Deluxe has recently sent out a letter regarding a new product called EZShield which provides accountholders with advancement of funds lost due to check fraud within 72 hours of a validated request. Customers receive this protection by purchasing a box of checks from Deluxe.

It sounds as though this service will automatically be implemented in May 2011 for those FIs that utilize Deluxe. Deluxe will need to share some customer information with EZShield.

Will this affect our privacy policy? Currently, we share information with Deluxe because our customers initiate the check order (which falls under the exception in 216.14). Will this exception still cover us since the customer is initiating the order?

There is a discussion in the Private Forums on this subject. IMHO they are going to violate every bank's privacy policy that they deal with.

How? Don't all privacy policies say they share for normal everday business practices and it can't be limited?

They are planning to market a product to your customers using NPI from the bank, which is not exempt from an opt-out or it has to be a financial product done under a joint marketing agreement. They are only your check printers right now, which is a service provider and exempt from opt-out.

So anymore info on this subject? I requested to be included in the private forums last week but so far no answer and I have the president wanting to know what our options are...

Thanks!

A question was raised in the private forum regarding the fact that check vendors typically advertise for checkbook covers, etc. already in the check order sent to customers. Here is my response. My best suggestion would be to ask for a copy of the check vendor's legal opinion on this and then ask your own attorney.


Interesting question and I am not sure that it has been ever thoroughly analyzed. I know I haven't really thought of it until this discussion.

The fact that banks offer customers checks for their checking accounts through a check vendor (we have been talking Deluxe, but there are others) you can easily make the argument that it would fall under the service provider exemption at 216.13.

However, I think the question is what happens after that? Can the check printer then continue to solicit business from the customer for other products? Since the check printer has the customer's account number, any future services would have to fall under the following exception:

Sec. 216.12 Limits on sharing account number information for marketing purposes.

(a) General prohibition on disclosure of account numbers. You must not, directly or through an affiliate, disclose, other than to a consumer reporting agency, an account number or similar form of access number or access code for a consumer’s credit card account, deposit account, or transaction account to any non-affiliated third party for use in telemarketing, direct mail marketing, or other marketing through electronic mail to the consumer.

(b) Exceptions. Paragraph (a) of this section does not apply if you disclose an account number or similar form of access number or access code:

(1) To your agent or service provider solely in order to perform marketing for your own products or services, as long as the agent or service provider is not authorized to directly initiate charges to the account;

I guess an argument could be made that the marketing of check book covers might be considered the marketing of the bank's own products and services. However, I believe most check printers maintain the ability to initiate the charge directly to the customer account - so the question is, how does this exemption apply to them.

In the case of this new product offered by Deluxe, which is basically an ID Theft product, I'm not sure how you could fit that into any of the exceptions unless you accomplished it through a joint marketing exception.

I have not really seen any sort of legal analysis of this situation and I think it just may have fallen under the radar all these years, but with the check printers getting into ancillary businesses, this is going to come to the forefront in a hurry.

I called our rep at Deluxe in regards to this letter and was able to opt out of the program over the phone. Our bank did not see the value in the product nor did we feel our customers would be willing to pay even more for their checks.

We just did the same. We also didn't want to begin providing an opt-out with our privacy notice.

I've received marketing flyers or stuffers from Deluxe and from Harland-Clarke, but only in the little box of checks I order through my bank. I have never received any direct mail from either vendor. Like Randy, I am puzzled by this new wrinkle from Deluxe.

I think the privacy rub was because of the non-direct relationship that the bank and EZ-Shield would have with Deluxe as an intermediary. We can all exempt deluxe or whomever based on the exceptions .13, .14, .15, but where no relationship was granted to or provided to EZ-shield directly from the bank to provide a service it triggers the need to alter your privacy policy. Same way as if you would have been approached directly by EZ-shield.

It is a bit "sneaky sneaky" if you ask me, but I imagine they figured they would get a better sales result if they sold in to their banking stream versus direct-to-consumer in the check box.

"they sold in to their banking stream versus direct-to-consumer in the check box."

Explain to me how they can sell anything directly in the check box without a privacy policy violation???

That is the point that I was really trying to make with my last analysis. I don't even think they can do that.

What I find particularly ironic with this move is that their reps go around telling banks that when confronted with a customer who points out that Deluxe checks are more expensive than those ads in magazines or in the mail, our response should be "Those other companies sell checks cheap because they make their money selling your name and address for marketing purposes and Deluxe doesn't do that."

Well....now we'd be lying wouldn't we!?

RL,

I don't see it as a violation on the banks part. I think the solicitation contained in the check box are of no consequence because they don't require any additional information from or result in an additional cost to the customer, accept when the customer actively responds to the solicitation. I think further the fact that what comes in the check box is ultimately the same service ,i.e. fun checks or a check book jacket then there is no harm or violation. Where the EZ shield stuff is a new service, albeit tied to the check, but outside the service they (the check provider) was contracted for is what makes one a violation and the other one just annoying.

Just my opinion though... I just don't see it as a violation.

From Deluxe today, upon our questions (thanks to the thread):

I would highly recommend that any bank that does not opt-out of this program ensure that the Bank's legal counsel is in full agreement that the current contract with Deluxe and thier relationship with EZShield falls squarely within the exemption provisions of the regulation.

Remember, it is the Bank that is at risk and not Deluxe for violations of the Bank's privacy policy as the Bank is fully aware that this is going on. Myself, I would be asking for a true legal analysis and not just some letter from Deluxe's sales and marketing force.

Specifically, Deluxe is marketing another third party's product, how does this fit in? How exactly is the marketing of the EZShield product the servicing or marketing of the financial institution's own product??

Section 502(b) of the GLB Act creates an exception to the opt out rules for the disclosure of information to a nonaffiliated third party for use by the third party to perform services for, or functions on behalf of, the financial institution, including the marketing of the financial institution’s own products or services or financial products or services offered pursuant to a joint agreement between two or more financial institutions.