The SEC recently adopted Regulation S-AM as mandated by the Fair and Accurate Credit Transactions Act of 2003, which requires that the SEC and certain other federal regulatory agencies adopt rules limiting affiliate marketing through the use of consumer information. Regulation S-AM prevents registered investment advisers, investment companies, broker-dealers and registered transfer agents (Covered Persons) from using certain consumer “eligibility information” provided by a Covered Person’s affiliate to market products unless there is notice to the consumer, the consumer is provided the opportunity to opt out of the use of such information for marketing purposes and the consumer does not opt out. The notice does not have to be in a specific form but it must include the name(s) of the affiliate(s) providing the disclosure, the types of eligibility information that may be used in solicitations and the length of time that the opt-out period will remain effective, which must be at least five years. The appendix to the release adopting Regulation S-AM includes model forms that will satisfy the notice and opt-out requirements.
“Eligibility information,” the use of which triggers the notice and opt-out requirements, is defined broadly and includes personally identifiable information obtained as a result of a Covered Person’s relationship with an affiliate. This includes information such as consumer addresses, account numbers, Social Security numbers and other information that, depending on the circumstances or when used in combination, could identify the individual or individuals to whom the data relates. Eligibility information does not apply to aggregate or blind data that does not contain personal identifiers. There are also limited exceptions to the notice and opt-out requirements, such as when a Covered Person has a pre-existing business relationship with a consumer or provides marketing materials in response to an unsolicited request by a consumer.
The practical effect of Regulation S-AM is that Covered Persons should include the required notice and opt-out information in their Regulation S-P privacy notices, which is permitted explicitly in the adopting release to Regulation S-AM. In addition, Covered Persons that are larger organizations with multiple affiliates are now well advised to analyze their consumer information collecting and sharing practices more carefully.
The compliance date for Regulation S-AM has been extended from January 1, 2010, to June 1, 2010. The SEC’s adopting release to Regulation S-AM is available at http://www.sec.gov/rules/final/2009/34-60423fr.pdf.