Federal Register, Volume 84 Issue 218 (Tuesday, November 12, 2019) 
[Federal Register Volume 84, Number 218 (Tuesday, November 12, 2019)]
[Proposed Rules]
[Pages 60963-60966]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2019-24581]

=======================================================================
———————————————————————–

COMMODITY FUTURES TRADING COMMISSION

17 CFR Part 160

RIN 3038-AE91

Privacy of Consumer Financial Information

AGENCY: Commodity Futures Trading Commission.

ACTION: Proposed rule.

———————————————————————–

SUMMARY: The Commodity Futures Trading Commission (“CFTC” or
“Commission”) is proposing to make a correction to one of the
Commission’s regulations to restore text that was inadvertently deleted
in a 2011 amendment to that regulation.

DATES: Comments must be received on or before December 12, 2019.

ADDRESSES: You may submit comments, identified by RIN 3038-AE91, by any
of the following methods:
     CFTC Comments Portal: https://comments.cftc.gov. Select
the “Submit Comments” link for this rulemaking and follow the
instructions on the Public Comment Form.
     Mail: Send to Christopher Kirkpatrick, Secretary of the
Commission, Commodity Futures Trading Commission, Three Lafayette
Center, 1155 21st Street NW, Washington, DC 20581.
     Hand Delivery/Courier: Follow the same instructions as for
Mail, above.
    Please submit your comments using only one of these methods.
Submissions through the CFTC Comments Portal are encouraged.
    All comments must be submitted in English, or if not, accompanied
by an English translation. Comments will be

[[Page 60964]]

posted as received to https://comments.cftc.gov. You should submit only
information that you wish to make available publicly. If you wish the
Commission to consider information that you believe is exempt from
disclosure under the Freedom of Information Act (“FOIA”), a petition
for confidential treatment of the exempt information may be submitted
according to the procedures established in Sec.  145.9 of the
Commission’s regulations.1
—————————————————————————

    1 17 CFR 145.9. Commission regulations referred to herein are
found at 17 CFR chapter I.
—————————————————————————

    The Commission reserves the right, but shall have no obligation, to
review, pre-screen, filter, redact, refuse or remove any or all of your
submission from https://comments.cftc.gov that it may deem to be
inappropriate for publication, such as obscene language. All
submissions that have been redacted or removed that contain comments on
the merits of the rulemaking will be retained in the public comment
file and will be considered as required under the Administrative
Procedure Act and other applicable laws, and may be accessible under
the FOIA.

FOR FURTHER INFORMATION CONTACT: Joshua Sterling, Director, (202) 418-
6056, [email protected]; Frank Fisanich, Chief Counsel, (202) 418-
5949, [email protected]; or Jacob Chachkin, Special Counsel, (202)
418-5496, [email protected], Division of Swap Dealer and Intermediary
Oversight, Commodity Futures Trading Commission, Three Lafayette
Centre, 1155 21st Street NW, Washington, DC 20581.

SUPPLEMENTARY INFORMATION:

I. Background

    Section 501 of Title V of the Gramm-Leach-Bliley Act (“Title V”)
mandates that certain agencies covered by Title V establish appropriate
safeguards for the financial institutions subject to their jurisdiction
relating to administrative, technical and physical safeguards–(1) to
insure the security and confidentiality of customer records and
information; (2) to protect against any anticipated threats or hazards
to the security or integrity of such records; and (3) to protect
against unauthorized access to or use of such records or information
which could result in substantial harm or inconvenience to any
customer.2 The Commission and entities subject to its jurisdiction
were originally excluded from Title V’s coverage.3 However, section
124 of the Commodity Futures Modernization Act of 2000 4 amended the
Commodity Exchange Act (“CEA”) to add section 5g,5 providing that
futures commission merchants (“FCMs”), commodity trading advisors
(“CTAs”), commodity pool operators (“CPOs”), and introducing
brokers (“IBs”) 6 fall under the requirements of Title V and
requiring the Commission to prescribe regulations in furtherance of
Title V. Thus, in 2001, the Commission promulgated part 160 of its
regulations to establish standards relating to Title V, and,
specifically, Sec.  160.30 in relation to section 501’s mandate.7
—————————————————————————

    2 Section 501, Subtitle A, Title V, Public Law 106-102, 113
Stat. 1338 (1999), as codified at 15 U.S.C. 6801.
    3 15 U.S.C. 6809(3)(B).
    4 Section 124, Appendix E of Public Law 106-554, 114 Stat.
2763 (2000).
    5 7 U.S.C. 7b-2.
    6 For the definitions of these intermediary categories, see
section 1a of the CEA and Sec.  1.3 of the Commission’s regulations.
7 U.S.C. 1a and 17 CFR 1.3.
    7 Privacy of Customer Information, 66 FR 21235 (April 27,
2001) (“2001 Rulemaking”). The Commission later modified its part
160 regulations to apply them to retail foreign exchange dealers
(“RFEDs”), swap dealers (“SDs”), and major swap participants
(“MSPs”). Regulation of Off-Exchange Retail Foreign Exchange
Transactions and Intermediaries, 75 FR 55409 (Sept. 10, 2010) for
RFEDs, and Privacy of Consumer Financial Information; Conforming
Amendments Under Dodd-Frank Act, 76 FR 43874 (July 22, 2011) for SDs
and MSPs (“2011 Amendment”). For the definition of RFED, see Sec. 
5.1(h). 17 CFR 5.1(h). For the definitions of SD and MSP, see
section 1a of the CEA and Sec.  1.3 of the Commission’s regulations.
7 U.S.C. 1a and 17 CFR 1.3.
—————————————————————————

    Commission regulation 160.30 implements this mandate by requiring
every FCM, RFED, CTA, CPO, IB, MSP, or SD that is subject to the
jurisdiction of the Commission (“Covered Persons”) 8 to adopt
policies and procedures to address administrative, technical and
physical safeguards for the protection of customer records and
information (the “General Requirement”).9 In addition, mirroring
section 501 of the GLB Act, the 2001 Rulemaking further required (the
“Detailed Requirements”) that the policies and procedures be
reasonably designed to: (i) Insure the security and confidentiality of
customer records and information; (ii) protect against any anticipated
threats or hazards to the security or integrity of customer records and
information; and (iii) protect against unauthorized access to or use of
customer records or information that could result in substantial harm
or inconvenience to any customer.10 However, when the 2011 Amendment
revised Sec.  160.30 to add SDs and MSPs to the list of entities in
Sec.  160.30’s introductory sentence (and, thus, subject to it), the
Detailed Requirements were inadvertently deleted.11
—————————————————————————

    8 17 CFR 160.30. Part 160 does not apply to foreign (non-
resident) FCMs, RFEDs, CTAs, CPOs, IBs, MSPs, and SDs that are not
registered with the Commission. 17 CFR 160.1. Therefore, they are
not “Covered Persons” as defined in this release.
    9 17 CFR 160.30.
    10 See 2001 Rulemaking at 21250.
    11 See 2011 Amendment at 43879. With respect to Sec.  160.30,
the preamble to the 2011 Amendment only discusses amending the
introductory sentence of Sec.  160.30 to add SDs and MSPs to the
list of CFTC registrants that must comply with that regulation. See
id. at 43876. Further, the Commission notes that the Detailed
Requirements continued to be included in Commission staff guidance
on compliance with Sec.  160.30 after the 2011 Amendment. See CFTC
Staff Advisory No. 14-21 (Feb. 26, 2014) (“Sec.  160.30
Guidance”). In addition, the Commission notes that restoring the
Detailed Requirements will make Sec.  160.30 more consistent with
similar rules adopted by the Securities and Exchange Commission
(“SEC”) and the Federal Trade Commission (“FTC”) under the GLB
Act. See 17 CFR 248.30 and 16 CFR 314.3, respectively.
—————————————————————————

II. Proposal

    The Commission is now proposing (the “Proposal”) to restore the
inadvertently deleted Detailed Requirements in Sec.  160.30 as shown in
the proposed amended rule text in this release. As discussed above, the
Detailed Requirements mirror the requirements of section 501 of the GLB
Act, pursuant to which part 160 of the Commission’s regulations was
adopted.

III. Related Matters

A. Regulatory Flexibility Act

    The Regulatory Flexibility Act 12 (“RFA”) requires federal
agencies to consider whether the rules they propose will have a
significant economic impact on a substantial number of small entities
and, if so, to provide a regulatory flexibility analysis regarding the
economic impact on those entities. The Proposal would restore the
inadvertently deleted Detailed Requirements in Sec.  160.30. To the
extent that the Proposal would impact Covered Persons that may be small
entities for purposes of the RFA,13 the Commission considered whether
the Proposal would have a significant economic impact on such Covered
Persons.
—————————————————————————

    12 5 U.S.C. 601 et seq.
    13 The Commission has previously determined that certain
entities are not “small entities” for purposes of the RFA. See,
e.g., 47 FR 18618, 18619 (Apr. 30, 1982) (registered FCMs); 75 FR
55410, 55416 (Sept. 10, 2010) (RFEDs); 77 FR 2613, 2620 (Jan. 19,
2012) (SDs and MSPs). However, the Commission has determined that
CPOs exempt pursuant to 17 CFR 4.13(a) are small entities. See 46 FR
26004 (May 8, 1981); 47 FR at 18619. The definitions of IB and CTA
are also broad enough to potentially encompass “small entities.”
See 48 FR 35248, 35276 (Aug. 3, 1983) (recognizing that the IB
definition “undoubtedly encompasses many business enterprises of
variable size”); 47 FR at 18620 (the category of CTAs is “too
broad” for a general determination regarding their small entity
status).
—————————————————————————

    In restoring the inadvertently deleted Detailed Requirements the
Proposal would simply set forth, consistent with

[[Page 60965]]

the Sec.  160.30 Guidance and the GLB Act, what is necessary to satisfy
the General Requirement that already applies to Covered Persons.
Therefore, the Commission believes that the Proposal will not have a
significant economic impact on a substantial number of small entities,
as defined in the RFA.
    Accordingly, the Chairman, on behalf of the Commission, hereby
certifies pursuant to 5 U.S.C. 605(b) that the Proposal will not have a
significant economic impact on a substantial number of small entities.
The Commission invites comment on the impact of the Proposal on small
entities.

B. Paperwork Reduction Act

    The Paperwork Reduction Act of 1995 (“PRA”) 14 imposes certain
requirements on Federal agencies, including the Commission, in
connection with their conducting or sponsoring any collection of
information, as defined by the PRA. The Commission may not conduct or
sponsor, and a person is not required to respond to, a collection of
information unless it displays a currently valid Office of Management
and Budget (“OMB”) control number.
—————————————————————————

    14 44 U.S.C. 3501 et seq.
—————————————————————————

    The Commission has previously received a control number from OMB
that includes the collection of information associated with the General
Requirement. The title for this collection of information is “Privacy
of Consumer Financial Information, OMB control number 3038-0055”.15
Collection 3038-0055 is currently in force with its control number
having been provided by OMB. Because in restoring the inadvertently
deleted Detailed Requirements, the Proposal would simply set forth what
is necessary to satisfy the General Requirement that already applies to
Covered Persons, the Commission believes that the Proposal would not
impose any new recordkeeping or information collection requirements, or
other collections of information that require approval of OMB under the
PRA.
—————————————————————————

    15 See OMB Control No. 3038-0055, http://www.reginfo.gov/public/do/PRAOMBHistory?ombControlNumber=3038-0055# (last visited
Nov. 5, 2019).
—————————————————————————

    The Commission invites the public and other Federal agencies to
comment on any aspect of the proposed information collection
requirements discussed above. Refer to the ADDRESSES section of this
notice for comment submission instructions to the Commission. A copy of
the supporting statements for the collection of information discussed
above may be obtained by visiting www.RegInfo.gov.

C. Cost-Benefit Considerations

    Section 15(a) of the CEA requires the Commission to consider the
costs and benefits of its actions before promulgating a regulation
under the CEA. Section 15(a) further specifies that the costs and
benefits shall be evaluated in light of the following five broad areas
of market and public concern: (1) Protection of market participants and
the public; (2) efficiency, competitiveness, and financial integrity of
futures markets; (3) price discovery; (4) sound risk management
practices; and (5) other public interest considerations. The Commission
considers the costs and benefits resulting from its discretionary
determinations with respect to the section 15(a) considerations.
    As discussed above, the Commission is proposing to restore the
inadvertently deleted Detailed Requirements in Sec.  160.30. Below, the
Commission discusses the costs and benefits of the Proposal.16 The
baseline against which the costs and benefits are considered is the
current status quo for Covered Persons with respect to their obligation
to satisfy the General Requirement under Sec.  160.30.17 The
Commission recognizes that there are inherent costs and benefits to
Covered Persons in providing requirements for specific customer privacy
policies and procedures, which Congress took into account in codifying
the GLB Act.
—————————————————————————

    16 The Commission endeavors to assess the expected costs and
benefits of its proposed rules in quantitative terms where possible.
Where estimation or quantification is not feasible, the Commission
provides its discussion in qualitative terms. Given a general lack
of relevant data, the Commission’s assessment is generally provided
in qualitative terms.
    17 The Commission notes that the consideration of costs and
benefits below is based on the understanding that the markets
function internationally, with many transactions involving United
States firms taking place across international boundaries; with some
Commission registrants being organized outside of the United States;
with some leading industry members typically conducting operations
both within and outside the United States; and with industry members
commonly following substantially similar business practices wherever
located. Where the Commission does not specifically refer to matters
of location, the discussion of costs and benefits below refers to
the effects of this proposal on all activity subject to the proposed
and amended regulations, whether by virtue of the activity’s
physical location in the United States or by virtue of the
activity’s connection with or effect on United States commerce under
CEA section 2(i). In particular, the Commission notes that some
Covered Persons are located outside of the United States.
—————————————————————————

    The inadvertent deletion of the Detailed Requirements in Sec. 
160.30 affected entities that were required to comply with the Detailed
Requirements prior to the 2011 Amendment as well as the two types of
entities (SDs and MSPs) the rule was being revised to include. Due to
the inadvertent nature of the deletion of the Detailed Requirements,
and that they applied prior to the 2011 Amendment, the Commission
expects the number of entities affected by the Proposal to be
negligible, if any. Consequently, to the extent the Proposal restores
the Detailed Requirements in Sec.  160.30, consistent with the Sec. 
160.30 Guidance and the GLB Act, the Proposal would not alter existing
benefits and costs. The Commission, however, recognizes that the
Proposal may benefit certain Covered Persons by, consistent with the
GLB Act, specifying what types of policies and procedures are necessary
to satisfy the General Requirement. In doing so, the Proposal may
reduce any potential confusion and allow Covered Persons to design and
maintain their policies and procedures to focus on the specified areas
mandated by the GLB Act. In this regard, the Proposal may allow Covered
Persons to more efficiently utilize their resources in developing
policies and procedures in compliance with Sec.  160.30. The Proposal
also will, consistent with the GLB Act,18 result in Sec.  160.30
being more similar to regulations adopted by the SEC and FTC pursuant
to the GLB Act and to which certain Covered Persons may be subject.19
—————————————————————————

    18 See Section 6804(a)(2) of the GLB Act. 15 U.S.C.
6804(a)(2).
    19 See n.11, supra.
—————————————————————————

    The Commission recognizes that, as a result of the Proposal,
certain Covered Persons may become subject to more specific
requirements under Sec.  160.30 than they are currently. However, given
that the General Requirement currently applies to Covered Persons, and
the Sec.  160.30 Guidance that remains in effect takes into account the
substance of the Detailed Requirements, the Commission believes that
the burden of the Proposal on Covered Persons will not be significant.
1. Section 15(a) Considerations
    In light of the foregoing, the CFTC has evaluated the costs and
benefits of the Proposal pursuant to the five considerations identified
in section 15(a) of the CEA as follows:
(1) Protection of Market Participants and the Public
    The Proposal’s restoration of the Detailed Requirements may protect
market participants and the public by ensuring that the policies and
procedures required under Sec.  160.30 are reasonably designed to
address the

[[Page 60966]]

specific areas mandated by Congress in the GLB Act.

(2) Efficiency, Competitiveness, and Financial Integrity of Markets

    The Proposal may reduce confusion and allow Covered Persons to
design and maintain their policies and procedures to focus on the
specified areas mandated by the GLB Act. This may allow Covered Persons
to more efficiently utilize their resources in developing policies and
procedures in compliance with Sec.  160.30. In addition, consistent
with the GLB Act, the Proposal will further align the consumer privacy
regulations of the Commission, FTC, and SEC, which may lower costs for
certain Covered Persons.
(3) Price Discovery
    The Commission has not identified an impact on price discovery as a
result of the Proposal.
(4) Sound Risk Management
    The Commission has not identified an impact on sound risk
management as a result of the Proposal.
(5) Other Public Interest Considerations
    Consistent with the GLB Act, the Proposal will further align the
consumer privacy regulations of the Commission, FTC, and SEC.
2. Request for Comments on Cost-Benefit Considerations
    The Commission invites public comment on its cost-benefit
considerations, including the section 15(a) factors described above.
Commenters are also invited to submit any data or other information
that they may have quantifying or qualifying the costs and benefits of
the Proposal with their comment letters.

D. Antitrust Considerations

    Section 15(b) of the CEA 20 requires the Commission to take into
consideration the public interest to be protected by the antitrust laws
and endeavor to take the least anticompetitive means of achieving the
objectives of the CEA, as well as the policies and purposes of the CEA,
in issuing any order or adopting any Commission rule or regulation
(including any exemption under section 4(c) or 4c(b)), or in requiring
or approving any bylaw, rule, or regulation of a contract market or
registered futures association established pursuant to section 17 of
the CEA.
—————————————————————————

    20 7 U.S.C. 19(b).
—————————————————————————

    The Commission believes that the public interest to be protected by
the antitrust laws is generally to protect competition. The Commission
requests comment on whether the Proposal implicates any other specific
public interest to be protected by the antitrust laws.
    The Commission has considered the Proposal to determine whether it
is anticompetitive and has preliminarily identified no anticompetitive
effects. The Commission requests comment on whether the Proposal is
anticompetitive and, if it is, what the anticompetitive effects are.
    Because the Commission has preliminarily determined that the
Proposal is not anticompetitive and has no anticompetitive effects, the
Commission has not identified any less anticompetitive means of
achieving the purposes of the CEA. The Commission requests comment on
whether there are less anticompetitive means of achieving the relevant
purposes of the CEA that would otherwise be served by adopting the
Proposal.

List of Subjects in 17 CFR Part 160

    Brokers, Consumer protection, Privacy, Reporting and recordkeeping
requirements.

    For the reasons stated in the preamble, the Commodity Futures
Trading Commission proposes to amend 17 CFR part 160 as set forth
below:

PART 160–PRIVACY OF CONSUMER FINANCIAL INFORMATION UNDER TITLE V
OF THE GRAMM-LEACH-BLILEY ACT

0
1. The authority citation for part 160 continues to read as follows:

    Authority:  7 U.S.C. 7b-2 and 12a(5); 15 U.S.C 6801, et seq.,
and sec. 1093, Pub. L. 111-203, 124 Stat. 1376.

0
2. Revise Sec.  160.30 to read as follows:

Sec.  160.30  Procedures to safeguard customer records and information.

    Every futures commission merchant, retail foreign exchange dealer,
commodity trading advisor, commodity pool operator, introducing broker,
major swap participant, and swap dealer subject to the jurisdiction of
the Commission must adopt policies and procedures that address
administrative, technical and physical safeguards for the protection of
customer records and information. These policies and procedures must be
reasonably designed to:
    (a) Insure the security and confidentiality of customer records and
information;
    (b) Protect against any anticipated threats or hazards to the
security or integrity of customer records and information; and
    (c) Protect against unauthorized access to or use of customer
records or information that could result in substantial harm or
inconvenience to any customer.

    Issued in Washington, DC, on November 6, 2019, by the
Commission.
Christopher Kirkpatrick,
Secretary of the Commission.

    Note:  The following appendix will not appear in the Code of
Federal Regulations.

Appendix to Privacy of Consumer Financial Information–Commission
Voting Summary

    On this matter, Chairman Tarbert and Commissioners Quintenz,
Behnam, Stump, and Berkovitz voted in the affirmative. No
Commissioner voted in the negative.

[FR Doc. 2019-24581 Filed 11-8-19; 8:45 am]
 BILLING CODE 6351-01-P