Joint Letter to the Uniform Law Commission on the Draft Uniform Personal Data Protection Act

National Conference of Commissioners on Uniform State Laws
111 N. Wabash Ave
Suite 1010
Chicago, IL 60602

Dear Commissioners:

The American Bankers Association and the undersigned state bankers associations, representing banks of all sizes, respectfully submit this comment letter for consideration by the Uniform Law Commission. We appreciate the opportunity to provide input on the draft Uniform Personal Data Protection Act as it goes for its final reading before the full Commission.

The American Bankers Association participated as Observers to the Uniform Personal Data Protection Act Committee throughout the drafting process, raising concerns with select provisions of the Act, namely how the Act interacts with federal (and recently passed state) statutes governing privacy. Throughout the drafting committee process, ABA and state bankers associations have submitted comment letters explicitly detailing the industry’s concern with various drafts of the Act. Ultimately the Act’s final draft contains several problematic provisions and therefore, we regretfully cannot support the Act in its current form should it be introduced in the states and urge its disapproval by the Commission.

Gramm-Leach-Bliley Act (GLBA) Exception

ABA members are strong proponents of protecting consumer data and privacy, and have been subject to extensive federal privacy and data protection laws and regulations, beginning in the early 1970s. The ABA continues to believe that in order to avoid a patchwork of inconsistent requirements, a federal privacy solution is warranted. In lieu of a federal consumer privacy law, a uniform state law endorsed by the ULC should be enactable and take into account the fact that Congress has enacted significant privacy legislation to address the handling of financial information by financial institutions.

Unlike virtually all other entities within the U.S. economy, banks are not simply subject to federal and state privacy laws, but are subject to routine monitoring and testing of financial institutions’ compliance with those laws. Examiners are even permanently placed on-site at offices of certain large financial institutions.

State privacy legislation has and should continue to recognize these existing federal frameworks crafted by Congress and the strong privacy and data security standards already in place for the financial sector under the GLBA and other financial privacy laws. Specifically, Virginia and Colorado recently passed privacy legislation that contains entity-level GLBA exemption. While we appreciate the Committee’s inclusion of an exception to the Act for information subject to Title V of the GLBA, limiting the exception only to information (as opposed to entities) creates both unnecessary compliance challenges and ignores the existing financial privacy regime that Congress created to provide an effective balance between strong consumer protections and ensuring that consumer financial transactions take place in a safe and secure environment.

ABA believes the Act’s information-level GLBA exception provided in Section 11 should likewise have been expanded to include entities subject to the GLBA.

Private Right of Action

Section 16 of the Act establishes that enforcement of the Act and any respective remedies are dependent on a state’s existing consumer protection law. While the draft itself does not explicitly establish a new private right of action, this provision essentially will enable a private right of action in those states whose consumer protection laws create such a right. This new right is contrary to the enforcement regime that has thus far been authorized in consumer privacy legislation. Continuing to pursue a private right of action in the Act will also undoubtedly lead to enactability issues.

Conclusion

Due to divergence of this Act from current state-passed consumer privacy laws as well as federal privacy regimes with respect to both the GLBA exception and private right of action, ABA urges Commissioners to reject the Act as currently drafted. We greatly appreciate the Commission’s consideration of our comments and look forward to continued participation in Commission projects in the future.

Sincerely,

American Bankers Association
Alabama Bankers Association
Alaska Bankers Association
Arizona Bankers Association
Arkansas Bankers Association
Colorado Bankers Association
Connecticut Bankers Association
Delaware Bankers Association
Florida Bankers Association
Georgia Bankers Association
Hawaii Bankers Association
Idaho Bankers Association
Illinois Bankers Association
Indiana Bankers Association
Iowa Bankers Association
Kansas Bankers Association
Kentucky Bankers Association
Louisiana Bankers Association
Maine Bankers Association
Maryland Bankers Association
Massachusetts Bankers Association
Michigan Bankers Association
Minnesota Bankers Association
Mississippi Bankers Association
Missouri Bankers Association
Montana Bankers Association
Nebraska Bankers Association
Nevada Bankers Association
New Hampshire Bankers Association
New Jersey Bankers Association
New Mexico Bankers Association
New York Bankers Association
North Carolina Bankers Association
North Dakota Bankers Association
Ohio Bankers League
Oklahoma Bankers Association
Oregon Bankers Association
Pennsylvania Bankers Association
Rhode Island Bankers Association
South Carolina Bankers Association
South Dakota Bankers Association
Tennessee Bankers Association
Texas Bankers Association
Utah Bankers Association
Vermont Bankers Association
Virginia Bankers Association
Washington Bankers Association
West Virginia Bankers Association
Wisconsin Bankers Association
Wyoming Bankers Association