The following article is reprinted from Basis Points® , Vol. 2, Issue 2, Copyright © 2003, with the permission of CounselorLibrary.com, LLC. All Rights Reserved. Further reproduction is prohibited without permission.

The FTC has recently published new guidance on the obligations imposed on mortgage brokers under the new privacy rules.

Are mortgage brokers subject to the Privacy Rule? Yes. Mortgage brokers are financial institutions because brokering loans is a "financial activity" as defined in section 4(k)(4)(F) of the Bank Holding Company Act. Mortgage brokers are subject to the FTC's enforcement authority, its Privacy Rule, and its Safeguards Rule.

The Privacy Rule applies when an individual seeks your assistance in obtaining mortgage loans that are primarily for personal, family, or household purposes. Under the Privacy Rule, you establish a customer relationship when an individual enters into an agreement or understanding with you and you undertake to arrange or broker a residential mortgage loan for him or her. You also establish a customer relationship when an individual provides any personally identifiable financial information to you in an effort to obtain a residential mortgage loan through you. Personally identifiable financial information means any information:

• A consumer provides to you to obtain a financial product or service from you;
• About a consumer resulting from any transaction involving a financial product or service between you and a consumer; or
• You otherwise obtain information about a consumer in connection with providing a financial product or service to that consumer.

Personally identifiable financial information includes:

• Information a consumer provides to you on an application to obtain a loan, credit card, or other financial product or service;
• Account balance information, payment history, overdraft history, and credit or debit card purchase information;
• The fact that an individual is or has been one of your customers or has obtained a financial product or service from you;
• Any information about your consumer if it is disclosed in a manner that indicates that the individual is or has been your consumer;
• Any information that a consumer provides to you or that you or your agent otherwise obtain in connection with collecting on, or servicing, a credit account;
• Any information you collect through an Internet "cookie" (an information collecting device from a web server); and
• Information from a consumer report.

Personally identifiable financial information does not include:

• A list of names and addresses of customers of an entity that is not a financial institution; and
• Aggregate information or blind data that does not contain personal identifiers such as account numbers, names, or addresses.

Can I provide the Privacy Notice after I take an application? No. The Privacy Rule requires that you provide an initial privacy notice no later than when the customer relationship is established. A customer relationship is established as soon as an individual provides personally identifiable financial information to you in an effort to obtain a mortgage loan through you. As a result, you must deliver a privacy notice before or at the same time as the individual provides application information to you. You cannot wait until a day or two later.

What about online applications? May I deliver an initial privacy notice at the same time as individuals submit their application information online? Yes. The Privacy Rule requires that you provide an initial privacy notice no later than when the customer relationship is established. The customer relationship is established as soon as an individual submits application information to you. As a result, you must deliver the privacy notice not later than when the customer submits the information online.

You may deliver a notice to online applicants by posting your current privacy notice clearly and conspicuously on your website if you require each applicant to acknowledge its receipt not later than when he or she first submits the application information. You must also provide the notice in a format that permits your customer to retain it or obtain it later. One way of doing this is to make your current privacy notice available on your website for online applicants who agree to receive the notice at the website.

What if I take residential mortgage applications over the phone without meeting the applicant face-to-face. Under the Privacy Rule may I deliver an initial privacy notice after these individuals give me their personally identifiable financial information? Subsequent delivery is permitted under certain circumstances. The Privacy Rule permits you to deliver the notice within a reasonable time after you establish a customer relationship if:

• You would substantially delay the customer's transaction if you had to provide notice before or not later than when you establish the customer relationship would, and
• The customer agrees to receive the notice at a later time.

Note, however, that if you delay delivering your initial notice to a customer, you may not disclose that customer's nonpublic personal information to any nonaffiliated third party (except as permitted by the exceptions under §§ 313.14 and 313.15 of the Privacy Rule) before you provide the notices and a reasonable opportunity to opt out, in accordance with §§ 313.7 and 313.10 of the Privacy Rule.

Do I need to provide an annual privacy notice to an individual who has obtained a mortgage loan through me if we're no longer in communication? No. An individual who has obtained a loan through you becomes a former customer when you no longer provide any statements or notices to the customer concerning that relationship. (Likewise, a customer who ceases using your services without obtaining a loan through you becomes a former customer.) You are not required to provide an annual notice to a former customer. However, you may need to provide a revised privacy notice and opt out notice if you intend to disclose nonpublic personal information about a former customer other than as described in the initial privacy notice that you provided.

In order to obtain loans for my customers, I share nonpublic personal information with lenders and credit reporting agencies, and my privacy notice notifies my customers that I make disclosures as permitted by law. Am I required to allow my customers to opt out of this type of information sharing? No. The Privacy Rule allows you to disclose nonpublic personal information about your customers without providing them a reasonable opportunity to opt out under certain circumstances. These exceptions to the opt out requirement are described at §§ 313.13 through 313.15 of the Privacy Rule.

Pursuant to § 313.14, you do not need to allow your customers to opt out of disclosures that are necessary for processing or administering financial transactions that they have requested or authorized. This would include, for example, disclosures to a prospective lender where your customer has authorized you to look for a mortgage loan and the disclosure is necessary to broker the loan. Further, the exceptions under § 313.15 include disclosures of information to a consumer reporting agency that are made in accordance with the Fair Credit Reporting Act.

To view all other Basis Points Articles click here.