consumer education and is specifically charged with the enforcement of the banking privacy law. This is more than sufficient to establish a nexus between the proposed rule and the scope of the Commissioner's authority. Finally, there are several other bases for the Commissioner's authority which do not appear to be relevant to the Committee's concerns. Sections 2066 and 2214 of Title 8 repeat the Commissioner's general rulemaking authority with respect to credit unions and licensed lenders, respectively. In addition, the Commissioner added some exceptions to the general prohibition on disclosure of financial information as permitted by 8 V.S.A. § 10204(23). Proposed Rule I-H-2001-04 (Insurance Industry) This proposed rule extends to the insurance industry basically the same disclosure and "opt-in" requirements that the proposed banking rule imposes on financial institutions. For purposes of this opinion, the primary distinction is that Vermont's banking privacy law, 8 V.S.A. §§ 10201-10205; does not apply to insurers. Nonetheless, it is the opinion of the Attorney General that the Commissioner has authority under §§ 10 and 15 of Title 8 (as well as other specific grants of authority in Title 8) to promulgate this rule for the insurance industry. The proposed rule is necessary to and carries out the purposes of two of the Legislature's principal directives to the Commissioner: (1) to provide for consumer protection and education, and (2) to assure reasonable and orderly competition in the financial services market. 8 V.S.A. § 10. First, as discussed at greater length above and in the Commissioner's filings, the proposed rule protects consumer privacy and provides for consumers to be informed of their privacy rights. It does so in a way that is consistent with the Legislature's intent (for an opt-in system) in the banking privacy law. This type of consumer protection measure falls within the scope of the Commissioner's authority under § 10. Second, the proposed rule also serves the Commissioner's statutory goal of assuring reasonable and orderly competition in the financial services market. As a result of the changes wrought by the federal GLB, banks and insurers, as well as other financial services organizations, may now engage in direct competition. In the absence of the proposed rule, insurers in Vermont might gain an unfair advantage (at the expense of consumer privacy) over financial institutions that are covered by the banking privacy law. The Commissioner has the authority to promulgate this rule to assure, to the extent possible, a level playing field in Vermont. As with the proposed banking rule, the proposed insurance rule meets the Vermont Supreme Court's "nexus" test. The rule both protects consumer privacy and provides for "reasonable and orderly competition" among financial services organizations by applying the same requirements to banks and insurers. This provides the required nexus between the proposed rule and the scope of the Commissioner's authority. In addition to §§ 10 and 15 of Title 8, the Commissioner relies upon several other specific grants of rulemaking authority for different aspects of the proposed rule. Several of these sections merely repeat the Commissioner's general rulemaking authority with respect to certain segments of the insurance industry, such as HMOs and captive insurance companies, and do not require separate analysis. See 8 V.S.A. §§ 3688, 3858, 4113, 4464, 4481, 4812, 4902, 4990, 5111, 6015, 8014, 8053. The Attorney General agrees with the Commissioner that her authority to regulate and approve forms, and to formulate consumer disclosures, provides an additional basis for the portion of the proposed rule dealing with written disclosures to consumers. See 8 V.S.A. § 4902 (consumer disclosures), id. §§ 3541 et. seq., 3829, 4062, 4108, 4201, 4480, 4515a, 4587, 4690, ch. 129, 5104, and 8005 (approval of forms). Proposed Rule S-2001-01 (Securities Industry) This proposed rule extends the consumer privacy protections to the brokerdealers and investment advisers who are regulated by the Department. The Commissioner has authority to regulate certain aspects of the securities industry under the Securities Act, 9 V.S.A. § 4201 et seq. This chapter includes a grant of authority "to make general rules and regulations ... to carry this chapter into full force and effect." Id. § 4237. In addition, the Legislature's general directives to the Commissioner in 8 V.S.A. § 10 apply to her supervision of the securities industry, as broker-dealers and investment advisers are "financial services organizations." The proposed rule for the securities industry is an appropriate exercise of the Commissioner's authority for largely the same reasons that the proposed rule for the insurance industry is appropriate. Again, the proposed rule is necessary to and carries out the purposes of consumer protection and education, because it prohibits unauthorized disclosures of consumer information and requires that consumers be advised of their rights. The proposed rule also assures reasonable and orderly competition by establishing uniform rules for all regulated industries. And the proposed rule has the required nexus with the scope of the Commissioner's authority to regulate the securities industry. III. The Proposed Rules and Gramm-Leach-Bliley As the Committee raised some concerns about the relationship between the proposed rules and the Gramm-Leach-Bliley Act, this opinion will discuss several aspects of GLB. First, although Congress did not, and cannot, give the Commissioner state rulemaking authority, the passage of GLB inevitably affected the Commissioner's obligations under Vermont law. For example, by requiring certain disclosures that would be inconsistent with Vermont law, GLB required the Commissioner to take action to protect Vermont's privacy law with respect to banking institutions. Moreover, by changing the overall rules for competition among financial services organizations, GLB also prompted the Commissioner to promulgate uniform privacy rules for all the state-regulated industries, to assure reasonable and orderly competition in Vermont. Second, with respect to determining the Commissioner's rulemaking authority under Vermont law, it is irrelevant that the proposed rules provide more protection for consumer privacy than the minimum standards of GLB. GLB explicitly provides that state laws that provide more protection are not preempted by the federal law. Thus, the Commissioner had no obligation to promulgate rules following the "opt-out" standard of GLB. Indeed, to the extent that it has spoken on privacy issues, the Legislature has explicitly provided that Vermont consumers should have the greater protection of the "opt-in" standard. Third, the proposed rules do not violate the so-called "nondiscrimination" provisions of GLB § 104 (codified at 15 U.S.C. § 6701). GLB § 104 prohibits state laws that discriminate against banks in the regulation of sales of insurance and other non- insurance financial activities. Some commenters on the proposed banking rule suggested that the rule would discriminate against banks because it would not apply to every financial services provider. The Commissioner, however, is powerless to promulgate a rule that covers every financial services provider, because some providers are regulated only by federal law. To interpret § 104 to bar any state privacy regulation that does not cover all financial services providers would effectively eliminate states' ability (either by statute or rule) to protect consumer privacy. As noted above, the privacy title of GLB, in § 507 (codified at 15 U.S.C. § 6807), specifically preserves state laws and regulations that provide greater protection for consumer privacy than GLB. The Attorney General believes that the most reasonable interpretation of GLB is that the nondiscrimination provisions of § 104 do not apply to state privacy laws and regulations, because such laws and regulations do not regulate "financial activities" but information sharing practices. On the other hand, interpreting § 104 to eliminate states' ability to enact privacy regulations is not reasonable, because it is contrary to the explicit provisions of § 507. Conclusion After reviewing the proposed rules, the relevant statutes, and judicial precedent, it is the opinion of the Attorney General that the Commissioner has authority under Vermont law to promulgate these rules. Sincerely, Bridget C. Asay Assistant Attorney Approved: al lace Malley. Jr. eputy Attorney General