This memorandum outlines certain changes to the Federal privacy regulations for investment advisers under Regulation S-P that have now taken final effect, including the new model privacy notice (the “Model Form”) and related safe harbor adopted by the Securities and Exchange Commission (“SEC”). Investment advisers should review the Model Form and their existing notices under Regulation S-P to determine if they will need to make changes to their policies and procedures for compliance with Regulation S-P.
Background
The SEC adopted Regulation S-P in June 2000 pursuant to the Gramm-Leachy-Bliley Act privacy directives. Regulation S-P requires registered investment advisers, among other securities firms, to provide notice to their customers about their privacy policies, and to refrain from disclosing nonpublic personal information about their customers to nonaffiliated third parties unless they first comply with certain conditions. These conditions include providing customers with the opportunity to “opt-out” from certain information disclosures by the adviser. Regulation S-P applies to all registered advisers. Advisers that are not subject to SEC registration are subject to comparable requirements under privacy rules issued by the Federal Trade Commission, which has also adopted a model privacy notice and related safe harbor that are essentially the same as those adopted by the SEC.
The Model Form replaces the “sample clauses” previously contained in Regulation S-P, and which many advisers have used to create their existing privacy notices. While the revised Regulation S-P does not mandate that advisers use the Model Form, it does provide a safe harbor that advisers using the Model Form can rely on to meet their disclosure obligations under Regulation S-P. Under the safe harbor, advisers that accurately complete and provide the Model Form to their clients in accordance with Regulation S-P will be deemed to have satisfied their Regulation S-P notice obligations.
Overview of the Model Form
The Model Form has two main pages and several distinct sections that seek to capture each firm’s privacy policies in a standardized format.
Page one of the Model Form sets forth the required information regarding the adviser’s privacy practices and has five parts: (i) a required title; (ii) an introductory section called the “Key Frame” that provides background information designed to help customers understand the required disclosures; (iii) a “Disclosure Table” that describes the adviser’s sharing activities; (iv) instructions regarding how customers can “opt-out” of certain sharing practices (if applicable); and (v) the adviser’s customer service contact information.
Page two of the Model Form provides additional explanatory information including a set of frequently asked questions (“FAQs”) and definitions. Page two may also include an optional other information section. The FAQs address: who is providing the notice (i.e., which entity or entities the notice covers); the protective measures used by the adviser to protect client information; how the adviser collects personal information; and what rights the customer has and does not have to limit information sharing. The definitions section requires advisers that share personal information with certain other companies (i.e., affiliates, nonaffiliates or joint marketers) to generally identify those companies. The other information section may be used only to include (i) information about state and/or international privacy law requirements, if applicable; and/or (ii) an acknowledgment of receipt form.
Use of the Model Form Versus Existing Privacy Notices
The instructions to the Model Form strictly limit the content and format of the information that may be included in an adviser’s privacy notice under the Model Form, and advisers seeking to benefit from the safe harbor must strictly adhere to these requirements. As a result, the Model Form provides little opportunity for advisers to tailor the disclosure to their actual practices or to further explain their responses. For these reasons, not all advisers will find that the Model Form fits their business practices and, as noted above, advisers are not required to use the Model Form. However, advisers not electing to use the Model Form must ensure that their notices meet the substantive requirements set forth in Regulation S-P. In this regard, we recommend that advisers who choose not to adopt the Model Form nonetheless review and consider revising their existing privacy notices to incorporate certain features of the Model Form and to address certain deficiencies in current practices that regulators identified in adopting the Model Form.
* * * * * * *
The SEC has provided an online form builder designed to assist advisers in creating their own privacy notices using the Model Form. The online form builder includes several different versions of the Model Form template (e.g., versions that provide an “opt-out” option and versions that do not etc.) When using these templates, advisers will need to closely review the detailed instructions for the Model Form and their firm’s specific privacy practices in order to select the appropriate template and accurately complete the required information.
If you have any questions or need more information, please contact an attorney in our Investment Management Group.
