DPL RETIREMENT ADVISORS, LLC
Effective November 13, 2000, the SEC adopted Regulation S-P covering Privacy of Customer Financial Information. Regulation S-P requires that DPL Retirement Advisors, LLC adopt and maintain written supervisory procedures that comply with Regulation S-P and serve to protect the privacy of customer data.
Regulation S-P requires that DPL Retirement Advisors, LLC provide each client with a Privacy Notice. In addition, where DPL Retirement Advisors, LLC discloses “nonpublic personal information” about clients outside of certain permitted exceptions (chiefly related to the needs of the business) DPL Retirement Advisors, LLC must obtain the client’s prior written permission.
1. Who Is Protected?
The regulation protects only individuals; thus, trusts, partnerships and corporations are not protected. Beneficiaries of trusts, 401(k) participants, shareholders of corporations or partners of partnerships are not protected. IRA beneficiaries are protected since they are individuals. Institutional investors are not covered by the regulation and no disclosures are required to be made to institutional customers or consumers.
The Regulation protects “Consumers” and “Customers.” A “Consumer” gets Notice protection if DPL Retirement Advisors, LLC starts to disclose that Consumer’s “Nonpublic Personal Information” (NPI) to “non-affiliated third parties” (NTP). A “Customer” always gets Notice protection.
“Consumer” is defined as any individual who obtains a financial product or service from DPL Retirement Advisors, LLC for personal purposes. The Regulation clearly states that a Consumer includes any individual who provides NPI in requesting brokerage or investment advisory services. If the person is simply requesting a prospectus or brochure and has not actually applied, he/she is not a protected Consumer. Also that person is not a Consumer if his/her account is with another broker-dealer who has set up an “omnibus account” with DPL Retirement Advisors, LLC and doesn’t routinely provide information to DPL Retirement Advisors, LLC. Or, if that person has purchased shares in an investment company held in the name of a brokerage firm, he/she is not a Consumer of that investment company.
“Customer” is defined as a Consumer who has established a “continuing relationship” with DPL Retirement Advisors, LLC under which DPL Retirement Advisors, LLC provides one or more financial products or services, such as establishing a brokerage account or signing an investment advisory contract.
“Affiliate” is a term used throughout the Regulation. An “affiliate” of any person or firm is defined as an individual or entity (corporation, partnership, L.L.C., trust, or other entity, etc.) “controlled by, controlling or under common control with” the person or firm. “Control” is defined as the power to exercise a controlling influence over management or policies of another, whether by contract or otherwise. Ownership of over 25% of a company’s voting securities establishes a presumption of “control.”
The definition of “affiliate” is important because the Regulation permits sharing of information among “affiliated third parties” but restricts sharing with “non-affiliated third parties” (NTPs).
2. What Is Protected?
With certain exceptions set forth below, DPL Retirement Advisors, LLC is required to protect “Nonpublic Personal Information” defined as “Personally Identifiable Financial Information” (“PIFI”) acquired from the Consumer PLUS any list, description or other grouping of Customers derived from using any PIFI. Personally Identifiable Financial Information is defined as any information provided by a Consumer to DPL Retirement Advisors, LLC in order to obtain a financial product or service OR information about that Consumer resulting from any transaction between DPL Retirement Advisors, LLC and that Consumer OR information otherwise obtained by DPL Retirement Advisors, LLC in connection with providing a financial product or service to that Consumer.
In general, PIFI would include all information of a personal nature supplied on account applications, questionnaires and other information provided in order to obtain accounts, obtain credit, enter into advisory or other relationships, etc.
NPI does not include information that DPL Retirement Advisors, LLC has taken steps to verify and reasonably believes could lawfully be obtained from federal, state or local government records, widely distributed media (telephone book, television or radio program) or disclosures to the general public required to be made by federal state or local law.
NPI that can be lawfully obtained from a website available to the general public is not protected, even though the website operator requires a fee or password.
In addition, regulation S-P protects account number information. The Regulation (with certain exceptions) prohibits DPL Retirement Advisors, LLC under any circumstances from disclosing to any NTP other than a consumer reporting agency, a Consumer account number or similar form of access number or access code for a credit card account, deposit account or transaction account if such disclosure is for use in telemarketing, direct mail marketing or other electronic mail marketing. It is the responsibility of DPL Retirement Advisors, LLC to obtain the assurance of every NTP in advance of disclosure that any such account information is not being used for this purpose. The exceptions are as follows: (a) where the NTP is an agent or service Adviser engaged in these activities on behalf of DPL Retirement Advisors, LLC, as long as the agent or service Adviser has no authority to initiate any charges in the account or (b) an account number of similar form of access number or code in encrypted form as long as DPL Retirement Advisors, LLC does not provide the recipient with the means to decrypt the number.
Regulation S-P also controls “re-disclosure and reuse.” Any NPI received by DPL Retirement Advisors, LLC from a “non-affiliated financial institution” may not be directly or indirectly disclosed by DPL Retirement Advisors, LLC to any NTP unless that disclosure would be lawful if made directly by the “non-affiliated financial institution” to the NTP (including disclosures allowed by the Exceptions set forth below). Similarly, the NTP may not re-disclose that information unless such re-disclosure would be lawful if made directly by DPL Retirement Advisors, LLC.
Regulation S-P specifically requires the Privacy Notice to state that DPL Retirement Advisors, LLC may disclose NPI about former Customers as well as current ones. The Regulation does not require that a Privacy Notice be provided to any former Customer.
DPL RETIREMENT ADVISORS, LLC AS A POLICY DOES NOT DISCLOSE ANY CONSUMER OR CUSTOMER NON-PUBLIC INFORMATION TO NON-RELATED THIRD PARTIES OTHER THAN IN CONTROLLED CIRCUMSTANCES AS SPECIFICALLY ALLOWED BY REGULATION S-P.
3. How Is It Protected?
With certain exceptions, DPL Retirement Advisors, LLC may not disclose NPI of any Consumer to any NTP without prior notice and consent by the Consumer. An NTP is any person, firm or corporation that is not controlled by, controlling or under common control with DPL Retirement Advisors, LLC. NOTE: if any other government regulator treats DPL Retirement Advisors, LLC as an “affiliate” of a company regulated by it, then DPL Retirement Advisors, LLC is also an “affiliate” of that company for purposes of regulation S-P and may disclose NPI to that company.
Exceptions. There are Exceptions that allow DPL Retirement Advisors, LLC to disclose Consumer NPI to persons or firms that are NTPs without prior permission. The disclosure of NPI under any of the circumstances set forth below shall only be made by DPL Retirement Advisors, LLC after review and approval by the CCO. The exceptions are as follows:
- The NPI is necessary to service or process a transaction or a financial product or service requested or authorized by the Consumer or Customer. The NTP must be under contract with DPL Retirement Advisors, LLC designed to ensure that the NTP will (1) maintain confidentiality of the information to the same degree as DPL Retirement Advisors, LLC and (2) will use the information solely for the purposes disclosed;
- The NPI is necessary to provide some ancillary recording or reporting of the transaction, product or service, account maintenance, confirmation, accruing fees or bonuses, etc.;
- The NTP has a legal or beneficial interest relating to the Consumer or Customer or is acting in a fiduciary or representative capacity;
- The disclosure is for the purpose of protecting the confidentiality or security of DPL Retirement Advisors, LLC’s records, or to prevent potential or actual fraud, unauthorized transactions, claims or other liability, for institutional risk control or resolving customer disputes or inquiries;
- The disclosure is to provide information to insurance rate advisory organizations, guaranty funds or agencies, agencies rating DPL Retirement Advisors, LLC, assessing compliance with industry standards, attorneys, accountants and auditors of DPL Retirement Advisors, LLC;
- Subject to the Right to Financial Privacy Act, the disclosure is to a law enforcement agency, regulator, self-regulatory agency or in a public safety investigation;
- The disclosure is to a consumer reporting agency in accordance with the Fair Credit Reporting Act, or from a consumer report prepared by such an agency;
- The disclosure is in connection with a proposed sale, merger or transfer of a business unit, limited to NPI about Customers of such unit;
- The disclosure is to comply with federal, state or local laws, rules or regulations, including requirements of self-regulatory organizations or a subpoena or judicial process; or
- The NPI is provided under a contract with the NTP (a) requiring the NTP to maintain the same level of confidentiality as is required of DPL Retirement Advisors, LLC and (b) limits any exceptions to those listed above.
4. Notice Requirements
Initial Privacy Notice Requirement. The Regulation requires DPL Retirement Advisors, LLC to provide an Initial Privacy Notice to (a) every Customer at all times and (b) every Consumer where DPL Retirement Advisors, LLC intends to disclose that Consumer’s NPI to any NTP under any non-exempt circumstances. Each recipient must also have been provided with a “reasonable” time to “opt out” or not. See the Forms Section for a sample Privacy Notice.
The Initial Privacy Notice must be provided to the Customer, with certain exceptions, AT OR BEFORE the time DPL Retirement Advisors, LLC establishes the Customer relationship and to the Consumer BEFORE DPL Retirement Advisors, LLC makes any disclosures of that Consumer’s NPI to a NTP. The Initial Privacy Notice may be provided in written or electronic form (if the Consumer or Customer is able to acknowledge receipt electronically).
The exceptions are as follows: The Initial Privacy Notice may be provided at a “reasonable” later time where (a) the Customer relationship has been established without the Customer’s knowledge or consent; (b) where to provide the Notice would substantially delay the Customer’s transaction and the Customer has agreed to receive the Notice at a later date; or (c) where the NTP establishes an account or purchases securities on behalf of the Customer.
Joint Notices. The regulation allows DPL Retirement Advisors, LLC, if it chooses, to make arrangements with a third party such as a broker-dealer, affiliate, service or product Adviser or other financial institution to deliver a joint notice covering NPI obtained by the Company and the other notifying entity or entities. The Notice must clearly identify the Company as one of the Notice Advisers. Also, the Notice must clearly cover the kinds of NPI possessed by the Company. DPL Retirement Advisors, LLC’s CCO shall note the use of any joint notice in maintaining records of individuals that “opt out.”
In the case of joint accounts, Notices need be provided only to one account holder. Each account holder must have the right to “opt out.” Also, individuals living in the same household can receive only one Notice as long as SEC regulations allow them to receive only one prospectus or other disclosure document.
Once provided to a particular individual, the Initial Privacy Notice does not have to be provided again every time a new product or service is obtained by that individual, as long as the Initial Privacy Notice and any subsequent Annual Privacy Notices (see below) are current and accurate as to that product or service.
DPL Retirement Advisors, LLC requires that the Initial Privacy Notice be provided in writing and acknowledged in writing by each Customer at the time the account is opened or agreement is signed and that a copy of such acknowledgment be included with the Customer’s account records. In the case of Consumers who are not Customers, DPL Retirement Advisors, LLC follows a similar procedure specified by the designated Principal.
“Opt Out” Provision. DPL Retirement Advisors, LLC’s Privacy Notice advises each Customer or Consumer as to NPI that may be disclosed unless there is an objection. Included in the Privacy Notice is a place where the Customer or Consumer can object or “opt out” by notifying DPL Retirement Advisors, LLC that he/she does not want all or part of the NPI to be disclosed. By signing the Privacy Notice the Customer or Consumer signifies that he/she wished to “opt out” of any disclosures by DPL Retirement Advisors, LLC of any or all categories of NPI specified in the Notice. The “opt out” is ongoing and can be changed by the Consumer or Customer at any time in writing. Where DPL Retirement Advisors, LLC changes any NPI category, a new Notice and “opt out” option must be provided to the Customer or Consumer.
Neither a Customer nor a Consumer may “opt out” of the exceptions to NPI disclosure described above. These exceptions are noted in DPL Retirement Advisors, LLC’s Privacy Notice.
The Privacy Notice must include the disclosure that NPI may be shared among affiliated entities, in compliance with the notice requirements of Section 603 of the Fair Credit Reporting Act, and that the Consumer may “opt out” of this sharing provision.
Annual Privacy Notice. DPL Retirement Advisors, LLC is required to provide an Annual Privacy Notice to each Customer every 12 months, giving that Customer an opportunity to “opt out” within a reasonable time of receiving the Notice. The Annual Privacy Notice may be delivered over DPL Retirement Advisors, LLC’s website if the Customer agrees in advance. Once he/she ceases to be a Customer, no further Notice is required.
5. Books and Records Requirement
The Initial Privacy Notice must not only be provided to the individual, but in the case of Customers it must be furnished so that a copy can be retained or obtained at a later time, either by mailing or delivery in written form or electronically by access to a website. DPL Retirement Advisors, LLC places a copy of the executed Notice in the Customer’s account records. Each “opt out” choice is perpetual unless affirmatively revoked by the recipient.
Where applicable, DPL Retirement Advisors, LLC maintains records pertaining to customers’ “Privacy Choices” and records of all “opt out” choices. The record is maintained by the designated Principal. Further, Customer “opt out” choices are noted in that Customer’s account records.
6. Superceding Authorities
Regulation S-P does not supersede, alter or affect any state law or regulation that provides protection that is greater than that created by Regulation S-P. Accordingly, DPL Retirement Advisors, LLC should be aware of comparable provisions in states where it is doing business. Similarly, Regulation S-P does not modify, limit or supersede the Fair Credit Reporting Act (15 U.S.C. 1681), particularly Section 603 that allows companies to provide selected credit information to lenders.