As financial institutions get to the specifics of drafting privacy policies, many are coming face-to-face with the fact that GLB and its various implementing regulations are not the only laws that impose obligations concerning the privacy of consumer information. Other statutes, both federal and state, also impose obligations, and these various obligations are not always consistent. Financial service providers in the throes of drafting GLB privacy policy notices need to consider the extent to which it is mandatory or advisable to address all such obligations in one notice.
Two prime examples are the Federal Fair Credit Reporting Act ("FCRA") and state statutes modeled on the 1982 NAIC Insurance Information and Privacy Protection Model Act ("Model Act"). Both have been around for a number of years. FCRA was first enacted in 1970, with substantial amendments in 1996. The Model Act was adopted in 1980 and amended in 1982, and fifteen states have enacted it. Two other states, Kansas and
