Effective November 13, 2000, the SEC adopted Regulation S-P covering Privacy of Customer Financial Information. Regulation S-P requires that Harbor Ithaka LLC, adopt and maintain written supervisory procedures that comply with Regulation S-P and serve to protect the privacy of customer data.
Regulation S-P requires that Harbor Ithaka LLC, provide each client with a Privacy Notice. In addition, where Harbor Ithaka LLC discloses “nonpublic personal information” about clients outside of certain permitted exceptions (chiefly related to the needs of the business) Harbor Ithaka LLC must obtain the client’s prior written permission.
The regulation protects only individuals; thus, trusts, partnerships and corporations are not protected. Beneficiaries of trusts, 401(k) participants, and shareholders of corporations or partners of partnerships are not protected. IRA beneficiaries are protected since they are individuals. Institutional investors are not covered by the regulation and no disclosures are required to be made to institutional customers or consumers.
The Regulation protects “Consumers” and “Customers.” A “Consumer” gets Notice protection if Harbor Ithaka LLC starts to disclose that Consumer’s “Nonpublic Personal Information” (NPI) to “non-affiliated third parties” (NTP). A “Customer” always gets Notice protection.
“Consumer” is defined as any individual who obtains a financial product or service from Harbor Ithaka LLC for personal purposes. The Regulation clearly states that a Consumer includes any individual who provides NPI in requesting brokerage or investment advisory services. If the person is simply requesting a prospectus or brochure and has not actually applied, he/she is not a protected Consumer. Also that person is not a Consumer if his/her account is with another broker-dealer who has set up an “omnibus account” with Harbor Ithaka LLC and doesn’t routinely provide information to Harbor Ithaka LLC. Or, if that person has purchased shares in an investment company held in the name of a brokerage firm, he/she is not a Consumer of that investment company.
“Customer” is defined as a Consumer who has established a “continuing relationship” with Harbor Ithaka LLC under which Harbor Ithaka LLC provides one or more financial products or services, such as establishing a brokerage account or signing an investment advisory contract.
“Affiliate” is a term used throughout the Regulation. An “affiliate” of any person or firm is defined as an individual or entity (corporation, partnership, L.L.C., trust, or other entity, etc.) “controlled by, controlling or under common control with” the person or firm. “Control” is defined as the power to exercise a controlling influence over management or policies of another, whether by contract or otherwise. Ownership of over 25% of a company’s voting securities establishes a presumption of “control.”
The definition of “affiliate” is important because the Regulation permits sharing of information among “affiliated third parties” but restricts sharing with “non-affiliated third parties” (NTPs).
With certain exceptions set forth below, Harbor Ithaka LLC is required to protect “Nonpublic Personal Information” defined as “Personally Identifiable Financial Information” (“PIFI”) acquired from the Consumer PLUS any list, description or other grouping of Customers derived from using any PIFI. Personally Identifiable Financial Information is defined as any information provided by a Consumer to Harbor Ithaka LLC in order to obtain a financial product or service OR information about that Consumer resulting from any transaction between Harbor Ithaka LLC and that Consumer OR information otherwise obtained by Harbor Ithaka LLC in connection with providing a financial product or service to that Consumer.
In general, PIFI would include all information of a personal nature supplied on account applications, questionnaires and other information provided in order to obtain accounts, obtain credit, enter into advisory or other relationships, etc.
NPI does not include information that Harbor Ithaka LLC has taken steps to verify and reasonably believes could lawfully be obtained from federal, state or local government records, widely distributed media (telephone book, television or radio program) or disclosures to the general public required to be made by federal state or local law.
NPI that can be lawfully obtained from a website available to the general public is not protected, even though the website operator requires a fee or password.
In addition, regulation S-P protects account number information. The Regulation (with certain exceptions) prohibits Harbor Ithaka LLC under any circumstances from disclosing to any NTP other than a consumer reporting agency, a Consumer account number or similar form of access number or access code for a credit card account, deposit account or transaction account if such disclosure is for use in telemarketing, direct mail marketing or other electronic mail marketing. It is the responsibility of Harbor Ithaka LLC to obtain the assurance of every NTP in advance of disclosure that any such account information is not being used for this purpose. The exceptions are as follows: (a) where the NTP is an agent or service Adviser engaged in these activities on behalf of Harbor Ithaka LLC, as long as the agent or service Adviser has no authority to initiate any charges in the account or (b) an account number of similar form of access number or code in encrypted form as long as Harbor Ithaka LLC does not provide the recipient with the means to decrypt the number.
Regulation S-P also controls “re-disclosure and reuse.” Any NPI received by Harbor Ithaka LLC from a “non-affiliated financial institution” may not be directly or indirectly disclosed by Harbor Ithaka LLC to any NTP unless that disclosure would be lawful if made directly by the “non-affiliated financial institution” to the NTP (including disclosures allowed by the Exceptions set forth below). Similarly, the NTP may not re-disclose that information unless such re-disclosure would be lawful if made directly by Harbor Ithaka LLC.
Regulation S-P specifically requires the Privacy Notice to state that Harbor Ithaka LLC may disclose NPI about former Customers as well as current ones. The Regulation does not require that a Privacy Notice be provided to any former Customer.
HARBOR ITHAKA LLC AS A POLICY DOES NOT DISCLOSE ANY CONSUMER OR CUSTOMER NON-PUBLIC INFORMATION TO NON-RELATED THIRD PARTIES OTHER THAN IN CONTROLLED CIRCUMSTANCES AS SPECIFICALLY ALLOWED BY REGULATION S-P.
With certain exceptions, Harbor Ithaka LLC may not disclose NPI of any Consumer to any NTP without prior notice and consent by the Consumer. An NTP is any person, firm or corporation that is not controlled by, controlling or under common control with Harbor Ithaka LLC. NOTE: if any other government regulator treats Harbor Ithaka LLC as an “affiliate” of a company regulated by it, then Harbor Ithaka LLC is also an “affiliate” of that company for purposes of regulation S-P and may disclose NPI to that company.
There are Exceptions that allow Harbor Ithaka LLC to disclose Consumer NPI to persons or firms that are NTPs without prior permission. The disclosure of NPI under any of the circumstances set forth below shall only be made by Harbor Ithaka LLC after review and approval by the CCO. The exceptions are as follows:
The Regulation requires Harbor Ithaka LLC to provide an Initial Privacy Notice to (a) every Customer at all times and (b) every Consumer where Harbor Ithaka LLC intends to disclose that Consumer’s NPI to any NTP under any non-exempt circumstances. Each recipient must also have been provided with a “reasonable” time to “opt out” or not. See the Forms Section for a sample Privacy Notice.
The Initial Privacy Notice must be provided to the Customer, with certain exceptions, AT OR BEFORE the time Harbor Ithaka LLC establishes the Customer relationship and to the Consumer BEFORE Harbor Ithaka LLC makes any disclosures of that Consumer’s NPI to a NTP. The Initial Privacy Notice may be provided in written or electronic form (if the Consumer or Customer is able to acknowledge receipt electronically).
The exceptions are as follows: The Initial Privacy Notice may be provided at a “reasonable” later time where (a) the Customer relationship has been established without the Customer’s knowledge or consent; (b) where to provide the Notice would substantially delay the Customer’s transaction and the Customer has agreed to receive the Notice at a later date; or (c) where the NTP establishes an account or purchases securities on behalf of the Customer.
The regulation allows New Market Analytics LLC,, if it chooses, to make arrangements with a third party such as a broker-dealer, affiliate, service or product Adviser or other financial institution to deliver a joint notice covering NPI obtained by the Company and the other notifying entity or entities. The Notice must clearly identify the Company as one of the Notice Advisers. Also, the Notice must clearly cover the kinds of NPI possessed by the Company. New Market Analytics LLC’s CCO shall note the use of any joint notice in maintaining records of individuals that “opt out.”
In the case of joint accounts, Notices need be provided only to one account holder. Each account holder must have the right to “opt out.” Also, individuals living in the same household can receive only one Notice as long as SEC regulations allow them to receive only one prospectus or other disclosure document.
Once provided to a particular individual, the Initial Privacy Notice does not have to be provided again every time a new product or service is obtained by that individual, as long as the Initial Privacy Notice and any subsequent Annual Privacy Notices (see below) are current and accurate as to that product or service.
Harbor Ithaka LLC requires that the Initial Privacy Notice be provided in writing and acknowledged in writing by each Customer at the time the account is opened or agreement is signed and that a copy of such acknowledgment be included with the Customer’s account records. In the case of Consumers who are not Customers, Harbor Ithaka LLC follows a similar procedure specified by the designated Principal.
Harbor Ithaka LLC’s Privacy Notice advises each Customer or Consumer as to NPI that may be disclosed unless there is an objection. Included in the Privacy Notice is a place where the Customer or Consumer can object or “opt out” by notifying Harbor Ithaka LLC that he/she does not want all or part of the NPI to be disclosed.
By signing the Privacy Notice the Customer or Consumer signifies that he/she wished to “opt out” of any disclosures by Harbor Ithaka LLC of any or all categories of NPI specified in the Notice. The “opt out” is ongoing and can be changed by the Consumer or Customer at any time in writing. Where Harbor Ithaka LLC changes any NPI category, a new Notice and “opt out” option must be provided to the Customer or Consumer.
Neither a Customer nor a Consumer may “opt out” of the exceptions to NPI disclosure described above. These exceptions are noted in Harbor Ithaka LLC’s Privacy Notice.
The Privacy Notice must include the disclosure that NPI may be shared among affiliated entities, in compliance with the notice requirements of Section 603 of the Fair Credit Reporting Act, and that the Consumer may “opt out” of this sharing provision.
Harbor Ithaka LLC is required to provide an Annual Privacy Notice to each Customer every 12 months, giving that Customer an opportunity to “opt out” within a reasonable time of receiving the Notice. The Annual Privacy Notice may be delivered over Harbor Ithaka LLC’s website if the Customer agrees in advance. Once he/she ceases to be a Customer, no further Notice is required.
The Initial Privacy Notice must not only be provided to the individual, but in the case of Customers it must be furnished so that a copy can be retained or obtained at a later time, either by mailing or delivery in written form or electronically by access to a website. Harbor Ithaka LLC places a copy of the executed Notice in the Customer’s account records. Each “opt out” choice is perpetual unless affirmatively revoked by the recipient.
Where applicable, Harbor Ithaka LLC maintains records pertaining to customers’ “Privacy Choices” and records of all “opt out” choices. The record is maintained by the designated Principal. Further, Customer “opt out” choices are noted in that Customer’s account records.
Regulation S-P does not supersede, alter or affect any state law or regulation that provides protection that is greater than that created by Regulation S-P. Accordingly, Harbor Ithaka LLC should be aware of comparable provisions in states where it is doing business. Similarly, Regulation S-P does not modify, limit or supersede the Fair Credit Reporting Act (15 U.S.C. 1681), particularly Section 603 that allows companies to provide selected credit information to lenders.