July 10, 2001

Honorable Timothy J. Muris
Chairman
Federal Trade Commission
600 Pennsylvania Avenue, N.W.
Washington, D.C. 20580

Dear Chairman Muris:

On behalf of the American Bar Association and its more than 400,000 members, I request that lawyers and law firms engaged in the practice of law be exempt from the privacy provisions of the Gramm-Leach-Bliley Act of 1999 (the "Act" or "Gramm-Leach-Bliley"). ¹ The American Bar Association (the "ABA") strongly believes that such an exemption is appropriate for a number of reasons:

• Congress did not intend to regulate the legal profession through Gramm-Leach-Bliley.
• Legal services are intrinsically different from financial services and activities and, as a result, lawyers and law firms should not be considered financial institutions covered by the Act.
• The existing rules of professional responsibility that govern attorney conduct in each of the fifty states and the District of Columbia apply stringent enforceable confidentiality requirements to attorneys.
• Attorney confidentiality requirements provide a higher degree of protection for consumers of legal services than the Act's privacy provisions, which makes the Act's privacy provisions redundant when applied to lawyers.
• Attorney confidentiality requirements have been designed specifically to foster and protect the attorney-client relationship, while the Act's privacy provisions are ill suited to address the unique nature of that relationship.
• If lawyers and law firms are required to send privacy policy notices to their clients, clients will be confused and the public's confidentiality expectations with respect to lawyers may be diluted.
• Applying the Act's privacy provisions to lawyers infringes and may conflict with upon longstanding state regulation of attorney conduct and the attorney-client relationship.
• Compliance with the Act's privacy policy notice rules imposes an undue administrative burden on small law firms and individual practitioners.

While the ABA supports consumer protection, application of Gramm-Leach-Bliley to attorneys will not enhance privacy protection for consumers of legal services. Accordingly, we urge the Federal Trade Commission (the "Commission") to exempt lawyers and law firms engaged primarily in the practice of law from the application of the Act's privacy provisions by the issuance of an informal staff opinion followed by an amendment to the Commission's existing regulations under the Act.

In November 1999, Congress enacted Gramm-Leach-Bliley, which, for the first time since the Great Depression, allows financial institutions to engage in banking, insurance, and securities businesses simultaneously. In taking this step, Congress also sought to regulate the use and sale of consumers' personal information for marketing, profiling, and other commercial purposes by banks and financial institutions. As a result, Title V of the Act ² limits a financial institution's disclosure or other use of consumer information and requires a financial institution to send notices to its customers who are individuals describing, among other things, its privacy policy, any nonpublic personal information that the company intends to disclose to affiliates or third parties, and a method for the customer to "opt-out" of the disclosure of personal information. ³

In May 2000, the Commission issued regulations regarding the application of Title V of the Act to certain types of financial institutions (the "Regulations"). ⁴ Both the Act and the Regulations define a "financial institution" as an institution the business of which is engaging in financial activities as described in section 4(k) of the Bank Holding Company Act of 1956 (the "BHCA"). ⁵ Relevant examples of covered financial activities include financial, investment, and economic advisory services, real estate settlement services, and tax planning and return preparation services. ⁶ Legal services are not included in the list of covered activities. Under the Regulations, a firm that engages in one or more of the listed financial activities is treated as a "financial institution" only if it is "significantly engaged" in those activities. ⁷

There is no specific exception in the Act or the Regulations for lawyers or law firms. Consequently, if a law firm or individual practitioner is considered significantly engaged in one or more of the listed financial activities, the law firm or individual practitioner potentially would be subject to the Act's privacy requirements. Although common sense indicates that lawyers and firms primarily engaged in the practice of law should not be classified as financial institutions, there is no guidance in the Act or the Regulations as to what "significantly engaged" means in the context of the legal profession. In addition, while the privacy provisions of the Act are intended to protect consumers and do not restrict the use of information regarding entities and businesses, there is no indication in either the Act or the Regulations that the activities to be considered in making the "significantly engaged" determination exclude services provided to entities or businesses. Thus, the application of Title V of the Act to lawyers and law firms is unclear.

Under the Regulations, covered financial institutions were required to send initial privacy notices to all "customers" by July 1, 2001. ⁸ A "customer" is defined as an individual who obtains or has obtained from the financial institution a financial service primarily for personal, family, or household purposes and with whom the institution has an established relationship. ⁹ A customer does not include an entity or business of any sort. ¹⁰ Once an initial notice is sent to a customer, additional privacy notices must be sent annually thereafter. ¹¹

The stated purpose of the Act is to "enhance competition in the financial services industry by providing a prudential framework for the affiliation of banks, securities firms, insurance companies and other financial service providers." ¹² The focus of the Act is on the financial services industry and permitting combinations of various types of financial service providers. ¹³ A careful review of the Act's legislative history provides no support for interpreting Title V or any other provision of the Act as applying to the practice of law.

The legislative path of the Act provides affirmative evidence that it was not intended to apply to lawyers. When the Act was introduced in the House of Representatives, it was referred to the House Banking and Financial Services Committee and the House Commerce Committee, but not to the House Judiciary Committee, which has jurisdiction over matters pertaining to the legal profession. The Act also was never referred to the Senate Judiciary Committee. The fact that the legislation was not considered by either of the committees with jurisdiction over matters relating to the legal profession, and that neither committee chairman sought to exercise jurisdiction over Title V of the legislation, strongly indicates a Congressional belief that Title V would not extend to matters under the jurisdiction of those two committees. Thus, it seems implausible that Congress intended that law firms and individual practitioners be treated as financial institutions subject to the Act's privacy provisions.

As described above, a law firm or individual practitioner will not be classified as a financial institution under the Regulations unless the law firm or practitioner is "significantly engaged" in financial activities within the meaning of section 4(k) of the BHCA. Legal services are not, and should not be, considered financial activities under the BHCA for two related reasons. First, because the practice of law is subject to state regulation entirely different from the federal and state regulatory regimes that apply to financial institutions, legal services are intrinsically different from financial services and activities. The rules of professional responsibility and conduct that apply in all fifty states and the District of Columbia impose special obligations on attorneys, including duties of competency, diligence, confidentiality, undivided loyalty, and the obligation to charge reasonable fees. ¹⁴ Financial institutions typically are not subject to state-enforced rules of conduct analogous to the rules that apply to attorneys. Accordingly, the services provided in connection with the practice of law are inherently different from the types of financial products and services intended to be covered by the Act and the BHCA. A second reason that legal services are not, and should not be, considered financial activities within the meaning of the BHCA is that bank holding companies are prohibited from providing legal services to their customers under the professional independence rules that apply in all states. ¹⁵ Thus, the Act and the BHCA could not possibly have been intended to apply to law firms and lawyers whose principal activity is the practice of law.

Legal services clearly are distinct from the types of financial services described in section 4(k) of the BHCA. Although financial services such as financial, investment, and economic advisory services, real estate settlement services, and tax planning and return preparation services may be provided in connection with, or subsumed within, legal services, these financial services are often ancillary to the practice of law. When such services are performed in connection with or as part of the practice of law, they should not be considered financial activities within the meaning of section 4(k) of the BHCA because of the unique state-enforced rules of conduct that apply to attorneys and the special nature of the attorney-client relationship. Those unique rules of conduct, including the attorney confidentiality obligation, apply to the provision of financial services by lawyers as part of the practice of law, even though similar or analogous services may be performed by nonlawyers without giving rise to the unauthorized practice of law. ¹⁶ Consequently, any firm or individual practitioner engaged primarily in the practice of law should not be considered a financial institution within the meaning of Title V of the Act.

Based on the foregoing, the ABA urges the Commission to issue guidance expressly stating that legal services are not financial activities and that law firms and individual practitioners engaged primarily in the practice of law are not financial institutions within the meaning of the Act. Such guidance would be analogous to the exception that the Commission has created for travel agents who provide ancillary financial services. ¹⁷

The rules of professional responsibility that govern attorney conduct in each of the fifty states and the District of Columbia impose stringent confidentiality requirements on attorneys engaged in the practice of law. As described in more detail below, these confidentiality requirements provide a higher level of protection for consumers of legal services, and are more appropriate in the context of the attorney-client relationship, than Title V of the Act. The Act expressly states that it is not intended to preempt or alter applicable state regulation where such regulation provides greater consumer privacy protection than the Act. ¹⁸ Furthermore, the Act contemplates that the Commission will have the authority to grant exceptions from the application of Title V. ¹⁹ Accordingly, even if the Commission is unwilling for some reason to exclude law firms and individual practitioners engaged primarily in the practice of law from the Act's definition of "financial institution" as requested above, the ABA believes that the Commission has the authority to exempt lawyers from the application of the Act's privacy provisions and should exercise that authority on the ground that law firms and individual practitioners engaged in the practice of law are subject to state confidentiality requirements that are both more stringent and more appropriate to the attorney-client relationship than Title V.

Each state regulates the conduct of lawyers through the state's court system. The highest state court is responsible for promulgating rules of professional conduct, which in most states are patterned after either the ABA Model Rules of Professional Conduct (the "Model Rules") or the earlier version of those rules, the ABA Model Code of Professional Responsibility. If a lawyer violates the applicable state rules of conduct, it is considered professional misconduct subject to court sanction or a disciplinary hearing before a state bar organization or other state-created agency that is supervised by the highest state court. ²⁰ If disciplinary action is required, the court or enforcing agency has the authority to reprimand a lawyer, suspend the lawyer's license to practice, or, for more serious violations, disbar the lawyer.

The obligation of confidentiality is a longstanding cornerstone of the attorney-client relationship. The confidentiality rules have been developed over the centuries and reflect the unique relationship that exists between lawyers and their clients. The objective of those rules is to encourage full and frank communication between attorney and client. ²¹ These rules of confidentiality facilitate the full development of facts essential to proper representation of the client and encourage people to seek early legal assistance. ²² Unlike the Act's privacy provisions, the confidentiality rules applied by the various states are specifically designed to foster and protect the attorney-client relationship.

The ABA's Commission on Evaluation of Professional Standards amended and broadened the obligation of confidentiality when it developed the Model Rules in 1983. Under Rule 1.6(a) of the Model Rules, a lawyer is not permitted to "reveal information relating to representation of a client unless the client consents after consultation, except for disclosures that are impliedly authorized in order to carry out the representation." The only other exceptions to confidentiality involve situations where the client is planning to commit a serious crime, there is a dispute between the attorney and the client regarding the representation, or the attorney is subject to criminal, civil, or disciplinary charges in connection with the representation. ²³ The confidentiality obligation applies to all information -- both public and non-public -- gained in the scope of representation. ²⁴ Rule 1.6 is broader than the right of attorney-client privilege and restricts dissemination of any information that was obtained as a result of representation, whether or not provided by the client. ²⁵ In addition to preventing disclosure, the Model Rules also prohibit the use of such information in any way detrimental to the client. ²⁶ Finally, the confidentiality obligation continues to apply after the attorney-client relationship terminates. ²⁷

All fifty states and the District of Columbia have adopted confidentiality requirements that are either based on or similar to Rule 1.6 (or its predecessor provision in the ABA's Model Code of Professional Responsibility). Although there are variations among the confidentiality requirements imposed by the various states, those variations typically relate to one or more of the following issues: (i) whether disclosure of a client's intention to inflict serious bodily harm or death should be mandatory or permissive; (ii) whether disclosure should be permitted with respect to a client's intention to commit less serious crimes or engage in reckless or fraudulent conduct; and (iii) whether to distinguish the right or obligation to disclose depending on whether the information is protected by the attorney-client privilege or solely by ethical rules. ²⁸ As a result, the variations among state-imposed confidentiality requirements are not relevant to an analysis of whether those requirements are more stringent or more appropriate in the attorney-client context than the Act's privacy provisions.

Title V of Gramm-Leach-Bliley clearly provides less privacy protection for consumers than Rule 1.6 of the Model Rules and the corresponding provisions of the various state professional conduct codes. Examples of ways in which the attorney confidentiality obligation provides a higher level of privacy protection than Title V include the following:

• The confidentiality obligation protects all information obtained in the course of the representation, while Title V protects only nonpublic personal information;
• Title V allows a financial institution to disclose nonpublic personal information about a customer if the customer fails to opt-out of disclosure after receiving appropriate notice of his or her right to do so, while the confidentiality obligation must be affirmatively waived by the client (referred to as an "opt-in" rule); ²⁹ and
• The exceptions to the information disclosure limitations of the Act ³⁰ are significantly broader than the exceptions to the confidentiality obligation. ³¹

Even where the attorney confidentiality obligation creates a right or obligation to disclose client information, an attorney generally may divulge only the minimum amount of information necessary to address the situation. ³² An attorney also may be required to take protective measures so that the information disclosed is not conveyed to any unnecessary parties. ³³ Thus, the attorney confidentiality obligation clearly is more stringent than the Act's privacy provisions. As result, compliance with state confidentiality requirements should be deemed to be compliance with Title V. ³⁴

The state confidentiality requirements that apply to lawyers have been designed specifically to foster and protect the attorney-client relationship. Title V, on the other hand, is intended to govern the relationship between banks, insurers, and other financial institutions and their customers, which differs substantially from the attorney-client relationship. The Act's rules are ill suited to govern attorney conduct. For example, Title V requires that financial institution customers receive initial and annual privacy policy notices describing, among other things, the institution's policies regarding disclosure of nonpublic personal information to both affiliated and unaffiliated parties and the customer's right to opt-out of disclosure of such information to unaffiliated parties. ³⁵ Applying this notice requirement to lawyers is redundant and may create confusion because a lawyer's or law firm's privacy policy is mandated by state professional conduct rules that are longstanding and publicly available. In addition, attorneys are subject to an "opt-in" requirement under state professional conduct rules and are not permitted to impose an "opt-out" requirement on their clients with respect to information disclosure. Finally, requiring lawyers to provide privacy notices to their clients -- along with banks, credit card companies, and other financial institutions that are not subject to the sort of stringent confidentiality obligations applicable to lawyers-- potentially will create confusion among clients as to whether there has been a dilution of the attorney confidentiality rules. Consequently, subjecting lawyers and law firms to Title V would provide no benefit to consumers and instead might confuse the public.

Congress clearly intended that Title V of the Act not interfere with appropriate state regulation of a business or activity and that the Commission be sensitive to state regulation in implementing Title V. Section 507(a) ³⁶ of the Act expressly provides that Title V "shall not be construed as superseding, altering, or affecting any statute, regulation, order, or interpretation in effect in any State, except to the extent that such statute, regulation, order, or interpretation is inconsistent with the provisions of this subtitle, and then only to the extent of the inconsistency." Under the Act, a state law is not inconsistent with Title V if the law provides greater protection to consumers than Title V. ³⁷ The Act also grants the Commission specific authority to provide exceptions to the application of Title V's privacy provisions. ³⁸ Accordingly, Congress clearly intended that the Commission have the authority to exempt a business or activity from the application of Title V and that such authority would be exercised where state regulation of a business or activity is more protective and more appropriate than the rules of Title V. ³⁹

The practice of law is subject to longstanding regulation by the various state court systems. Over the centuries, an extensive system of judicial regulation of lawyers has emerged, including admission requirements, ethical codes, and disciplinary rules, that governs virtually every aspect of a lawyer's professional life. These rules and regulations are promulgated and enforced by the highest court of each state. An unbroken line of U.S. Supreme Court decisions recognizes the unique nature of the legal profession and the inherent power of the states to regulate the practice of law. ⁴⁰ In particular, the Supreme Court has indicated that the states' interest in regulating the legal profession "is especially great since lawyers are essential to the primary governmental function of administering justice, and have historically been 'officers of the court'" ⁴¹ and that the practice of law is not "interchangeable with other business activities." ⁴² As a result, the Supreme Court often has refused to permit the application of federal laws to the legal profession.

Under applicable state rules, lawyers are subject to confidentiality requirements more stringent than the Act's privacy provisions. In addition, those requirements are specifically designed to nurture and protect the attorney-client relationship. It seems clear based on the plain language of the Act that Congress did not intend that Title V interfere with the longstanding and appropriate state regulation of attorneys and would want the Commission to grant an exemption from the application of the Act's privacy provisions to law firms and individual practitioners engaged primarily in the practice of law. Such an exemption would be analogous to the one granted by the Commission to colleges and universities, which are subject to more protective privacy rules under another federal law. ⁴³ Accordingly, the ABA urges the Commission to provide such an exemption -- temporarily by issuing an informal staff opinion and more permanently by amending the Regulations.

Under the Regulations, covered financial institutions were required to send initial privacy notices to all customers who are individuals by July 1, 2001. ⁴⁴ Once an initial notice is sent to a customer, additional privacy notices must be sent annually thereafter. ⁴⁵ The financial institutions that the Act was intended to regulate are generally large companies that have their own or have ready access to computerized customer lists and automated mailing systems. Small law firms and lawyers who are individual practitioners, however, generally do not own or have access to such resources. In attempting to comply with the Act's notice requirements, small law firms and individual practitioners typically would not be able to afford the sort of automated systems that financial institutions have on hand. Instead, these individuals would have to assemble client lists and prepare mailings using non-automated or semi-automated procedures that are time-consuming and expensive. Consequently, the ABA believes that applying the Act's notice requirements to small law firms and individual practitioners would be unduly burdensome and unwarranted, particularly given the absence of any apparent public benefit from sending such notices and the likelihood that receiving such notices from lawyers would generate public confusion. Thus, it is especially important that the Commission provide small law firms and individual practitioners with relief from the Act's notice requirements.

For these reasons we feel that lawyers and law firms engaged in the practice of law should be excluded from the set of regulated entities under Title V of this Act. We appreciate your consideration of these very important issues. I look forward to having the opportunity to discuss these issues with you, your fellow Commissioners and the Commission staff in the near future.

Sincerely,

Martha W. Barnett
President, American Bar Association

1. Gramm-Leach-Bliley Financial Modernization Act, Pub. L. No. 106-102, 113 Stat. 1338 (1999).
2. 15 U.S.C. §§ 6801 et seq.
3. Id. at §§ 6802-6803.
4. 16 C.F.R. § 313.
5. 15 U.S.C. § 6809(3)(A); 16 C.F.R. § 313.3(k)(1). Section 4(k) of the Bank Holding Company Act of 1956, as amended, is found at 12 U.S.C. § 1843(k).
6. See 12 U.S.C. § 1843(k)(4)(C), (G); 12 C.F.R. § 225.28(b)(2)(viii), (6)(vi).
7. 16 C.F.R. § 313.3(k)(1).
8. Id. at §§ 313.4, 313.18(b)(1).
9. Id. at § 313.3(e), (h)-(i).
10. Id. at § 313.3(e).
11. 15 U.S.C. § 6803(a); 16 C.F.R. § 313.5.
12. H.R. Rep. No. 106-434, at 1 (1999), reprinted in 1999 U.S.C.C.A.N. 245.
13. The Act does not change the regulatory framework within which lawyers and law firms operate, nor does it permit a law firm to combine with other types of service providers. Law firms generally are prevented from affiliating with other types of service providers and businesses by the professional responsibility rules regarding lawyer independence that have been adopted by each of the states. See AMERICAN BAR ASSOCIATION MODEL RULES OF PROFESSIONAL CONDUCT (hereinafter referred to as "MODEL RULES"), Rule 5.4 (1983). Those rules typically prevent a lawyer from sharing fees or entering into a law partnership with a nonlawyer or practicing law with a professional corporation if any nonlawyer is an officer or director of the corporation or owns an interest therein. See id.
14. See id. at Rules 1.1, 1.3, 1.5, 1.6, 1.7, and 3.4.
15.See id. at Rule 5.4. A lawyer generally is not permitted to share profits with a nonlawyer, form a partnership with a nonlawyer if any of the activities of the partnership consist of the practice of law, or practice with a corporation or association if a nonlawyer is a director or officer or owns any interest therein. Id.
16. See id. at Rule 5.7.
17. The "Supplementary Information" to the Regulations indicates that providing ancillary financial services does not cause travel agents to be treated as financial institutions under the Act. See 65 F.R. 33655 (May 24, 2000).
18. 15 U.S.C. § 6807.
19 See id. § 6804(b).
20. See MODEL RULES, Rule 8.4(a).
21. Id. at Rule 1.6, comment 4.
22. Id. at Rule 1.6, comment 2.
23. See id. at Rule 1.6(b).
24. See id. at Rule 1.6, comment 6.
25. See id.
26. See id. at Rule 1.8(b).
27.Id. at Rule 1.6, comment 22.
28. See REGULATION OF LAWYERS: STATUTES AND STANDARDS 71 (S. Gillers & R. Simon eds., 2001).
29. An "opt-in" rule puts the burden on the attorney to seek the client's affirmative permission for information disclosure and thus is more protective of the consumer than an "opt-out" rule, which puts the burden on the consumer affirmatively to forbid disclosure.
30. See 15 U.S.C. § 6802(e).
31. See MODEL RULES, Rule 1.6.
32. See id. at Rule 1.6, comments 14, 18 & 19; NY County Lawyers' Ass'n Comm. on Professional Ethics, Formal Op. 722 (1997).
33. See Lawyer Disciplinary Board v. Farber, 488 S.E.2d 460 (W. Va. 1997); The Comm. on Professional Ethics of the Ass'n of the Bar of the City of New York, Op. 1986-8 (1986) (prescribing that attorney should only discuss confidential information about a fee claim with the court in camera and also should have information kept under seal.).
34. See 15 U.S.C. § 6807; 16 C.F.R. § 313.1(b) (compliance with the Federal Educational Rights and Privacy Act by a university will be deemed compliance with Title V).
35. See 15 U.S.C. §§ 6802(b), 6803.
36. See id. at § 6807(a).
37. See id. at § 6807(b).
38. See id. at § 6804(b).
39. We have heard that the Commission may be reluctant to exempt attorneys from Title V because of Heintz v. Jenkins, 514 U.S. 291 (1995), in which the Supreme Court rejected the Commission's interpretation that attorneys were exempt from coverage of the Fair Debt Collection Practices Act (the "FDCPA"). However, Heintz should not be an impediment here because, while the Commission does not have express rulemaking authority to grant such an exemption under the FDCPA, it does under the Act. See 15 U.S.C. §6804 (b).
40. See, e.g., Hoover v. Ronwin, 466 U.S. 558 (1984) (precluding Sherman Act suit against development and grading of bar examinations); Bates v. State Bar of Arizona, 433 U.S. 350 (1977) (state prohibition against lawyer advertising does not violate the Sherman Act); Goldfarb v. Virginia State Bar, 421 U.S. 773 (1975) (refusing to impose Sherman Act to a state bar organization).
41. Bates, 433 U.S. at 362.
42. Goldfarb, 421 U.S. at 788 n.17.
43. Institutions of higher learning are subject to the more stringent privacy rules of the Federal Educational Rights and Privacy Act, 20 U.S.C. § 1232g, and its implementing regulations, 34 C.F.R. part 99, which govern the disclosure of student financial aid and other educational records. 65 F.R. 33648 (May 24, 2000). The Regulations provide that compliance with these more stringent rules "shall be deemed to be . compliance with" Title V. 16 C.F.R. § 313.1(b).
44. 16 C.F.R. §§ 313.4, 313.18(b)(1).
45. 15 U.S.C. § 6803(a); 16 C.F.R. § 313.5.

Executive Branch Letters Home