Order Code RL32626
CRS Report for Congress
Received through the CRS Web
American Bankers Association v. Lockyer:
Whether California’s Financial Information Privacy
Law Has Been Preempted by the Fair and
Accurate Credit Transactions (FACT) Act
Updated November 23, 2005
M. Maureen Murphy
American Law Division
Congressional Research Service ˜ The Library of Congress
American Bankers Association v. Lockyer: Whether
California’s Financial Information Privacy Law Has
Been Preempted by the Fair and Accurate Credit
Transactions (FACT) Act
P.L. 108-159, the Fair and Accurate Credit Transaction (FACT) Act of 2003,
extends a clause in the Fair Credit Reporting Act purporting to preempt state law and,
thereby, establish a national standard for sharing of consumer financial information
among affiliated companies. The legislative history of the FACT Act indicates
awareness that California’s Financial Information Privacy Law, enacted in 2003,
would be preempted. Nonetheless, on June 30, 2004, a federal court ruled, in
American Bankers Association v. Lockyer, that the FACT Act preempted state law
only with respect to credit report information and that an anti-preemption clause in
the privacy title of P.L. 106-102, the Gramm-Leach-Bliley Act of 1999, permits
states to enact more protective laws such as that of California. The federal banking
regulators and the Federal Trade Commission joined the plaintiffs in urging the U.S.
Court of Appeals for the Ninth Circuit to reverse the decision and to expedite the
appeal. On June 20, 2005, the appellate court reversed the district court ruling and
found that the FACT Act preempted the California law to the extent that it attempted
to regulate communication among affiliated companies of information covered by the
FCRA’s definition of “information.” On October 4, 2005, the district court issued
an injunction against enforcement of the California statute’s affiliate information
sharing provisions, having found that distinguishing information shared among
affiliates that is covered by the FACT Act from that which could survive was not
practicable. California has appealed this ruling. This report will be updated as
Background . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
Federal Statutes on Affiliate Information Sharing: GLBA and FCRA . . . . . 2
The FACT Act Provisions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
FACT Act Legislative History . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
Preemption Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
District Court Ruling: American Bankers Association v. Lockyer . . . . . . . . 6
Issues on Appeal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Analysis of the District Court’s Decision . . . . . . . . . . . . . . . . . . . . . . . . . . 12
The Ninth Circuit Ruling: American Bankers Association v. Gould . . . . . . 14
District Court Ruling on Remand: American Bankers Association v.
Lockyer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Legislation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
American Bankers Association v. Lockyer:
Whether California’s Financial Information
Privacy Law Has Been Preempted by the
Fair and Accurate Credit Transactions
The California Financial Information Privacy Act,1 was enacted on August 28,
2003, as Congress was considering the legislation that was to become the Fair and
Accurate Credit Transactions (FACT) Act.2 The California law became effective on
July 1, 2004. It governs the rights of California residents with respect to the
dissemination of nonpublic personal information by financial institutions. In some
respects, it diverges from two federal laws that impose restrictions on the
dissemination of customer information by financial institutions: (1) the privacy title
of the Gramm-Leach Bliley Act of 1999 (GLBA)3 and (2) 1996 amendments to the
Fair Credit Reporting Act of 1970 (FCRA).4 It includes a requirement that, before
sharing nonpublic personal information with nonaffiliated third parties, financial
institutions obtain an opt-in, i.e., affirmative consent, from their customers.5 Before
such information may be shared with affiliates not in the same line of business and
regulated by the same functional regulator, an opt-out notice is required, i.e., a notice
providing an opportunity to preclude disclosure of information. Wholly-owned
subsidiaries and affiliates in the same line of business (securities, banking, or
insurance) may share information, except medical information, without an opt-out
or opt-in requirement.
California’s law was enacted as a temporary federal statute purporting to
preempt state regulation of information sharing among corporate affiliates was set to
expire on December 31, 2003. The FACT Act, among other things, makes that
Cal. Fin. Code §§ 4050 - 4060.
P.L. 108-159, 117 Stat. 1952 (2004).
P.L. 106-102, 11 Stat. 1338, 15 U.S.C. §§ 6801 et seq.
P.L. 91-508, tit. VI; 84 Stat. 1128; 15 U.S.C. §§ 601 et seq.
For further information, see CRS Report RL31758, Financial Privacy: The Economics
of Opt-In vs Opt-Out, by Loretta Nott; and CRS Report RL31847, The Role of Information
in Lending: The Cost of Privacy Restrictions, by Loretta Nott.
preemption permanent and limits the ability of affiliated companies to share
consumer information for marketing solicitations.6
Federal Statutes on Affiliate Information Sharing:
GLBA and FCRA
Generally, both the Gramm-Leach-Bliley Act (GLBA) of 19997 and the Fair
Credit Reporting Act (FCRA) of 1970,8 as amended, address the issue of sharing of
information about consumers among business entities. GLBA applies to “financial
institutions.” It restricts entities, which are in the business of providing financial
services, from sharing customer non-public personal information with non-affiliated
third parties. FCRA regulates credit bureaus and the credit reporting business. It does
not require such businesses to register or be chartered. Instead, it defines certain
functions and regulates businesses performing those functions under the
nomenclature of “credit reporting agencies.” It prescribes standards that address
information used to determine eligibility of consumers for credit, insurance, or
employment and covers “any person which, for monetary fees, dues, or on a
cooperative nonprofit basis, regularly engages in whole or in part in the practice of
assembling or evaluating consumer credit information or other information on
consumers for the purpose of preparing or furnishing consumer reports.”9 As
originally enacted, FCRA did not include an express provision on the exchange of
consumer credit information among affiliated companies. Subsequently, under the
Fair Credit Act Amendments of 1996,10 information sharing among affiliates was
specifically excepted from the definition of “consumer report,” thereby permitting
affiliated companies to share with one another customer information without
implicating FCRA obligations and requirements.11
With respect to coverage of interaffiliate information sharing, FCRA preempts
state law in broad language. GLBA takes an opposite approach; it contains an antipreemption clause which preempts state laws only to the extent that state laws
provide consumers less protection than does GLBA. Under GLBA, inconsistent state
statutes, regulations, orders, or interpretations are preempted, to the extent of their
For further information on the FACT Act, see CRS Report RL32535, Implementation of
the Fair and Accurate Transactions (FACT) Act of 2003, by Angie A. Welborn and Grace
Chu; CRS Report RS21449, Fair Credit Reporting Act: Preemption of State Law, by Angie
A. Welborn; and, CRS Report RL32121, Fair Credit Reporting Act: A Side-by-Side
Comparison of House, Senate and Conference Versions, by Angie A. Welborn and Loretta
P. L. 106-102, 113 Stat. 1338, 15 U.S.C. §§ 6801 et seq.
P.L. 91-508, tit. 6, § 601, 1128; 15 U.S.C. §§ 1681 et seq.
15 U.S.C. § 1681a(f).
P.L. 104-208, Div. A, Tit., II, Subtitle d, Ch. 1, § 2419, 110 Stat. 3009-452, adding 15
U.S.C. § 1681t(b)(2).
Exchange of experience and transaction information among affiliated companies is totally
excluded from the definition of “consumer report”; exchange of other information among
affiliates is excluded provided the consumer is given a notice and an opportunity to prevent
the disclosure, an opt-out.16 U.S.C. §§ 1681a(d)2)(A)(ii) and (iii).
inconsistency; and, a state law is not inconsistent “if the protection such statute,
regulation, order, or interpretation affords any person is greater” than provided by
GLBA.12 The difficulty is that the FCRA provisions relating to affiliate information
sharing and the GLBA privacy provisions do not clearly lay out their interaction with
one another. GLBA requires an opt-out for financial institutions to share nonpublic
personal information with non-affiliated third parties. It does not address any such
requirement for interaffiliate sharing. GLBA does, however, require financial
with respect to information sharing among affiliates. GLBA also has a savings clause
preserving the operation of FCRA.13
The FACT Act Provisions
The FACT Act provision on information sharing among affiliated companies
amends FCRA,14 as amended in 1996. FCRA regulates the credit reporting business
by prescribing standards for the credit reporting business and for users of consumer
credit reports. It generally defines “consumer reports” and limits the purposes and
conditions under which “consumer reports” may be furnished by “consumer reporting
agencies.”15 Under the 1996 amendments, the definition of “consumer report” was
amended to exclude communication of transaction and experience information
among corporate affiliates. Also excluded, provided the consumer was afforded an
opportunity to prevent it, i.e., opt out, was communication of other information
concerning the consumer among affiliates.16 Essentially, this permits companies to
share with their affiliates certain information respecting their transactions and
experience with a customer without any notification. Other customer information,
such as credit reports and information supplied or gathered in connection with
applying for loans or other services, may be shared with other companies in the
corporate family if the customers are given “clear and conspicuous” notice about the
sharing and an opportunity to direct that the information not be shared.17 Under the
1996 FCRA amendments, what had been the FCRA’s general anti-preemption clause
preserving more protective state law, was modified to specify federal preemption of
state law until January 1, 2004, with respect to certain issues. Included among the
issues temporarily preempted was the “exchange of information among persons
15 U.S.C. § 6807. Under this provision, inconsistency is to be determined by the Federal
Trade Commission (FTC). 15 U.S.C. § 6807(b).
It reads: “[e]xcept for the amendments made by subsections (a) and (b)[relating to
enforcement], nothing in this title shall be construed to modify, limit, or supersede the
operation of the Fair Credit Reporting Act, and no inference shall be drawn on the basis of
the provisions of this title regarding whether information is transaction or experience
information under section 603 of such Act.” 15 U.S.C. § 6806(c).
84 Stat. 1128, 15 U.S.C. §§ 1681 et seq.
15 U.S.C. § 1681b.
15 U.S.C. §§ 1681a(d)(2)(A)(ii) and (iii).
15 U..C. § 1681a(d)(2)(A)(iii).
affiliated by common ownership or common control.”18 Under the FACT Act
amendments, this preemption provision was made permanent and an additional
limitation was placed on information sharing among affiliated companies. Subject
to certain exceptions, affiliated companies may not share customer information for
marketing solicitations unless the consumer is provided clear and conspicuous
notification that the information may be exchanged and an opportunity and a simple
method to opt-out.19
FACT Act Legislative History
When the FACT Act was passed, there were indications of congressional
awareness of the California Financial Information Privacy Act treatment of
information sharing among affiliated companies. The California law was enacted as
the FCRA temporary preemption of state law was about to expire,
contemporaneously with congressional consideration of proposals to extend the
FCRA preemption. The legislative history of the FACT Act includes references to
the preemptive effect the FACT Act was anticipated to have on the California
provisions respecting information sharing among corporate affiliates. The Conference
Committee proclaimed that “the legislation will ... ensure the operational efficiency
of our national credit system by creating a number of preemptive standards.”20 Floor
debate included statements that the bill would preempt the California law
requirement with respect to sharing of information among affiliates21 and rejection
15 U.S.C. § 1681t(b)(2).
15 U.S.C. § 1681s-3. The limitations with respect to using the information communicated
among affiliates for marketing purposes is also covered by the preemption-of-state law
provision. 15 U.S.C. § 1681s-3(c).
H.Rept. 108-396, 66 (2003)
149 Cong. Rec. H 8120 (September 9, 2003, daily ed.) (Rep. Frank, a proponent of the
measure, and ranking minority member of the committee reporting the bill, the House
Financial Services Committee. In the Senate, the debate centered on S. 1753, which was
passed by the Senate and its language, eventually, substituted for that of the House bill, H.R.
2622, with reconciliation of the two versions occurring in the Conference Committee. In
the Senate debate, Sen. Feinstein was clear in informing her colleagues that “this bill
reduces the privacy rights of 36 million Californians.” 149 Cong. Rec. S13980 (November
5, 2003, daily ed.). Sen. Reed said that “[f]ailure to reauthorize national standards would
balkanize our national credit system and potentially hurt every consumer in America,” and
indicated that he was speaking inclusively of all affiliate information sharing. 149 Cong.
Rec. S13858 (November 5, 2003). According to Sen. Reed:
When Congress passed the amendments to the Fair Credit Reporting Act in 1996,
affiliate sharing had a very different meaning. The Gramm-Leach-Bliley Act had
not yet been passed, and massive financial services holding companies had not
emerged. Today, according to the Federal Reserve’s National Information
Center, the largest bank holding company has at least 1639 affiliates as of June
30, 2003. The meaning of affiliate sharing has changed, and will likely continue
to change as the financial services industry adapts to changing times. Id., at S
by the Senate of an amendment that would have made the California standard a
national standard on affiliate information sharing.22
Preemption analysis begins with the Supremacy Clause of the U.S.
Constitution.23 Under it, Congress may override state laws in conflict with the
exercise of powers delegated to it under Article I of the U.S. Constitution. When
Congress has done so, preempted state laws are unenforceable. Determining whether
a federal statute has a preemptive effect is a matter of statutory analysis. If Congress
enacts legislation under one of its delegated powers that includes an explicit
statement that state law is preempted, the Supreme Court generally will give effect
to that legislative intent.24 Where there is no language of preemption, the Court is
likely to find preemption when it identifies a direct conflict between the federal law
and the state law or when it concludes that the federal government has so occupied
the field as to preclude enforcement of state law with respect to the subject at hand.25
Since the FCRA clause on affiliate information sharing contains explicit
language of preemption, the issue is one of statutory construction, i.e., discerning and
giving effect to congressional intent.26 Generally, that intent is determined by
examining the statutory language, giving effect to its plain meaning in relation to its
context in the statute, and, if further elaboration is necessary, its legislative history.27
In dealing with matters traditionally within the power of states to protect public
health and safety, i.e., the police power, the Supreme Court often applies a
presumption against preemption.28 In some recent decisions upholding an express
federal preemption, however, the presumption against preempting state police power
laws or regulations did not figure in the Court’s analysis. These cases seem to have
S. Amend. 2054, offered by Sen. Feinstein, 149 Con. Rec. 13860 (November 5, 2003).
U.S. Const., Art. VI, cl. 2. It declares that the Constitution and “the Laws of the United
States which shall be made in Pursuance thereof ... shall be the supreme Law of the Land
... any Thing in the Constitution or Laws of any State to the Contrary notwithstanding.”
Rice v. Santa Fe Elevator Corp., 331 U.S. 218, 230 (1947); Wisconsin Public Intervenor
v. Mortier, 501 U.S. 597, 605 (1991).
CRS Report 97-589, Statutory Interpretation: General Principles and Recent Trends, by
“The purpose of Congress is the ultimate touchstone” in every preemption case. Retail
Clerks v. Schermerhorn, 375 U.S. 96, 103 (1963).
See Cipollone v. Liggett Group, Inc., 505 U.S. 504, 532 (Blackmun, J. concurring in part
and dissenting in part).
See, e.g., Medtronic, Inc. v. Lohr, 518 U.S. 485 (1996) (express preemption provision in
the 1976 Medical Device Amendments to the Federal Food, Drug, and Cosmetic Act did not
preempt state tort action for a defective pacemaker); Cipollone v. Liggett Group, Inc., 505
U.S. 504 (1992) (express preemption clause in federal cigarette labeling legislation read
narrowly in light of presumption against preemption of state police power and state tort
action found not preempted).
been confined to examining the language and legislative history of the provision in
District Court Ruling:
American Bankers Association v.
In American Bankers Association v. Lockyer,30 the American Bankers
Association, the Consumers Bankers Association, and the Financial Services
Roundtable challenged the validity of California’s Financial Information Privacy
Act31 treatment of information sharing among affiliated companies. Specifically, at
issue is the California prohibition on disclosure of a consumer’s nonpublic personal
information to the financial institution’s affiliates without providing the consumer
with written notice and a reasonable opportunity to prevent the disclosure, i.e., an opt
out. Plaintiffs maintained that the provision is preempted by the FCRA, as amended
in 1996 and by section 214 of the FACT Act32 in 2003. The California Attorney
General, defended the California statute as permissible under the GLBA antipreemption clause, which preserves any state law that is more protective.33
At the district court level, the court identified its task as that of determining
Congressional intent. To do so, it assumed that a narrow reading must be given to
the FCRA/FACT Act preemption provision and a presumption against preemption
invoked because the California law represented the exercise of the state’s police
power.34 The court relied on the purposes enunciated in FCRA35 and various judicial
In Lorillard Tobacco Co. v. Reilly, 533 U.S. 525 (2001), the Court found Massachusetts
regulations on sale of tobacco products to minors to be preempted by federal cigarette
labeling laws as requirements on smoking and health. The court examined the legislative
history of the cigarette labeling laws, including the language in a previous version of the
federal law. In Geier v. American Honda Motor Co, Inc., 529 U.S. 861 (2000), a state tort
action for failure to equip a certain vehicle with an airbag was held to have been preempted
by a federal motor vehicle safety standard promulgated under the National Traffic and
Motor Vehicle Safety Act of 1966, 80 Stat. 718, under which an airbag was not required on
the particular vehicle. See, Susan Raeker-Jordan, “A Study in Judicial Sleight of Hand: Did
Geier v. American Honda Motor Co Eradicate the Presumption Against Preemption,” 17
Brigham Young University Journal of Public Law 1 (2002); Mary J. Davis, “ Unmasking the
Presumption in Favor of Preemption,” 53 South Carolina Law Review 967 (2002).
___ F.Supp. 2d ___ (E.D.Cal. 2004), 2004 WL 1490432.
Cal. Fin. Code §§ 4050 - 4060.
P.L. 108-159, 117 Stat. 1952, 1980 (2004).
15 U.S.C. § 6807.
It drew this presumption from three cases, one of which involved express language of
preemption. That was Cipollone v. Liggett Group, Inc., 505 U.S. 504 (1992) (cigarette
labeling statute’s express preemption provision held by a plurality of the Court to preempt
a state common law negligence action by taking a narrow view of the scope of the express
preemption provision and invocation of presumption against preemption when dealing with
a state’s police power). In California v. ARC Am. Corp., 490 U.S. 93 (1989), a state
antitrust law allowing indirect purchasers to recover damages in price fixing cases was held
interpretations of the scope of the FCRA in construing it, not as a system for
regulating commercial dissemination of consumer information but as regulation of
consumer reporting agencies and the contents of consumer reports. It invoked an
appellate court FCRA decision36 to draw a distinction between consumer reports and
the information they contain when that information is not used, expected to be used,
or collected for one of the permissible purposes of “consumer reports” under the
FCRA.37 It then examined the FCRA provisions excluding information exchanged
among affiliates from the definition of “consumer report” and preempting state laws
on affiliate information sharing.38 The latter reads:
[n]o requirement or prohibition may be imposed under the laws of any State ...
with respect to the exchange of information among persons affiliated by common
ownership or common corporate control, except that this paragraph shall not
not to be preempted as an obstacle to the accomplishment of a federal antitrust statute in
view of the long exercise of state police power in the antitrust area. In General Motors v.
Abrams, 897 F. 2d 34 (2d Cir. 1990), an FTC consent order was held not to preempt New
York State’s lemon law by occupying the field in consideration of the tradition of state
regulation of trade practices.
The court relied on 15 U.S.C. § 1681. It includes Congressional findings and a statement
of purpose. The latter states that the purpose of the legislation is “to require that consumer
reporting agencies adopt reasonable procedures for meeting the needs of commerce for
consumer credit, personnel, insurance, and other information in a manner which is fair and
equitable to the consumer, with regard to the confidentiality, accuracy, relevancy, and
proper utilization of such information in accordance with the requirements of this chapter.”
Ippolito v. WNS, Inc., 864 F. 2d 440 (7th Cir. 1988). The portion of the opinion that
Lockyer relied on stated:
as defined in §§ 1681a(d) and 1681b, not all reports containing information on
a consumer are ‘consumer reports.’ To constitute a ‘consumer report,’ the
information contained in the report must have been ‘used or expected to be used
or collected in whole or in part’ for one of the purposes set out in the FCRA if:
(1) the person who requests the report actually uses the report for one of the
‘consumer purposes’ set forth in the FCRA; (2) the consumer reporting agency
which prepares the report ‘expects’ the report to be used for one of the
‘consumer purposes’ set forth in the FCRA; or (3) the consumer reporting agency
which prepared the report originally collected the information contained in the
report expecting it to be used for one of the ‘consumer purposes’ set forth in the
FCRA. Ippolito v. WNS, Inc., 864 F. 2d 440 , 449 (7th Cir. 1988), cert. denied,
The decision involved a claim that a consumer report was illegally obtained. The court
ruled that because the purpose for which the report was intended did not involve consumer
credit, insurance, etc., but investigation of the owners of a business by another business in
connection with litigation, the information supplied by the consumer reporting agency was
not a “consumer report.”
15 U.S.C. § 1681b (consumer’s request, court order, consumer credit transaction,
insurance, government benefit eligibility, child support agency, and employment). For
further information, see, CRS Report RL31666, Fair Credit Reporting Act: Rights and
Responsibilities, by Angie A. Welborn.
15 U.S.C. § 1681t(b)(2).
apply with respect to subsection (a) or (c)(1) of section 2480e of title 9, Vermont
Statutes Annotated (as in effect on September 30, 1996).39
It noted that the FCRA language, on its face, seems to preempt all state laws on
affiliate sharing of consumer information. It then reasoned that interpreting the
language of preemption that way would encompass broader coverage than the
underlying legislation and, thereby, cover all information rather than just consumer
credit information or credit report information.
The court reasoned that since information sharing among affiliates is exempted
from the FCRA’s definition of “consumer report,” it would make no sense for the
FCRA to exclude affiliate information sharing from FCRA coverage in that manner
in one clause and in another bring it within the ambit of the statute by precluding
states from regulating it. The court saw this reasoning reinforced by the fact that the
same clause that preempted state law with respect to affiliate sharing of information
specifically preserved a Vermont law from preemption, which applied state credit
reporting law to affiliate sharing of information.40
GLBA was also a factor in the court’s decision. That its notice requirement
applies to affiliate information sharing led the court to read the GLBA antipreemption clause to cover California’s right to enact its opt-out requirement for
affiliate information sharing. To support this conclusion, it quoted from the
legislative history, including the following remark by Senator Sarbanes, the sponsor
of the anti-preemption clause: “We were able to include in the conference report an
amendment that I proposed which ensures that the Federal Government will not
preempt stronger State financial privacy laws that exist now or may be enacted in the
future. As a result, States will be free to enact stronger financial privacy safeguards
if they deem it appropriate.”41
The Vermont law places strictures on the release of credit reports. The FCRA preemption
provision is stated as a general exception to FCRA’s general anti-preemption clause , 15
U.S.C. § 1681t(a), preserving state laws.
The court appears to have overlooked the fact that the Vermont statute’s coverage of
credit reports was broader than FCRA’s coverage of “consumer reports,” and, therefore,
would have covered affiliate information sharing but for the exclusion.
145 Cong. Rec. S13789 (November 3, 1999, daily ed.).
Issues on Appeal
In the appeal of Lockyer, to the U.S. Court of Appeals for the Ninth Circuit,42
the appellant was supported by financial services trade associations43 and federal
bank, thrift, and credit union regulators, and the Federal Trade Commission (FTC).44
The American Bankers Association, the Financial Services Roundtable, and the
Consumer Bankers Association, who are the appellants in the case, argue for a plain
meaning interpretation of the FCRA language. In their view, the sharing of customer
information among affiliated companies is “the essential predicate to offering
comprehensive banking, insurance, and securities products” to customers of financial
services companies.45 Their premise is that the nation-wide integrated financial
services companies authorized by financial modernization legislation46 relies on the
three laws at issue and that, contrary to the district court’s interpretation, the FCRA’s
1996 amendments and the FACT Act provide comprehensive regulation of customer
information sharing among affiliated financial companies. They appear to fault the
district court for considering “consumer reports” only in the narrow or technical
sense of information covered by the FCRA that is subject to the most stringent
limitations on providers, users, or collectors and is generally obtained through
consumer reporting agencies. They see the three laws on a continuum and the district
court as ignoring the plain language of the FCRA preemption, the clause in GLBA
that preserves the operation of the FACT Act, and the legislative history of the FACT
Act. They argue that the district court should not have engaged in contextual
exegesis of unambiguous language and that, in doing so, the court limited the scope
of the statutory language. They further argue that the contextual analysis was
incomplete since it failed to note the contrast the subject provision has with other
preemption provisions in FCRA that do include limiting language.47 They take issue
American Bankers Association v. Lockyer, appeal docketed, No. 04-16334 (9th Cir. July
There are amicus briefs representing: (1) the Investment Company Institute, Securities
Industry Association, Investment Counsel Association of America, American Insurance
Association, American Council of Life Insurers, and the National Business Coalition of ECommerce and Privacy; (2) the Clearing House Association; (3) E-Loan, Inc.; and, (4)
Citizens for a Sound Economy.
Amicus Curiae Brief of the Office of Thrift Supervision, the Office of the Comptroller
of the Currency, the Federal Deposit Insurance Corporation, the Board of Governors of the
Federal Reserve System, the National Credit Union Administration, and the Federal Trade
Commission in Support of Appellants, American Bankers Association v. Lockyer, (9th Cir.
No. 04-16334) (hereinafter, Regulators’ Brief).
Brief of Plaintiffs-Appellants at 2, American Bankers Association v. Lockyer, (9th Cir. No.
“[T]hey operate as integrated financial services businesses, often under a common brand,”
sharing “customer information among their affiliates to provide comprehensive, seamless
services and products that customers expect, especially from commonly branded entities —
e.g., immediate transfer of funds and balance information between a bank and its securities
affiliate.” Id., at 16.
For example, 15 U.S.C. § 1618t(b)(1)(A). FCRA has a general savings clause, 15 U.S.C.
with the district court’s conclusion that the FCRA is concerned only with “consumer
reports,” citing legislative history of the 1996 amendments48 and of the FACT Act49
to this end. With respect to the presumption against preemption, the appellants
argue that it cannot overcome explicit, clear language of preemption. The appellants
also argue that the GLBA anti-preemption clause does not apply to state laws
preempted under FCRA and cites legislative history to this effect.50
The amicus brief of the federal banking regulators in support of the appellants
also argues for a plain meaning construction of the FCRA/FACT Act language. It
views the district court decision as predicated “on a fundamental misperception of
the framework and scope of FCRA”51 and as one that is “frustrating Congress’
objective.”52 It portrays FCRA, FACT Act, and GLBA, as a “carefully crafted
national system to govern the accumulation, dissemination and use of a consumer’s
personal financial information.”53 It contains considerable treatment of the legislative
history and the rationale behind the inclusion in the 1996 FCRA amendments of the
preemption of state law with respect to information sharing among affiliates. This
is used to discredit the court’s interpretation of the FCRA as too narrow. According
to the federal regulators, FCRA, as originally enacted, contained an exemption
permitting all businesses to share with other entities information about their own
dealings — i.e., “experience and transaction” information — without being subject
§ 1681t(a), preserving state laws that do “not annul, alter, affect, or exempt any person
subject to [its] ... provisions ... from complying with the laws of any State with respect to
the collection, distribution, or use of any information on consumers, except to the extent that
those laws are inconsistent with any provision of [FCRA] ... , and then only to the extent of
the inconsistency.” One of the exceptions to this clause is 15 U.S.C. § 1618(b)(1)(A) which
states that “No requirement or prohibition may be imposed under the laws of any State ...
with respect to any subject matter regulated under ... subsection (c) or (e) of section 1681b
of this title, relating to the prescreening of consumer reports.” [Emphasis added to indicate
the limiting language referred to in the American Bankers’ Association brief.]
Authorities cited for this include the detailed legislative history analysis written by the
General Counsel of the House Banking Committee during the time of Congressional
consideration of the 1996 FCRA amendments, i.e., Joseph L. Seidel, The Consumer Credit
Reporting Reform Act: Information Sharing and Preemption, 2 N.C. Banking Institute 79
Floor statements include those of Sen. Feinstein, 149 Cong. Rec. S13848, 13860
(November 4, 2003, daily ed.); Sen. Boxer, id., at S13874; Sen. Shelby, floor manager of
the bill, 149 Cong. Rec. S13863, 13873 (November 4, 2003 daily ed.); and Sen Durbin, 149
Cong. Rec. at S13875 (November 4, 2003, daily ed.).
145 Cong. Rec. S13883, 13901 (daily ed. Nov. 4, 1999), in which Sen. Gramm assured
Sen. Mack that “Section 507 is intended to apply only to subtitle A of title V of the bill, and
is not to be construed to apply to any provision of law other than the provisions of this
subtitle. Thus, section 507 does not affect the existing FCRA provisions on that statute’s
relationship to state laws.”
Regulators’ Brief, at 16.
Id., at 14.
Regulators’ Brief, at 1-2.
to regulation as credit reporting agencies. In the 1990’s, this became a problem for
holding companies: transaction and experience information could be shared with an
affiliate without triggering the added regulatory requirements, but information
derived from one affiliate could not be shared by another affiliate with a third
affiliate. Anything else could not be shared among affiliates without compliance
with the obligations imposed on credit reporting agencies. In that situation,
according to the regulators, affiliated companies were inhibited from sharing any
information among themselves. The 1996 amendments remedied this by treating
affiliated companies as if they were one company for the purposes of sharing
experience and transaction information and by permitting affiliated companies to
share other information among affiliates subject to an opt-out. According to the
At the same time that it established the federal criteria that enabled affiliates to
share a broad range of consumer information without becoming consumer
reporting agencies, the 1996 legislation also expressly preempted state laws that
impose requirements or prohibitions ‘with respect to the exchange of information
among persons affiliated by common ownership or common corporate control.’
15 U.S.C. § 1681t(b)92). The type of information covered by this preemption
was not limited to ‘consumer report’ information. The combined effect of these
provisions was to set national, uniform requirements for the sharing of consumer
information among affiliates.54
They argue that GLBA’s anti-preemption clause does not permit the states to enact
restrictions on affiliate information sharing; rather, it is limited to the provisions of
GLBA and does not affect the preemptive force of FCRA.
California, supported by 27 states55 and the District of Columbia, argues for
upholding the district court’s ruling. California has four major arguments. The first
is that the presumption against preemption in state police power cases requires
unambiguous statutory language. California maintains that the right of the states “to
legislate within their historic police power to protect consumers” requires that the
preemptive language be given a narrow reading to preempt only state consumer
reporting laws, rather than all state laws.56 It sees the language at issue as ambiguous.
It contend that even the American Bankers’ Association is not advocating a literal
reading of the plain language of the preemptive clause of the FCRA and that such a
reading would invalidate all state laws respecting information sharing, “financial or
consumer or otherwise,” among affiliated corporations.57
Regulators’ Brief, at 6.
Vermont, Arkansas, Colorado, Connecticut, Delaware, Hawaii, Illinois, Iowa, Louisiana,
Maine, Maryland, Massachusetts, Minnesota, Mississippi, Montana, Nevada, New
Hampshire, New Mexico, New York, North Dakota, Ohio, Oklahoma, Oregon, Rhode Island
Tennessee, Washington, and Wisconsin.
Brief of Appellees California Attorney General Bill Lockyer and California Insurance
Commissioner John Garamendi, American Bankers Association v. Lockyer 2 (9th Cir. No.
04-16334) (hereinafter, Brief of Appellees).
Id., at 11.
The state offers a second argument, that the FCRA preemption provision
preempts only state laws regulating consumer reporting. This draws on 1996
legislative history for support. According to California, the motivating factor and
main purpose of preempting state laws with respect to information sharing among
affiliates was to eliminate the possibility that affiliated companies would be treated
as credit reporting agencies under the FCRA and under state credit reporting laws.
The state argues that the banking associations “have not cited anything in the
legislative history of the 1996 amendments supporting their interpretation that
Congress intended the FCRA to reach beyond the scope of consumer reporting to
void state financial privacy laws like [the California law].”58
A third argument characterizes the American Bankers’ Association’s resort to
FACT Act legislative history as “muddying the waters” and “legally and logically
irrelevant in discerning the intent of Congress when it added the affiliate-sharing
preemption provision to the FCRA in 1996.”59 According to California, the FACT
Act did not alter the meaning of the preemption clause; it merely eliminated a
provision by which it was scheduled to sunset. It asks the court to refrain from
drawing any inference that California’s law was considered preempted by any failure
by Congress to enact any proposed amendments60
A final argument relies on the savings clause in GLBA’s privacy title.
According to the state, GLBA “expressly preserved the ability of the states to enact
consumer protection statutes providing greater privacy protection,” and that “[t]his
is precisely what California did.”61 The brief relies on legislative history, particularly
the statement by Senator Sarbanes , supra at 8, that was quoted in the district court’s
Analysis of the District Court’s Decision
The district court’s ruling, with its refusal to limit itself to the strict language of
the FCRA preemption clause and its narrow reading of FCRA’s potential reach and
of the legislative history of the 1996 and 2003 amendments, may have surprised
legislators, regulators, and financial services trade groups. It may have been
welcomed by consumer groups, privacy advocates, and opponents of increasing
federal power. Whether the decision is ultimately reversed or not, the ruling is
interesting because it appears to embrace a view of a provision, the temporary
enactment and permanent extension of which was hotly debated, widely discussed,
and almost universally acknowledged to be precisely what the court ruled it was not.
The reason for the disparity between the perception during the debate and the
interpretation of the court, six months later, may, therefore, provide some
Id., at 23.
Id., at 2.
Authorities cited included Solid Waste Agency v. United States Army Corp of Engineers,
531 U.S. 159 (2001) and Pension Benefit Guar. Corp. v. LTV Corp., 496 U.S. 633 (1990).
Id., at 10.
Id., at 64.
illumination to followers of the legislative process. The straight language of the
affiliate information sharing preemption was not free-standing legislation but was
surrounded by the language, structure, and purposes of the Fair Credit Reporting Act.
It was the placing of this language within the confines and constrictions of a law that
had limited purposes that was viewed by the district court as requiring a contextual
analysis rather than a limited parsing of the verbiage of the simple language of the
affiliate information sharing preemption.
Despite this fact, however, there are various issues that the district court’s
opinion raises that might lead an appellate court to reach a different conclusion.
Among them are the following:
1. Did the court do a sufficient job of analyzing what the FCRA regulates?
FCRA regulates “consumer reporting agencies,” which, by definition would likely
include financial services companies that share with their affiliates the kind of
information that is covered by the FCRA definition of “consumer report.”
Specifically, financial services companies share non-transaction and non-experience
information bearing on a consumer’s credit worthiness, which is used or expected
to be used to serve in determining eligibility for credit, insurance, employment or
other purposes covered by the FCRA.63 Such information is regulated by the FCRA
when it is disseminated among affiliated companies unless the company disclosing
such information to its affiliates provides consumers with a notice and an opt-out.
Without the notice and opt-out, the disclosure would constitute a consumer credit
report under FCRA and, thus, by inference, the disclosing company would be subject
to regulation as a credit reporting agency.
2. The court, in construing the statute, overlooked the statutory history of the
1996 amendments. While there is considerable ambiguity in this legislative history,
it may provide support for the view that Congress intended to preclude any state law
placing further limits on interaffiliate sharing of information on consumers.64
3. The court’s analysis of GLBA may be open to question. As the court, in
Bank of America, N.A. v. City of Daly City,65 recognized, most commentators have
read GLBA to be a law regulating the sharing of nonpublic personal information
about consumers by companies with non-affiliated third parties, not a general law
regulating the sharing of such information among affiliates and non-affiliated third
parties. Its only provision respecting sharing of information among affiliates is the
requirement that the institution’s policy with respect to sharing information among
affiliates be disclosed in its privacy notice. Its only specification with respect to this
notice is that the notice under the FCRA opt-out requirement be included in the
GLBA privacy notice.
15 U.S.C. § 1681a(d).
See, Seidel, supra, n.48.
Bank of America, N.A. v. City of Daly City, 279 F. Supp. 2d 1118 (N.D. Cal. 2003),
vacated as moot, 9th Cir. May 14, 2004. The district court held local ordinances invalid as
having been preempted by the FCRA language. On appeal of another issue, the decision
was vacated as moot.
4. OCC, one of the regulators charged with writing the GLBA rules, has taken
the position that “[t]he FCRA preemption provision ensures that affiliated entities
may share customer information without interference from State law and subject only
to the FCRA notice and opt-out requirements if applicable. The preemption is broad
and extends beyond state information sharing statutes to preempt any State statute
that affects the ability of an entity to share any information with its affiliates.
Congress intended the preemption provision to establish a national uniform standard
in this area ....”66
The Ninth Circuit Ruling: American Bankers Association v.
On appeal, the U.S. Court of Appeals for the Ninth Circuit reversed the district
court and held that the California law was preempted by the FCRA’s affiliateinformation-sharing provisions. The court was careful to limit its holding by
emphasizing that the preemption extended only to “information” covered by the
FCRA definition of “consumer report.”68 The court outlined FCRA as a regime
governing “consumer reporting agencies” and “consumer reports,” which exempts
from its coverage the sharing of consumer-report information among affiliated
companies under certain conditions. To reach these conclusions it set forth premises
on which its analysis of the preemptive scope of federal legislation was based: (1)
preemption depends on congressional intent; (2) in an area of traditional state
authority, such as consumer protection, congressional intent must be clear; (3)
analysis must begin with the plain statutory language, which is to be viewed within
the overall context of the regulatory scheme, interpreted as a coordinated whole.69
The court found FCRA’s preemption to cover only information within the
FCRA definition of “consumer report.” That definition extends to “information ...
bearing on a consumer’s credit worthiness, credit standing, credit capacity, character,
general reputation, personal characteristics, or mode of living which is used or
expected to be used or collected in whole or in part for the purpose of serving as a
factor in establishing the consumer’s eligibility for” certain purposes.70 It remanded
Letter from Julie L. Williams, First Senior Deputy Comptroller and Chief Counsel,
Office of the Comptroller of the Currency, to Sandra Murphy, Bowles Brice McDavid Graff
& Love (September 24, 2001), quoted in Bank of America v. City of Daly City, 279 F. Supp.
2d 1118, 1122 (N.D. Cal. 2003), vacated as moot ___ F.3d ___ (9th Cir. 2004).
412 F. 3d 1081 (9th Cir. 2005).
15 U.S.C. § 1681a(d)(1).
For this, the court relied on Food & Drug Admin. v. Brown & WilliamsonTobacco Corp.,
529 U.S. 120, 133 (2000).
15 U.S.C. § 1681a(d)(1). This specifies the following authorized purposes: “(A) credit
or insurance to be used primarily for personal, family, or household purposes; (b)
employment; or (C) any other purpose authorized under 1681b of this title.” Id. Section
1681(b) adds, among others, the following purposes, subject to certain conditions:
“determination of the consumer’s eligibility for a license or other benefit granted by a
governmental instrumentality ...”; for insurance underwriting determinations involving the
the case to the district court for a determination of whether, in light of the restricted
meaning of “information” under FCRA, any of the affiliate-information-sharing
provisions of the California law survive preemption under FCRA, and, if so, whether
such provisions could be severed so as to be enforceable.
It also ruled that the provision of GLBA purporting to preserve FCRA’s
operation,71 acted to preserve FCRA’s preemptive scope, thus, making GLBA’s antipreemption clause72 irrelevant.
District Court Ruling on Remand: American Bankers
Association v. Lockyer73
On October 4, 2005, in American Bankers Association v. Lockyer, the district
court issued an injunction against the enforcement of the affiliate information-sharing
provisions of the California legislation. It found no practicable way of distinguishing
FCRA affiliate information-sharing protected by the FACT Act preemption clause
from affiliate information-sharing which could be subjected to state law. The court
began with the premise, derived from the FCRA definition of “consumer report,”74
that FCRA covered “information” that met two standards: scope and use. For
information to be considered a “consumer report,” it must be the type of information
falling within the scope set forth in the definition of “consumer report.” It must also
meet the definition’s condition that the information be used for one of the purposes
set forth in the definition. The court found that virtually all information collected on
consumers would fall within the identified scope since it was likely to concern “credit
worthiness, credit standing, credit capacity, character, general reputation, personal
characteristics, or mode of,”75 but that only a portion of the information collected by
consumer; child support enforcement; and response to a court order or a federal grand jury
15 U.S.C. § 6806.
15 U.S.C. § 6807.
__ F.Supp. 2d ___, 2005 WL2452798 (E.D.Cal. 2005).
15 U.S.C. § 1681a(d)(1). Under this definition:
The term "consumer report" means any written, oral, or other
communication of any information by a consumer reporting agency bearing on
a consumer's credit worthiness, credit standing, credit capacity, character, general
reputation, personal characteristics, or mode of living which is used or expected
to be used or collected in whole or in part for the purpose of serving as a factor
in establishing the consumer's eligibility for-(A) credit or insurance to be used primarily for personal, family, or household
(B) employment purposes; or
(C) any other purpose authorized under section 604
“Scope” covers information that concerns a consumer’s “credit worthiness, credit
standing, credit capacity, character, general reputation, personal characteristics, or mode of
the plaintiff financial institutions fit within FCRA authorized purposes.76 The
problem, however, was that there was no way of determining in advance which
pieces of information would never be put to one of the uses or purposes covered by
the FCRA.77 The court also decided that it had no power to sever those portions of
the California statute’s affiliate information-sharing provisions that were
unconstitutional as being federally preempted from any that could survive.
California’s Attorney General, Bill Lockyer, has appealed the district court
Although no specific legislation has been introduced to address the California
situation, there have been measures to address the question of financial privacy
generally.79 There is a possibility that, since the appeals court has upheld the position
of federal regulators and financial services industry trade associations, consumer
advocates might seek legislation to overturn the decision. This could mean a replay
of the policy debates occurring prior to passage of the FACT Act. Consumer
advocates80 and state attorneys generals81 would again speak in favor of preempting
only state law that does not provide consumers the same level of protection; and
federal regulators and financial services companies would argue for the national
uniformity that federal preemptions brings.
living.” 15 U.S.C. § 1681a(d)(1).
FCRA covers “information” that is “used, expected to be used, or collected for the
purpose of establishing eligibility for credit or insurance, employment, or [other authorized
purposes]. 15 U.S.C. §1681a(d)(1).
The court stated that, “[w]hile in theory it seems financial institutions could delineate in
advance what information enjoys federal protection and which does not, in practice any such
delineation would simply be conjecture.” 2005 WL 2452798, at 3.
American Bankers Assoc. v. Lockyer, 9th Cir. No. 05-17163, appeal docketed 11/9/05).
See CRS Report RS20185, Privacy Protection for Customer Financial Information, by
M. Maureen Murphy.
See Hearings on H.R. 1622, the Fair and Accurate Credit Transactions Act before the ,
House Committee on Financial Services (July 9,2003), Testimony of Chris Hofnagle,
Deputy Counsel, Electronic Privacy Information Center and Testimony of Stephen Broback,
Education Director, Consumer Federation of America, at 4, ff. Available September 30,
2004 at [http://financialservices.house.gov/hearings.asp?formmode=detail&hearing=244].
See Hearings on Fair Credit Reporting Act: How it Functions for Consumers and the
Economy before the Subcommittee on Financial Institutions and Consumer Affairs of the
House Financial Services Committee (June 4, 2003), Testimony of Julie Brill, Assistant
Attorney General of the State of Vermont, at 16. Available September 30, 2004 at