Dianne Feinstein

Mrs. FEINSTEIN

Mrs. FEINSTEIN. Madam President, I have a copy of a colloquy between the leaders that we would have an up-or-down vote on the amendment.

Mrs. FEINSTEIN. I thank the Senator. I will do that.

Mrs. FEINSTEIN. Thank you very much, Mr. President. Amendment No. 2083 (Purpose: To improve the operation of energy markets)

Mrs. FEINSTEIN. Madam President, the extraordinary courtesy of the Senator is appreciated because he is actually correct. It did say ``in relation to.'' But I quickly accept his offer to have an up-or-down vote.

Mrs. FEINSTEIN. Is this meant to be an amendment to my amendment?

Mrs. FEINSTEIN. Correct.

Mrs. FEINSTEIN. Thank you. I retain the remainder of my time. I yield the floor.

Mrs. FEINSTEIN. Madam President, I would like to respond to the Senator. I think this discussion is constructive and I am pleased to partake in this exchange with my good friend from Idaho. This is a report entitled ``The Over-the-Counter Derivatives Market in the Commodity Exchange Act'' which was written by the President's working group on financial markets in 1999. On page 16 of that report, it goes on to say--and I want to read it in its context: Due to the characteristics of markets for nonfinancial commodities with finite supplies-- Which energy would be one-- the working group is unanimously recommending that the exclusion-- In other words, the loophole-- not be extended to agreements involving such commodities. For example, in the case of agricultural commodities, production is seasonal and volatile and the underlying commodity is perishable, factors that make the markets for these products susceptible to supply and pricing distortions and to manipulation. There have also been several well known efforts to manipulate the prices of certain metals by attempting to corner the cash or futures markets. Moreover, the cash market for many nonfinancial commodities is dependent on the futures market for price discovery. The CFTC, however, should retain its authority to grant exemptions for derivatives involving nonfinancial commodities as it did in 1993 for energy products, where exemptions are in the public interest and otherwise consistent with the Commodities Exchange Act. Then the loophole was promulgated. The section of the Commodities Exchange Act which contains that loophole is section 2(g) and is titled, ``Excluded Swap Transactions.'' The section reads, No provision of this Act (other than section 5a (to the extent provided in sections 5a(g)), 5b, 5d, or 12(e)(2) shall apply to or govern any agreement, contract or transaction in a commodity other than an agricultural commodity if agreement, contract or transaction is . . . And then it goes on. This section in the Commodities Exchange Act is what creates the loophole, and that is the problem that we are trying to correct in this legislation. I believe we do correct it. Again, it is very hard for me--and this might have something to do with the fact we went thorough it the west--to understand why we would not want to deter this activity and strengthen the rules to prohibit such manipulation from happening in the future. We want to be very certain that with all of this kind of trading, including over the counter trades and electronic trades, that the records are kept and there is an audit trail clearly exists and there is an opportunity for the Commodity Futures Trading Commission to note something may be wrong and hold the proper investigation. This is no more and no less than what exists on the exchange today. Why should this secret world of trading be allowed to exist? I know people get rich through it. This secret trading world allows people to get rich by engaging in fraudulent trades, as was seen during the Western energy crisis. It is this type of manipulative behavior that we are trying to stop. I can't understand why the administration would not want to support this. When Mr. Greenspan came in and talked to me a few years ago when we first proposed this legislation, his main concern was financial derivatives. This is why we made certain, as I have said in my comments, that this legislation does not concern financial derivatives. He may well have expanded his view to all kinds of over-the-counter trades since then, but at the time I sat down and met with him, that was not his position. Regardless, we are talking about public policy. We are talking about protecting the people of America. We are talking about strengthening the law so that what happened on the west coast can never happen in the Midwest or on the east coast or any part of the nation. I mentioned what the attorney general of the State of New York--the attorney general, not a deputy--Mr. Spitzer, has written. Once again, let me read what he said. He is the one who prosecutes many of these cases and I really think his views in this area should make a difference. He says: I urge your amendment's adoption. In addition to providing wholesale electricity markets, the transparency vital to effective competition, the amendment closes loopholes used to manipulate energy markets. It improves the ability to detect fraud and other manipulation, and it deters manipulation by establishing substantive penalties. This is the attorney general of the State of New York who is going to be prosecuting many of these cases. He says it is a wise thing to do, it is a prudent thing to do, and you should do it. He also says that this amendment makes a major contribution to competitive energy markets by initiating an electronic information system to be operated through the Federal Energy Regulatory Commission. I have already talked about this. Earlier, I said how this legislation will provide open access to comprehensive, timely, and reliable wholesale electricity and transmission prices. The attorney general repeats that. He says: The reliability of market information would be markedly improved by the amendment's-- Don't we want that? I think so-- general prohibition on manipulation of the purchase or sale of electricity, or the transmission services needed to deliver electricity and by the specific prohibition of the round trip trading manipulation used so effectively to inflate electricity prices to the public's injury. This is the prosecutor in one of the main States that would have this kind of litigation. Then he goes on to say: Enforcement of the law and regulation safeguarding our energy markets would be greatly aided by other reforms the amendment provides. The amendment would repeal the so-called Enron exemption which shields large energy traders from oversight. Once again, I want to iterate that this is the attorney general of New York speaking. In addition, the amendment would apply to anti-manipulation and anti-fraud provisions of the Commodity Exchange Act-- I just read to this provision to you. Clearly this section of the Act is inadequate by anybody's reading to effectively regulate all energy transactions-- Our legislation would improve the Federal Energy Regulatory Commission's ability to address complaints, and it would lift the restriction on the Federal Energy Regulatory Commission's authority to order refunds. These reforms will make accountable parties, which are currently beyond the law's reach accountable for their actions and will increase recovery of overcharges. Once again, I ask, don't we want to do this? Do we really want to protect these people who are willing to do such harmful things to the American people? I am shocked at the administration's letter. I thought they were there to protect the public. I thank the Chair. I reserve the remainder of my time.

Mrs. FEINSTEIN. Madam President, there really is a difference of opinion. I would like to have the time to read part of the transcript in a hearing on the Committee on Agriculture on July 10. A question that Senator Crapo asks to Mr. Newsome of the CFTC. Senator Crapo: I know we have been over this before but I want to be sure that I have it right. As I listened to the testimony of both of you it seems to me that there is actually a lot more agreement than disagreement with respect to what we ought to be doing and where we ought to be. The disagreement, as I understand it, is over whether 2G excludes from the fraud and manipulation provision swap transactions. Now, swap transactions are the dominant majority of what goes over the over-the-counter market. I am correct about that. Would the two of you agree that is the core of the disagreement between your testimony? Mr. Newsome: 2G certainly does exclude swap transactions. That is my point. And he is testifying to it in this committee that this is not covered by the CFTC. It goes on. Senator Crapo: It excludes them from fraud and manipulation protections. Mr. Newsome: 2G excludes them from jurisdictions of the

Mrs. FEINSTEIN. Mr. President, I would like to try to respond to some of the comments that have been made. I believe the CFTC has antifraud and antimanipulation oversight on futures exchanges but not on over-the-counter energy trades. That is the difference here. We would cover over-the-counter energy trades and particularly those trades that are electronic. I also want to show where existing law is inadequate. There is a case that has just been brought to my attention which I think shows that the existing law is inadequate, and this is what we are trying to fix. Two energy traders from the energy firms Dynegy and El Paso were charged by the U.S. Government with reporting false information on a number of trades--at least 48 trades. They falsely reported the number and the prices used in trades they conducted involving natural gas in an attempt to influence the natural gas spot price indices. The Federal indictment charged them, among other matters, with wire fraud and violation of the Commodity Exchange Act, which is what we are talking about, provisions prohibiting price manipulation and dissemination of false information about energy commodity rates. The Federal court allowed the wire fraud charges, but it dismissed the Commodity Exchange Act charges on the ground that the wording of the act failed to prohibit persons from knowingly providing false information. While the CEA used the word ``knowingly'' in an earlier part of the provision, the court ruled that the word had to be repeated in the section prohibiting false information. The Feinstein-Lugar-Levin amendment would clarify the wording of the CEA provision to resolve the problem identified by this Federal district court in the case of the United States of America v. Michelle Valencia, Criminal Action No. 8-03-024. That is a pretty clear indication of where present law is not adequate. These were bogus trades. These trades never took place. There were totally bogus, and yet the wording in the Commodity Exchange Act, which we are trying to fix, was judged by the court as too vague to take any action. Second, I want to make this point: What we are trying to do is prevent fraud and manipulation. We are trying to prevent it and deter it from happening. The soft penalties we have now don't prevent it. That should be very clear. We toughen the penalties in the Electricity Act and in the National Gas Act. Clearly, a number of these schemes that Enron practiced, whether it was Death Star, Ricochet, or Black Widow, or any of these other terrible schemes, took place. Our bill would specifically prevent them. We are trying to prevent and deter, and the way we do that is by strengthening the law. I am really puzzled by the administration's position. I am really puzzled because it seems to me they should be on the side of the American people, not on the side of the traders and those who want to get rich quick from this open marketplace. Additionally, it is interesting to me that the President's working group, when it came out in 1999, specifically said: ``Due to the characteristics of markets for nonfinancial commodities with finite supplies''--that is energy--``however, the working group is unanimously recommending that the exclusion''--the exclusion from the bill--``not be extended to agreements involving such commodities.'' So beginning in the year 2000, they have done a total switch and I do not understand why, particularly after the events of 2000 and 2001, where we know fraud and manipulation was explicit. Now when the Government tries to go after two companies for bogus trades, a court finds the Commodities Exchange Act is inadequate; it is vague. Why would people oppose what we are trying to do? I think we are on the side of the angels. Let me quickly go over some points. Why do we need this legislation? We need it because companies are now permitted to trade large amounts of energy in virtually unregulated markets, which makes it easier for unscrupulous companies such as Enron to manipulate the price of energy. The bill would close the Enron loophole that allows this unregulated trading. Secondly, do we have any examples of how these markets have been manipulated? FERC recently released a 1-inch thick report on how the markets for electricity and natural gas in the western United States were manipulated in 2000 and 2001. So we know it happened. The FERC found Enron and other companies lied about the prices of their trades, reported fictitious trades to drive up prices, did wash trades with each other, and engaged in rapid trading to drive prices up and then back down, reaping millions of dollars of profits in the process and costing customers billions of dollars in unjustified energy costs. That is according to FERC. That is a finding in their study. Yet people still oppose this legislation. Unbelievable. Would this legislation have prevented these manipulations? Under current law, the CFTC is totally in the dark about what goes on in the over-the-counter markets. Under this legislation, manipulation in these markets would be a felony and the CFTC would get reports about large trades in the over-the-counter markets, so it would be able to monitor these markets, something it cannot do now. Should anybody be able to escape from ongoing monitoring of what they do in these markets, big traders? I do not think so. Yet they are in this little loophole that was created. That was the purpose of the loophole, to prevent anybody from looking; keep no records. Therefore, they are not going to be able to catch us, and there will be a weak law so it will not be sustained in court when they try to bring a case. Another question: Enron is bankrupt. A number of traders have been fined and energy trading is back on the rise. The marketplace seems to be correcting itself. Why is this legislation needed? It is needed to avoid more problems like we have just had. Although everything mentioned in the question I just asked may be true, there is one other significant fact. The consumers and businesses that paid higher prices have only recovered a small fraction of their losses. It is better to prevent the manipulation and the losses from happening than try to make up for them after they take place. That is the point. What our agencies have shown is there is, up to this point at least, no way for an aggrieved marketplace to recover its losses from fraud and any manipulation. Therefore, it should be our job to see the laws are accurate and in place to prevent this kind of activity from taking place in the beginning. That is where increasing the penalties comes in. Imagine, a $2,000 penalty for doing this. That is nothing. That is not even a slap on the wrist for multibillion-dollar companies. How does one respond to the concerns that this legislation will increase costs and uncertainty and scare off investment in the energy markets? It will not. The regulated U.S. commodities markets are the most successful and reliable in the world. Ever since the agricultural exchanges were first regulated, we have heard dire predictions from commodities traders that regulation will drive business overseas. In fact, the opposite has happened. We have seen a flight to quality as investors seek safe and reliable markets. That is a fact. This helps the market. Many traders and energy companies have said the actual cost of compliance with this legislation will be minimal. The final question: Why should energy derivatives be regulated differently or more stringently than financial derivatives? Because we do not touch financial derivatives. Mr. Greenspan, please know that. The price of energy derivatives can be manipulated by manipulating the supply of the underlying energy commodity. The price of financial derivatives is very difficult to manipulate because it is difficult to manipulate the price of financial measures underlying the instruments, which generally are not commodities but abstract financial measures such as interest rates and currency exchange rates. Then again, in 1999, the President's working group saw this. They recommended they not put energy into the loophole. The Congress saw differently and put energy into this loophole, and the never-never land of secrecy went on. These bogus trades were enabled. These bogus trades took place. There are cases being brought, and we are even finding that the law is inadequate because a court has said it is too vague. We correct that. I think this is really an important amendment. I do not think I could live with myself if I did not try to do it. If we lose today, believe me, I will come back again and again, because we saw what happened. We know there was massive fraud and manipulation. We know the loophole was there. We know there is no transparency, no record, no audit trail, and no antifraud and antimanipulation oversight for any over-the-counter energy trade. That is what we are trying to do. My colleagues have referred to futures exchanges rather than over- the-counter energy trades, and that is what we are referring to in this bill. Please, I know back here people look at the West and they say, aha, it is not us, but what I say to them is some day it could be them. Do they not want the law right? Do they not want to be protected? Do they not want a record kept so the regulatory agency can look at it? I really hope the answer is yes, and I hope this Senate will vote for this amendment. If there are no further comments, I will yield the remainder of my time. If there are, I reserve the remainder of my time.

Mrs. FEINSTEIN. I ask unanimous consent for 1 minute to permit Senator Cantwell to speak.

Mrs. FEINSTEIN

Mrs. FEINSTEIN. I thank the Senator from Florida and I thank the Chair for allowing this opportunity for the Senator to make a statement. I think he is referring to an amendment that I will introduce at a later time having to do with clearing up the health definition in the bill. The health definition in the bill is archaic. The vast majority of states have adopted more fully inclusive definitions, and we would like to have that definition in the bill. Prior to the break for lunch, I was beginning to explain why the bill before us has a weak privacy standard on affiliate sharing. Specifically, the underlying bill permits financial institutions to share a customer's transaction and experience information with affiliates with few, if any, restrictions. As I stated, transaction and experience information could include extremely sensitive information about individuals such as their bank account balance and data mined from their check or credit accounts or where they buy goods. If consumers cannot preserve the privacy of their bank balances or the places they go to make purchases, they do not have meaningful privacy protections. That is the weak privacy standard that will become the national norm if this bill passes the way in which it is envisioned. Supporters of the existing weak standard argue that America's credit environment has thrived since 1996. So they say, why mess with a system that is working? I challenge that assertion. First, because transaction and experience information remains undefined. As I pointed out before lunch, we asked the CRS to look at current law. We asked them how they would define ``transaction and experience'' information. They said it has never been defined. So it is questionable whether any privacy regime at all exists for the bulk of affiliate-sharing practices. Secondly, identity theft has emerged as a national epidemic in the last 7 years. Both the chairman and the ranking member of this committee have done their utmost and been very receptive to trying to enact legislation to prevent identity theft. The Federal Trade Commission recently published a study that suggested 9.9 million Americans are victims of identity theft every year. The cost is $50 billion annually. Studies have shown that much identity theft occurs in the workplace. So increased affiliate sharing will likely facilitate this crime. Potentially, thousands of employees in affiliated businesses will have increased access to the currency of identity theft, and that is Social Security numbers and other sensitive identifying information, such as date and place of birth and mother's maiden name. In her testimony before the Senate Banking Committee, Vermont Assistant Attorney General Julie Brill directly linked affiliate sharing to identity theft. Here is what she said: Many identity fraud cases stem from the perpetrator's purchase of consumers' personal information from commercial data brokers. Financial institutions' information sharing practices contribute to the risk of identity theft by greatly expanding the opportunity for thieves to obtain access to sensitive personal information. So that is what we are doing here. Now, this is a prosecutor who should know. This is what she deals with. So why broaden the scope and opportunity for identity theft to take place? Assistant Attorney General Brill also cited work by researchers at Michigan State University who studied 1,000 cases of identity theft and found that 50 percent of the victims traced the theft of information to an employee of a company compiling personal data on individuals. Third, it is an open question whether affiliate sharing has offered any price or service advantage to customers. According to an article by Janet Gertz in the San Diego Law Journal, there is some evidence that businesses use affiliate sharing to extract concessions from consumers. Let me quote her: By profiling consumers, financial institutions can predict an individual's demand and price point sensitivity and thus can alter the balance of power in their price and value negotiations with that individual. Statistics indicate that the power shift facilitated by predictive profiling has proven highly profitable for the financial services industry. However, there is little evidence that any of these profits or cost savings are being passed on to consumers. Just recently, for example, the Federal Reserve issued a report on financial service fees and services showing that fees at larger institutions are generally increasing and services are decreasing. So we are letting exist this whole area where businesses buy other businesses just to share consumers' data? And the consumer has no control over their personal data. That is wrong. My colleagues may hear during the debate on this amendment that the affiliate sharing problem is addressed because S. 1753 allows consumers to opt out of certain marketing solicitations by affiliates. I want to go into this because this has been widely circulated by the financial institutions. Senator Boxer and I were just questioned about it at a press conference we held. In truth, these restrictions that they say are there are grossly inadequate, and they barely scratch the surface of the problem. Let me describe some of the uses of affiliate sharing that the bill does permit. First, internal credit reports: The bill permits companies to use transaction and experience information to create internal credit reports. Martin Wong, general counsel of Citigroup's Global Consumer Group, testified before the Senate Banking Committee in June that: Citigroup is able to use the credit information and transaction histories that we collect from affiliates to create internal credit scores and models that help determine a customer's eligibility for credit. In other words, a bank can use transaction and experience from its affiliates to determine if it is going to charge a higher interest rate to certain credit card customers and give perks to others or to deny a credit applicant a credit card. In contrast to a traditional credit card report, a consumer has no right of access to transaction and experience information used by a bank to deny him or her credit. Nor would a consumer have any right to correct any errors made in compilation of these internal credit reports. So one can have their credit changed even without their knowledge. It can be wrong, and the person would not know about it. It all happens in this secret world of affiliate sharing. Similarly, a health insurer could deny a customer a health insurance or life insurance policy based on transaction and experience information. For example, a life insurer might reject an insurance applicant because of evidence in his card or check transaction record that he visits liquor stores frequently, buys products at stores selling mountain climbing equipment and therefore is at risk of injury, or has purchased a gun. These are just indications. These are just areas. But you can see where this thing is going. Essentially, consumers can be denied products or services and they will have no ability to determine why the denial occurred. The bill would permit prospective or current employers, without an individual's knowledge or consent, to mine information about the individual from other affiliates with whom the individual does business. This could be used for hiring decisions, disciplinary action, job evaluations, or other employment purposes. Again, all of this goes on simply because you bank with a given bank. You think all these things are protected and in fact they are data-mining checks, where you go, who you are paying. This information is going out to a whole host of other companies, sometimes thousands of companies. Some affiliates are offshore and American consumer protection laws do not apply to those countries. As United States companies continue to acquire affiliates overseas, consumers may not even be able to depend on existing consumer protection laws to protect information that is shared with an affiliate. Earlier this month, and many of us read about it, a woman in Pakistan, transcribing medical files for the University of California Medical Center in San Francisco, threatened to post patient medical records on the Internet unless she was paid more money. While we have strict laws governing medical files in the United States, these laws are virtually unenforceable overseas. The Senate bill does not prevent affiliated companies from accumulating and sharing uncomplimentary information about customers, such as if they have filed for bankruptcy, do not pay their credit on time, or complain a lot. This information can be used to push unprofitable customers into a different tier of customer services. Example, where there are longer waits for a customer representative, or eliminate the customer altogether. All of this happens because of the ease with which this information can be shared among commonly held companies. Let me give an example. Business Week magazine has reported that Sanwa Bank gives A's to its best customers, but those whose profiles show they will generate less revenues get C's from the bank. The bank tends to charge those earning C's more fees, and is more likely to put them on hold when they call in for service. This type of profiling certainly can occur in the context of affiliate sharing. Even in the area of marketing, this bill is grossly inadequate. It purports to give consumers the right to opt out of the sharing of transaction and experience information for marketing, but there are loopholes. The institutions are going around the Hill today, pointing out they already do protect this. Let me talk for a minute about the loopholes. The bill excludes companies from the opt-out if they have a preexisting business relationship with the consumer. What is a preexisting business relationship? Your guess is as good as mine because the bill doesn't define it. Presumably, a bank could argue it has a preexisting relationship with a consumer if a consumer came into the bank 5 years ago to cash a check, or even just made an inquiry about an account. Additionally, if a consumer does exercise the opt-out for marketing, which is in the bill, the opt-out expires after 5 years. At that time, affiliates can then start marketing again to the customer. I find it disturbing that the supporters of the bill want to permanently preempt States from enacting stronger affiliate-sharing laws for credit reporting purposes, but only think customers' preferences should be recognized for 5 years. Last, but perhaps most fundamental, the Senate bill denies the consumer the ability to define the parameters of his or her relationship with a company, and this, I think, is really important. Under the current bill, when a consumer purchases a product from a megacorporation, the consumer automatically, without his or her choice or consent, makes his or her information available to hundreds of companies. Lawyers call this type of relationship, where one side has all the bargaining power, an adhesion contract. Some courts rule these types of contracts invalid because they do not reflect arm's-length negotiation and could result in unconscionable terms for the consumer. Our amendment is a substitute to the affiliate-sharing language in S. 1753. Supporters of the underlying bill claim the Government needs a viable national standard to ensure the efficiency of our credit market. This amendment provides such a standard. It gives consumers all across the country--in Alabama, in Maryland, in Kentucky, in Colorado, in Washington--the opportunity to have some say, some choice in how their personal data is shared. With the privacy of Americans more at risk because of the latest technological developments and identity theft, with privacy invasions at its core becoming the fastest growing white- collar crime in the United States, we believe strong national standards are critical. Our amendment reflects the terms of the California privacy law, which the California Bankers Association just a very short time ago called reasonable and workable, and are now lobbying against. I read the letter of the author of the California bill, which I think irrefutably states the turnaround the financial institutions have done in this opt-out provision. Jim Bruner of the Securities Industry Association stated at the press conference announcing the agreement on California law on August 14, just a short time ago: ``While we would have preferred a national standard,'' [the California law] ``encompasses all aspects of the workability needed to ensure protection of consumers' privacy.'' And then they turned around and did a 180. Jamie Clark of the California Bankers Association said at the same press conference that the banks: ``. . . have no objection to the measure passing'' and would tell its supporters to vote for the bill. Clark added: ``We prefer a national standard so that you have a uniform operating environment.'' But they didn't tell anyone in California, which has just passed a new law which provides opt-out, that they could not live with the opt- out standard. They did not come back here saying the law was sloppily drafted. They liked it then. When you do the law back here, all of a sudden it is sloppily drafted. Diane Colborn of the Personal Insurance Federation called the California bill ``a balanced measure that will provide meaningful privacy protections to consumers while also addressing the workability concerns that our members and customers had.'' The California credit unions supported this legislation and still do. I thank them for their support. This amendment offers businesses in California and around the country the chance to get a moderate, reasonable, uniform national standard on personal privacy. Under the amendment, companies would be required to give consumers notice of their intent to share transactions and experience and other information with their affiliates. Consumers would then have the opportunity to opt out--to say, I don't want you to do it, or to do nothing at which point the information could be shared. The company would be notified and would give them, I hope, a choice of whether their most personal information is shared among affiliates. This amendment would also allow closely related affiliates in the same line of business to share information with each other. Specifically, companies would not need to provide an opt-out choice if one, the affiliate is regulated by the same functional regulator--an example of that is institutions that regulate financial service institutions such as the Office of Thrift Supervision and the Office of the Comptroller of the Currency would be considered the same functional regulator; two, the affiliate engages in the same line of business. An example of that is the selling of securities, banking services, and insurance would all be considered independent lines of business; three, the affiliate shares a common brand identification; and four, the affiliate is a wholly owned subsidiary of the same company. The amendment also has numerous other exceptions that were ironed out after 4 years of negotiation in California to meet the practical needs of business. The exceptions include the following: No. 1, information maintained in common databases. This is another false rumor that is being spread on this bill. This amendment allows employees of an affiliate to have access to information maintained in a common information system or database so long as the information is not accessed, disclosed, or used. That is the key. It doesn't require new databases. It doesn't mess up their database. It just says you can't access it if the individual opts out. This exception is necessary because we don't want to disadvantage companies that have streamlined operations by combining databases and other information technology resources. On the other hand, this amendment still permits consumers to have a choice over whether information in the database can be used for secondary purposes. This amendment, as the Gramm-Leach-Bliley and California law, has an exception for transactional uses of information. Information sharing ``necessary to affect, administer or enforce a transaction requested or authored by the consumer'' or ``with the consent or at the direction of the consumer'' is excluded from the opt- out. Our amendment has exceptions for affiliate sharing of personal information that is necessary for companies to effectively manage their operations. For example, for security purposes, institutional risk control, and to respond to customer disputes or inquiries. Proponents for unrestricted sharing of affiliate information argue that it is needed to solve identity theft. They correctly point out that companies can track unlawful purchases or suspicious activity by monitoring unusual account activity, change of address requests, and other suspicious behavior. This amendment explicitly allows for affiliates to share information ``to protect against or prevent actual or potential fraud, identify theft,'' et cetera. In addition, the amendment has exceptions relating to a business, a merger, a sale, a transfer; to comply with Federal, State, or local laws; for outsourcing functions with vendors such as data processing or billing; and, to identify or locate missing and abducted children, witnesses, criminals and fugitives, parties to lawsuits, parents delinquent in child support payments, organ and bone marrow donors, pension fund beneficiaries, and missing heirs, or to report known or suspected instance of elder or dependent adult financial abuses; and an exception is also carved out for the United States of America PATRIOT Act. I deeply believe that without this opt-out the National Consumer Credit Reporting System Improvement Act would create a permanent and unworkable Federal standard that would set back the privacy of personal information and allow sensitive personal data to be moved through dozens, hundreds, and, in some cases, thousands of other companies. This amendment is quite simple. It is about consumer choice. I am puzzled at the ferocity with which the financial institutions and the banks are lobbying against this amendment. They serve people. That is what they are there to do--serve people. Shouldn't someone know if this information is being marketed within the loophole? Shouldn't someone have the opportunity to say, I don't want you to use my information? In fact, I think I am going to change banks, if they do this. Find a bank that won't do it. That would be my advice to everybody. I think consumers should be given the opportunity to tell a bank they don't want their information shared with other companies. This is America. We should have that freedom. We should have that right. If you vote for this amendment, Americans will. Do I have a few more minutes? If I could quickly set aside this amendment and send one other amendment to the desk, I will not speak to it. I am happy to wait. I will yield the floor at this time and do it later. Thank you very much.

Mrs. FEINSTEIN. Mr. President, the Senator from Florida has asked if I would yield for just a short time before I begin. Is that agreeable?

Mrs. FEINSTEIN. Reserving the right to object.

Mrs. FEINSTEIN. Mr. President, I ask unanimous consent that the reading of the amendment be dispensed with.

Mrs. FEINSTEIN. Mr. President, I send an amendment to the desk on behalf myself, Senator Boxer, and Senator Kennedy.

Mrs. FEINSTEIN. I believe both sides will accept the definition, and I would be happy to take a voice vote.

Mrs. FEINSTEIN. Mr. President, this amendment essentially updates the definition of ``medical information.'' It takes a medical definition submitted by the National Association of Insurance Commissioners. It is the definition that is used by a majority of our States. I ask unanimous consent that a letter in support of this definition from the American Medical Association, the American Cancer Society, the California Medical Association, the Community Clinic Consortium, the San Francisco AIDS Foundation, and the AIDS Health Care Foundation be printed in the Record.

Mrs. FEINSTEIN. No. That is all right.

Mrs. FEINSTEIN

Mrs. FEINSTEIN. I thank the Chair.

Mrs. FEINSTEIN. Mr. President, I ask unanimous consent that I might be permitted to continue when the Senate resumes.

Mrs. FEINSTEIN. Mr. President, I am not aware of a time limitation.

Mrs. FEINSTEIN. Mr. President, while I was in California, I met with the CEOs of the major banks. It became very clear to me at that time what they were going to do. They were going to come back here and they were going to get a national standard that clearly preempted the California opt-out. Incidentally, we have modified the amendment I have sent to the desk. I know there was some criticisms of the amendment. We have tightened it up. I think it will stand the test of scrutiny. This amendment protects American consumers' basic privacy rights. It creates a national opt-out standard for affiliate sharing. This would give consumers the choice of whether their personal information can be shared among unrelated companies in a corporate family of companies. Under the amendment, a company would have to notify a consumer that it intended to share the consumer's information with unrelated affiliates and give the consumer the opportunity to opt out of this sharing. If the consumer does nothing, the institution is perfectly free to share the information. This amendment is fully sensitive to the real-life demands of business. Where there is a legitimate business need for the information, this amendment provides exceptions to the opt-out. First and foremost, related affiliates--which are defined as affiliates in the same line of business with the same functional regulator and with the same brand name--are exempt from the opt-out. Second, the amendment does not affect the ability of companies to have common databases with their affiliates so long as the information is not accessed, disclosed, or used by the affiliate. This is one of the arguments they have raised that this exception is a big loophole. Answer, untrue. While a common database can exist, the amendment explicitly states that an affiliate cannot access or use the information in a manner inconsistent with the consumer's opt-out. Third, to use consumer information to complete transactions; fourth, to protect against or prevent actual or potential fraud or identity; next, to comply with Federal, State, or local laws and to do data processing, billing, or mailing. This amendment does not affect the ability of affiliated companies to do any of these six things. There are a number of other standard exceptions. Before I go into detail describing the amendment. I will spend some time talking about the shortcomings of the ``National Consumer Credit Reporting System Improvement Act'' with respect to a person's natural privacy and why this amendment is needed. At the outset, I recognize the author of the bill, Chairman Richard Shelby. He has met with me and I am grateful for that meeting. He has listened to my concerns. He has made longstanding efforts to balance the rights of individual privacy with legitimate business needs. I deeply respect the commitment of Senator Shelby to consumer privacy. It is well known. He deserves recognition for his work to strengthen the privacy provisions of the Driver's Privacy Presentation Act and for introducing legislation to require an opt-in for affiliate sharing in the 106th Congress. In the 107th Congress, he joined me as a cosponsor of the Identity Theft Prevention Act. Many of these provisions he has incorporated in the bill on the floor today, and I thank him. I also thank Senator Sarbanes. I think his record on privacy is equally impressive. He fought hard to create the opt-out standards for nonaffiliated third parties during enactment of the Gramm-Leach-Bliley financial services modernization law. I have the utmost respect for his work on privacy legislation. He is a champion of consumer privacy. The American people should know this about both of these Senators. It is just that Senator Boxer and I have a very strong view on the need to give consumers this opt-out on affiliates. I also recognize this bill has a number of provisions I strongly support. It entitles every consumer to a free credit report. That is great. It creates fraud alerts. Great. It creates a national standard for truncating credit card numbers on store receipts. That is great. I was delighted, because when I introduced identity theft legislation earlier this Congress, the chairman and CEO of Visa, Carl Pascarella, came and held a press conference and indicated that Visa was not going to wait for the bill, they were going to go ahead and truncate all but the last four digits, in any event, on their credit cards. As of June, all the new merchant terminals using the VISA system--affecting tens of millions of Visa credit cardholders--do have that truncation. Shortly, Visa will have all other stations truncating as well. This morning Senator Kyl and I held a hearing on hackers getting into data bases and how you prevent that from happening. Visa testified, and it is clear they have taken this very seriously with a very elaborate system to get at the problem and to use technology to solve it. So all these provisions were included in legislation that I have offered over the last 4 years, and I am very grateful to both the chairman and ranking member, who are here on the floor, that they have been incorporated into this bill. So I say, thank you, Senator Shelby; thank you, Senator Sarbanes. Now, I think, though, that some of these needed provisions just become window dressing, if you really can't protect a person's privacy. The affiliate sharing provisions of the legislation would set that back because the information age is going to move ahead rapidly. That is one of the problems: Technology finds a way of moving ahead so fast before we have a chance to see that there is an appropriate regulatory system in place. So the debate today over this bill is really part of a great struggle over whether Americans--ordinary Americans--will have basic control over the most elemental parts of their identity, and whether we can stop the misuse and commercialization of their most personal information. Most Americans, I believe, consider their personal information their private property. I do. I consider my health data my personal data, my financial data my personal data. When I do business with a bank, I do not expect to see my mortgages purchasable on the Internet for $15 or $20. I do not expect somebody to buy my Social Security number over the Internet, or anything of that kind. Nor do I expect the bank with which I do business to give my data to a thousand--and it can be a thousand-- of their affiliates so their affiliates can contact me about traveling with them, investing with them, that they have a better scheme than my checking account. I do not expect that, and guess what. I do not think the majority of Americans do, either. To give you a sense of the groundswell of public support for privacy, I would like to mention a survey of California voters by Fingerhut Granados Opinion Research on February 7 of this year. The statewide survey found that by a massive 91-to-7 percent margin, California voters would favor a ballot proposition--and let me quote what it would say--that ``would require a bank, a credit card company, insurance company, or other financial institution to notify a customer and receive a customer's permission before selling any financial information to any separate financial or non-financial company.'' Mr. President, 91 percent would support an initiative to do just that. So they are supporting not opt-out, which is a lower, lesser standard, but they are supporting opt-in when it comes to affiliate sharing. Similar polls across this great land have reflected a landslide of support by Americans for stronger privacy laws. In my 10 years in this Senate, I have never seen anything like it. There is a groundswell out there, let there be no doubt. Here in the Senate we have taken some strong action to protect privacy in recent months. In one day, the Senate drafted and passed a bill upholding the ``National Do Not Call'' list. Recently, we passed legislation limiting e-mail spam. In each of these cases, Congress accepted the near unanimous will of the public that there should be limits on when and how commercial entities can invade ordinary Americans' privacy--be it at their homes from telemarketing calls or on their computers from endless e-mail spam. These concerns are equally present in the debate over affiliate sharing, except the dangers to privacy are so much more insidious. Americans are fully aware of telemarketing calls because their dinners and evenings at home are interrupted by them. Americans are fully aware of spam because their e-mail is clogged with them. In the case of affiliate sharing, most Americans are not aware that their personal information travels from their bank to hundreds or even thousands of other companies. What is an affiliate and why should we be concerned about the sharing of information among affiliates? Affiliates are companies related by common ownership. As one example, Travelers Insurance, Diners Club International, Citi Financial, and Salomon Smith Barney are all affiliated companies owned by Citigroup. So the types of businesses that financial institutions can be affiliated with run the gambit: insurance companies, so you can be bugged by insurance companies; securities brokerages; mortgage lenders; travel agencies; retailers; automobile dealers; collection agencies; financial advisers; tax preparation firms. I even think they buy them just for this reason. In 1999, Congress passed the Gramm-Leach-Bliley Act, which repealed portions of the Glass-Steagall Act that prohibited banks from entering into affiliations with other lines of business. So it became fair game. These financial institutions have moved, in a major way, to affiliate themselves with a tremendous array of businesses. These include insurance and securities brokerages, as I said, mortgage lenders, ``pay day'' lenders, finance companies, and on and on and on. It could include investment advisers who are not required to register with the Securities and Exchange Commission. These are not mom-and-pop companies. The top dozen U.S. banks and financial institutions alone control thousands of health and life insurance companies, home mortgage companies, car loan lenders, housing developments, securities brokers, and other businesses. Take a look at this. Citibank alone has 1,736 affiliates which they own. They own a mortgage company, an insurance company, a student loan corporation, Travelers Life and Annuity, Diners Club International, and Salomon Smith Barney holdings. This becomes a veritable goldmine of information trading for them, and the information that is traded is your personal information that lets an insurance company, or a mortgage company, or an investment banking company know where to go to get business. Morgan Stanley has 628 affiliates, including the Discover Card, Dean Witter Realty, Southeastern Energy Corporation, and a number of insurance companies. Wells Fargo, headquartered in my city of San Francisco, has 777 affiliates, including, again, a mortgage company, Advance Mortgage, Dial Finance Company, Pacific Rim Health Care Solutions, Tower Specialists, Norwest Auto Finance, and Auto Risk Managers. Again, a veritable treasure trove, a goldmine for the sharing of private, personal information. Bank of America has 815 affiliates, including T-Oak Apartments, Stanton Road Housing, NationsBanc Insurance Agency, and General and Fidelity Life Insurance. By mining data from their affiliates, these corporations can compile vast dossiers on consumers to use to their commercial advantage. An affiliated company can call you up with full knowledge of your financial history and offer you credit cards, securities, loan consolidation, whether you need it or not, and you have no way to prevent the company from using your most intimate personal information. Consider the following case: Several years ago, Nationsbank paid fines of $7 million to the Securities and Exchange Commission and other agencies over its sharing of confidential customer financial statements and account balances with affiliated securities firms. Nationssecurities used the account information to identify those bank customers who had expiring certificates of deposit. Sales representatives then marketed to these customers highly leveraged investments, mischaracteriz- ing them as straightforward U.S. Government bond funds. Investors, 65 percent of whom were over 60 years old, lost millions of dollars from this practice. While Nationsbank paid a fine for its false and misleading sales practices, its sharing of customer information was perfectly legal under existing law. We need stronger laws to protect us from the potential predations of affiliate sharing. Unfortunately, the Senate bill does not rise to this test. The 1996 Fair Credit Reporting Act standard on affiliate sharing, which is, for the most part, preserved in S. 1753, is not a strong national standard. The 1996 act permits financial institutions to share ``transaction and experience'' information with affiliates without restrictions. This experimental standard has proven vague and unworkable. Even though the 1996 act has been in effect for 7 years, no one can definitively say what the terms ``transaction and experience'' information mean. When I asked the CRS to explain the FCRA standard, here is what they said: The [Fair Credit Reporting Act] does not offer a definition of a phrase, nor does the act provide any guidance with respect to what types of information may be included. Furthermore, none of the Federal bank regulators, nor the Federal Trade Commission, have promulgated regulations regarding the definition of ``information solely as to transactions or experiences'' or what information may be included in such. Finally, discussions with industry representatives did articulate a consistently used definition of what constitutes a ``transaction or experience'' information. In essence, both the House bill and the Senate bill maintain an exemption for the sharing of personal information, which nobody has defined. Seven years after passage of the 1996 FCRA amendments, neither Congress, nor the Federal Trade Commission, nor any other agency has defined the term. An empty standard is a nonenforceable standard. I think America's personal privacy deserves better protection. Consider again the sensitive information which could be shared among unrelated corporate affiliates if we allow the current standard to stand. This chart refers to the information I have just been over: an employee's work history, including performance ratings, sick and vacation days, safety, whether the consumer is a complainer or not, can go out to all affiliates, your certificates of deposit maturity dates, so somebody can contact you when that certificate matures; stocks you own, so others can approach you. Then there are the personal things, such as political contributions, charitable contributions, your magazine subscriptions. Think about that. These companies develop a personal profile on who you are and what you like, and then tell other companies about you. Today, I heard testimony at a Senate Judiciary Committee hearing about someone who shopped at Victoria's Secret who had their personal information used in that way. That is what this allows. The collection of this information is not hypothetical. In Great Britain, unlike the United States, companies are required by law to file a report with the Government on the type of information they collect about consumers. Here is what Citibank reported to the British Government about the type of information it was collecting about British citizens for marketing purposes. I think it is likely they collect the same information about United States customers. This information includes: personal identifiers, financial identifiers, identifiers issued by public bodies, personal details, habits, current marriage or partnerships, details of other family, household members, other social contacts, accommodations or housing, travel movement details, lifestyle, academic record, membership of professional bodies, publications, current employment, career history.

Mrs. FEINSTEIN. Mr. President, the bill before the Senate in its current form allows huge conglomerates, with just limited restrictions on marketing, to freely share vast quantities of personal customer information with commonly owned companies even if a consumer asks that the information not be shared. Let me list the types of information we believe could be shared among companies that have common ownership--called affiliates--under the bill: Information mined from your check and credit card payments such as your political or charitable contributions, your magazine subscriptions, your liquor purchases, the location and identity of stores you frequent; the stocks you own and stock trading patterns; the cash you have in the bank; when your certificates of deposit mature; how much you owe on a credit card and what rate you get; your insurance claims history such as whether you pay your premiums on time, how many claims you have made and whether claims were paid out; how many times a consumer called the company's call center or complained about the company's service; an employee's work history, including performance ratings, use of sick days, vacation, and salary. To make matters worse, the bill permanently preempts States from taking stronger action. What we have before the Senate today is a weak privacy standard built for businesses at the expense of consumers which legislatures in all 50 States are forever barred from improving. I am particularly concerned that financial institutions in California, with the lone exception of the California Credit Union, negotiated and signed off on State legislation resolving this issue, and now the same financial institutions are trying to eliminate the California law with national legislation. I will spend just a moment on that because it is important. Essentially, the banks and financial institutions in California worked with the State legislature in crafting the Californlia law that has an opt-out for affiliate sharing. The reason they did so was because waiting in the wings was a well-funded initiative to pass an even stronger privacy law. They knew the people of California would pass that privacy law. Senator Jackie Speier, who was the author of the California privacy bill, has sent Senator Boxer and I a letter. I will read two paragraphs from the letter. ``It has recently come to my attention that the financial services industry has been criticizing the contents of your amendment to S. 1753, substituting the newly-enacted and stronger California privacy standard on affiliate sharing in the `corporate family of companies,' as unworkable and unreasonable. This same industry recently called my California bill `workable and reasonable,' specifically removing their opposition to my measure and lavishing praise upon it, even helping to gather votes. Industry made it clear that my bill met their workability concerns, progress made with their active participation. If my bill was workable for industry in California, then why shouldn't it be the national standard?'' ``One industry representative stood with me on that day and said my bill `encompasses all aspects of the workability needed to ensure protection of consumers' privacy,' while another called it `a balanced measure that will provide meaningful privacy protections to consumers while also addressing the workability concerns.' . . . Now the story is different, as industry sees a political opportunity to preempt California's standard on affiliate sharing with a weaker one.'' I ask unanimous consent the entire letter be printed in the Record.

Mrs. FEINSTEIN. Mr. President, on behalf of Senator Boxer and myself, as well as Senators Harkin, Feingold, Durbin, Lautenberg, and Nelson, I send an amendment to the desk.