CALIFORNIA SB1 LITIGATION UPDATE
The U.S. Court of Appeals for the Ninth Circuit heard oral arguments on December 6, 2004 in American Bankers Association v. Lockyer, No. 04-16334 (9th Cir. appeal filed July 1, 2004). The case involves the appeal by the American Bankers Association, the Financial Services Roundtable and the Consumer Bankers Association of the decision of the U.S. District Court for the Eastern District of California that the California Financial Information Privacy Act, Cal. Fin. Code §§ 4050 et seq., (commonly known as “SB1”) is not preempted by the federal Fair Credit Reporting Act (“FCRA”). The Ninth Circuit panel for the appeal consisted of Judges Alex Kozinski, William A. Fletcher and Jay S. Bybee.
Enacted in August 2003, SB1 applies to “financial institutions,” defined to include any institution (i) the business of which is engaging in financial activities as described in Section 1843(k) of Title 12 of the United States Code and (ii) doing business in California. Cal. Fin. Code § 4052(c). The first part of this definition is identical to the definition of “financial institution” in the federal Gramm-Leach-Bliley Act (“GLBA”). See 15 U.S.C. § 6809(3)(A).
The stated intent of SB1 is to provide greater privacy protections than the GLBA by, among other things, (i) requiring that DLT ALERT 31810 © 2004 Dreher Tomkies LLP Page 2 of 2 December 8, 2004 financial institutions that want to share nonpublic personal information with third parties and unrelated companies seek and acquire the affirmative consent of California consumers prior to sharing the information and (ii) providing consumers with the ability to prevent the sharing of financial information among affiliated companies through a simple opt-out mechanism via a clear and understandable notice provided to the consumer. See Cal. Fin. Code §§ 4051(b), 4051.5(b)(2), (3).
In short, the California law requires “opt in” for sharing with nonaffiliates (whereas the GLBA requires “opt out” for sharing with nonaffiliates) and “opt out” for sharing with affiliates (whereas the GLBA does not restrict sharing with affiliates (although the FCRA provides for an “opt out”)). See id. §§ 4052.5, 4053(b).