NYSBA Sues FTC Over Privacy Notice Issue

NYSBA Sues FTC Over Privacy Notice Issue
Disclosure Requirements Still Apply to CPAs

By Dennis O’Leary , Legislative Counselslative Counsel

The New York State Bar Association (NYSBA) has filed a lawsuit against the Federal Trade Commission (FTC) claiming that Congress never intended a 1999 law regarding client privacy notices to govern lawyer-client relationships.

The law, the Gramm-Leach-Bliley Act of 1999 (G-L-B), requires financial institutions (broadly defined) to provide annual disclosures of privacy protection policies to non-business, individual clients to whom financial services such as tax return preparation, tax advice and financial planning are provided. The law also requires financial institutions to give an initial privacy notice no later than the acceptance of the client relationship.

According to the FTC website, the G-L-B privacy notices requirement covers financial, investment or economic advisory services by credit counselors, financial planners, tax preparers, accountants and investment advisors, as well as debt collecting, real estate settlement services, brokering loans and servicing loans.

Although the FTC asserts that the law should also apply to attorneys, it has agreed to forego taking action against noncompliant lawyers for the time being as the NYSBA case gets decided in court. Other professionals, notably CPAs, have had to provide both annual and initial client privacy notices for covered services since G-L-B went into effect in July 2001.

Making Exceptions

According to State Bar News, the newspaper of the NYSBA, the FTC and the Department of Justice agreed, pending a court decision, not to take action against lawyers who do not take steps to notify clients of their privacy and information-sharing policies as mandated under the G-L-B Act.

The article stated that prior to this agreement the FTC asserted that the “G-L-B Act should require lawyers, as well as financial institutions, to provide, among other things, ‘a clear disclosure to all their clients concerning their privacy policies…’”

The American Institute of CPAs had hoped the FTC would exempt CPAs from the law altogether.

In 2002, the AICPA reported on its website that “The Institute had hoped that the FTC would exempt CPAs (from G-L-B Act privacy notices), since the profession’s Code of Professional Conduct has stricter requirements and stronger sanctions to protect client confidentiality than does the act. However, the FTC determined it lacked authority to do so, given the act’s broad consumer-protection language. Although the AICPA intends to seek a legislative exemption for CPAs, members should plan on sending the disclosure notice to clients during calendar 2002.”

No legislative exemption has been passed by Congress to date, so CPAs who provide the covered services must give the annual notice to clients, and new clients must be given the initial privacy notice. Practitioners are enclosing a prominent privacy notice in their annual tax organizer or other client communication, and an initial privacy notice to a new client is provided with the engagement letter.

The NYSBA maintains that in the United States, only states have the ability to license lawyers, and there is no federal agency that does so. This same argument can be made by the CPA profession.

CPAs do not have privileged communications with their clients. However, Regents Rule 29.10 (c), “Special Provisions for the Practice of Public Accountancy,” states that “Unprofessional conduct shall also include revealing of personally identifiable facts, data, or information obtained in a professional capacity without the prior consent of the client, except such information may be disclosed as necessary to other licensees of the profession conducting professional standards or ethics reviews, or as otherwise authorized or required by law.”

This rule governing the CPA profession in New York state is more protective of a client’s personal information than the G-L-B Act provision for the affirmative “opt-out” for clients to preclude disclosure of nonpublic personal information.

NYSSCPA Executive Director Lou Grumet maintains that the Bar’s lawsuit against the FTC on the privacy notices might have some precedent value to the CPA profession, which has higher client privacy standards than the G-L-B Act.

“It behooves us to monitor the New York Bar’s litigation very closely,” Grumet said.

A model privacy notice in compliance with the G-L-B Act is provided on the Society’s website at www.nysscpa.org/prof%5Flibrary/privacy/ftcc%2Dprivacyrule.htm.

The FTC also provides a guide for small businesses titled “How to Comply with the Privacy of Consumer Financial Information Rule of the Gramm-Leach-Bliley Act” at www.ftc.gov/bcp/conline/pubs/buspubs/glblong.htm.