Ameriquest Mortgage Co. v. Office of the Attorney General

Annotate this Case

Download PDF

IN THE SUPREME COURT OF THE STATE OF WASHINGTON AMERIQUEST MORTGAGE COMPANY, a Delaware corporation, ) ) ) Respondent, ) ) v. ) ) WASHINGTON STATE OFFICE OF THE ) ATTORNEY GENERAL, ) ) Petitioner. ) ___________________________________ ) No. 82690-1 EN BANC Filed November 4, 2010 FAIRHURST, J. This case concerns the application of certain federal privacy laws to a request for information brought under the State s Public Records Act (PRA), chapter 42.56 RCW. The Washington State Office of the Attorney General (AGO) obtained loan files, e-mails, and other papers from Ameriquest Mortgage Company during its investigation of Ameriquest s lending practices. The AGO also generated its own documents and received other information directly Ameriquest Mortgage Co. v. Wash. State Office of the Att y Gen., No. 82690-1 from consumers who filed complaints about Ameriquest. A member of the public, Melissa A. Huelsman, invoking the PRA, asked for records from the investigation, and the AGO wants to disclose certain information, including names, addresses, phone numbers, and interest rates. Ameriquest does not object to the AGO disclosing information it received from individual consumers. Ameriquest does object to the AGO disclosing information it received from Ameriquest. The disputed issue is whether, and to what extent, the federal Gramm-Leach-Bliley Act (GLBA), 15 U.S.C. §§ 6801-6809, and the relevant Federal Trade Commission (FTC) rule, preempt the PRA or otherwise bar the AGO from disclosing information it received from Ameriquest. I. STATEMENT OF THE CASE A. Overview of the GLBA and the FTC rule In the GLBA, Congress enacted the federal policy requiring financial institutions to respect the privacy of its customers and protect the security and confidentiality of those customers nonpublic personal information. 15 U.S.C. § 6801(a). Pursuant to the rule-making authority granted in the GLBA, § 6804, the FTC adopted Privacy of Consumer Financial Information, 16 C.F.R. § 313.1 Under 1 This FTC rule has been upheld against constitutional and administrative law challenges. See Trans Union LLC v. F.T.C., 295 F.3d 42, 46 (D.C. Cir. 2002); Individual Reference Servs. Group, Inc. v. F.T.C., 145 F. Supp. 2d 6, 26, 31 (D.D.C. 2001). Since we granted review, Congress enacted the Dodd-Frank Wall Street Reform and Consumer Protection Act, Pub. L. No. -2- Ameriquest Mortgage Co. v. Wash. State Office of the Att y Gen., No. 82690-1 these federal privacy protections, a financial institution is not allowed to disclose a consumer s nonpublic personal information to a nonaffiliated third party,2 unless the consumer receives a prior notice and an opportunity to opt out. 15 U.S.C. § 6802(a)(b); 16 C.F.R. § 313.10(a)(1).3 The notice must describe the financial institution s privacy policies and practices, including the kinds of protected information that the financial institution discloses to nonaffiliated third parties. 15 U.S.C. § 6803; 16 C.F.R. § 313.6. A separate opt out notice must clearly and conspicuously describe the consumer s right to opt out of the financial institution s disclosures of protected information and must give the consumer a reasonable means to exercise that right. 15 U.S.C. § 6802(b)(1); 16 C.F.R. § 313.7(a)(1). If after giving proper notice and a reasonable opportunity to opt out, the consumer does not opt out, then the financial institution may disclose nonpublic personal information to nonaffiliated third parties. 15 U.S.C. § 6802(a)-(b); 16 C.F.R. § 313.10(a)(1). The disclosure must be consistent with the policies described in the notice. See 15 U.S.C. § 6802(a)-(b); 16 111-203, 124 Stat. 1376 (July 21, 2010), which included amendments to the GLBA. See DoddFrank Act § 1093, 124 Stat. at 2095-97. The amendments appear to take away the rule making and enforcement authority granted in 15 U.S.C. §§ 6804-6805 over mortgage lenders such as Ameriquest from the FTC, transferring it to the newly created Bureau of Consumer Financial Protection. See Dodd-Frank Act § 1093, 124 Stat. at 2095-96. However, the parties agree the FTC rule applied when the acts in question occurred. We therefore apply the FTC rule. 2 The GLBA defines nonaffiliated third party as any entity that is not an affiliate of, or related by common ownership or affiliated by corporate control with, the financial institution, but does not include a joint employee of such institution. 15 U.S.C. § 6809(5). 3 In limited circumstances not relevant here, an opportunity to opt out does not have to be given. See 15 U.S.C. § 6802(b)(2); 16 C.F.R. § 313.13. -3- Ameriquest Mortgage Co. v. Wash. State Office of the Att y Gen., No. 82690-1 C.F.R. § 313.10(a)(1). Several exceptions to the financial institution s notice and opt out obligation are set forth in § 6802(e) and 16 C.F.R. § 313.14-.15. Some of the exceptions are relevant here. The financial institution does not have to give notice if the disclosure is done with the consent or at the direction of the consumer, § 6802(e)(2); 16 C.F.R. § 313.15(a)(1); or is necessary to, among other things, comply with Federal, State, or local laws, rules, and other applicable legal requirements, § 6802(e)(8); 16 C.F.R. § 313.15(a)(7)(i); or comply with a properly authorized civil, criminal, or regulatory investigation, § 6802(e)(8); 16 C.F.R. § 313.15(a)(7)(ii). These federal restrictions also prohibit a nonaffiliated third party from reusing or redisclosing any protected information received from a financial institution. The receiving nonaffiliated third party may disclose nonpublic personal information to its affiliates and those of the financial institution. 15 U.S.C. § 6802(c); 16 C.F.R. § 313.11(c)(1)-(2), .11(d)(1)-(2). However, the receiving nonaffiliated third party may not reuse or redisclose the nonpublic personal information to another nonaffiliated third party unless an exception applies or the reuse or redisclosure would be lawful if done by the financial institution. 15 U.S.C. § 6802(c); 16 C.F.R. § 313.11(c)-(d). B. Factual and procedural history -4- Ameriquest Mortgage Co. v. Wash. State Office of the Att y Gen., No. 82690-1 The AGO accumulated thousands of pages of documents when it investigated Ameriquest s lending practices for violations of the Consumer Protection Act, chapter 19.86 RCW. Ameriquest delivered loan files, e-mails, internal customer complaint files, and other documents to the AGO. Individual customers of Ameriquest gave information to the AGO through its consumer complaint process. The AGO also developed its own documents as the investigation unfolded. None of these documents are included in the appellate record, but an Ameriquest employee, in a sworn declaration, summarized the contents of the loan files that Ameriquest gave to the AGO: [T]he loan files produced by Ameriquest to the AGO would, at minimum, include a customer s full legal name, social security number (possibly an actual copy of the social security card as well), driver s license number (possibly a copy of the actual license as well), date of birth, credit (FICO) score, credit report (which would identify mortgages and consumer credit information such as name of credit card company, amount charged, amount paid, outstanding balance, timeliness of payments), monthly income, sources of monthly income (which could include a copy of the borrower s paystub, W2, personal and business tax returns, business profit and loss statement), employer s name, employer s address, length of employment, nature of employment, name and age of any children, checking and savings account information (bank statements, deposit verification), identification of other assets (stocks, bonds, life insurance net cash value, retirement fund holdings, net worth of business), residential address, residential telephone number, personal wireless telephone number, as well as all terms and conditions of the customer s transaction (e.g., loan amount, interest rate etc.). -5- Ameriquest Mortgage Co. v. Wash. State Office of the Att y Gen., No. 82690-1 Clerk s Papers (CP) at 118. The employee also stated that the Ameriquest e-mails given to the AGO contain confidential customer information. CP at 119. On March 21, 2006, a consent decree terminating the AGO s investigation was entered in King County Superior Court. The decree included a provision relating to the PRA: If the State receives a request for documents provided by an Ameriquest Party . . . , the State shall comply with applicable public disclosure laws and promptly provide notice to the Ameriquest Parties of the request that will afford the Ameriquest Parties the reasonable opportunity to assert that the documents subject to the request are exempt from disclosure. CP at 168. Huelsman is an attorney whose practice specializes in predatory lending cases, and she has represented former customers of Ameriquest. On February 5, 2007, she gave the AGO a request for [a]ll records relating to [the] investigation of Ameriquest. CP at 132.4 In follow-up discussions with the AGO, Huelsman clarified that she wanted the borrowers names, addresses, and loan terms and costs, but not the borrowers Social Security numbers, account numbers, and the like. The AGO notified Ameriquest that it intended to comply with Huelsman s request. Ameriquest sought an injunction against the AGO. The trial court entered a temporary restraining order prohibiting the AGO s intended disclosures to 4 The public records request was filed by Christina Latta, a colleague of Huelsman s. Huelsman, Ameriquest, and the AGO treat the request as Huelsman s, and therefore so do we. -6- Ameriquest Mortgage Co. v. Wash. State Office of the Att y Gen., No. 82690-1 Huelsman. In a motion for a preliminary injunction, Ameriquest asked the court to enjoin the AGO s disclosure of five types of documents: (1) Ameriquest s customer loan files, (2) Ameriquest s internal customer complaint files, (3) Ameriquest s employee e-mails, (4) Ameriquest s trade secrets and proprietary information, and (5) the AGO s internally produced documents. Ameriquest did not object to disclosure of the AGO s consumer complaint files, as long the disclosed documents did not include information given by Ameriquest. The trial court denied Ameriquest s motion, concluding that, among other things, the GLBA does not preempt the State s law on public disclosure of documents. CP at 322. However, the court left the temporary restraining order in effect until the AGO completes a thorough redaction of exempt personal and confidential information from the records. CP at 323.5 The Court of Appeals reversed, holding that [i]f compliance with the PRA is inconsistent with the GLBA, then the GLBA preempts the PRA on this point and prohibits disclosure. Ameriquest Mortgage Co. v. Att y Gen. of Wash., 148 Wn. App. 145, 159, 199 P.3d 468 (2009). Because the AGO is a nonaffiliated third party under the GLBA and Huelsman is not an affiliate of the AGO, the Court of Appeals concluded that the GLBA applied to the AGO s proposed disclosure to Huelsman. 5 This statement about exemptions for sensitive information appears to refer to the privacy protections of the PRA, rather than the GLBA or the FTC rule. -7- Ameriquest Mortgage Co. v. Wash. State Office of the Att y Gen., No. 82690-1 Id. at 162. The Court of Appeals remanded to the trial court, concluding that [w]hat information in the loan customers files is public is a factual question that the trial court will need to address. Id. at 165. We granted the AGO s petition for review only on the issue of whether federal law preempts or precludes disclosure of information in the loan files held by the Attorney General. Wash. Supreme Court Order, Ameriquest Mortgage Co. v. Wash. State Office of the Att y Gen., No. 82690-1 (July 7, 2009). II. ANALYSIS The privacy protections in the GLBA and the FTC rule apply to any nonaffiliated third party that obtains nonpublic personal information from a financial institution. 15 U.S.C. § 6802(c); 16 C.F.R. § 313.11(c). The parties agree that Ameriquest is a financial institution and that the AGO received nonpublic personal information from Ameriquest. (Ameriquest was permitted to share this protected information with the AGO under the exception for a properly authorized civil, criminal, or regulatory investigation. 15 U.S.C. § 6802(e)(8); 16 C.F.R. § 313.15(a)(7)(ii).) The AGO does not challenge the Court of Appeals holding that the AGO is a nonaffiliated third party in this case. The AGO s concession aside, the parties arguments raise several questions. A. Do the GLBA and the FTC rule s prohibitions on redisclosure apply if the AGO s intended recipient is a member of the public? -8- Ameriquest Mortgage Co. v. Wash. State Office of the Att y Gen., No. 82690-1 When a nonaffiliated third party receives nonpublic personal information from a financial institution, it may freely disclose the information to its affiliates. 15 U.S.C. § 6802(c); 16 C.F.R. § 313.11(c)(1)-(2), .11(d)(1)-(2). The AGO argues that Huelsman, as a member of the public, is an affiliate of the AGO, and therefore the GLBA and the FTC rule permit disclosure.6 The AGO is incorrect, and we are not persuaded by its citation of Pennsylvania State University v. State Employees Retirement Board, 594 Pa. 244, 935 A.2d 530 (2007). In Pennsylvania State, the Supreme Court of Pennsylvania concluded the GLBA did not apply because Pennsylvania s government and the general public could hardly be more closely affiliated. Id. at 257. However, affiliate is a defined term, and Pennsylvania State mistakenly failed to analyze the definition. An affiliate is any company that controls, is controlled by, or is under common control with another company. 15 U.S.C. § 6809(6); 16 C.F.R. § 313.3(a) (emphasis added). A [c]ompany, in turn, is a corporation, limited liability company, business trust, general or limited partnership, association, or similar organization. 16 C.F.R. § 313.3(d), (g) (defining [c]ontrol ). Neither the AGO nor Huelsman is a company; they cannot be 6 The AGO s briefing at this court did not challenge the Court of Appeals holding on this point. But the AGO has not conceded the issue either, and it is highly relevant to the broader question of whether the GLBA and the FTC rule preempt or preclude the AGO s disclosure. We therefore decide the issue. -9- Ameriquest Mortgage Co. v. Wash. State Office of the Att y Gen., No. 82690-1 affiliates of each other. Therefore, the AGO may not freely disclose nonpublic personal information to Huelsman, unless another ground exists for doing so. B. Does the GLBA or the FTC rule permit disclosure of unprotected information after nonpublic personal information has been redacted? The AGO argues that the GLBA and the FTC rule allow it to redact any nonpublic personal information and disclose the rest. In its brief, the AGO indicates it wants to disclose names and addresses because they already were a matter of public record for the mortgages at issue. Suppl. Br. of Att y Gen. at 4 n.2. At oral argument, the AGO added that, in some instances, it also wishes to disclose phone numbers and mortgage interest rates. The AGO s arguments raise two questions: What information here constitutes nonpublic personal information? And does the GLBA or the FTC rule prohibit redactions or repackaging to yield solely public information? 1. What information here constitutes nonpublic personal information? The GLBA and the FTC rule use a relatively complex approach to defining whether information is nonpublic personal information or not. Privacy of Consumer Financial Information, 65 Fed. Reg. 33646, 33659 (May 24, 2000). There are three definitional filters through which the information must pass: (1) personally identifiable financial information, § 6809(4)(A); 16 C.F.R. § 313.3(o); - 10 - Ameriquest Mortgage Co. v. Wash. State Office of the Att y Gen., No. 82690-1 (2) publicly available information, § 6809(4)(B); 16 C.F.R. § 313.3(p)(1); and (3) list, description, or other grouping of consumers, § 6809(4)(C); 16 C.F.R. § 313.3(n)(1)(ii), (2)(ii). a. Any personally identifiable financial information? The first meaning of nonpublic personal information is personally identifiable financial information. 15 U.S.C. § 6809(4)(A); 16 C.F.R. § 313.3(n)(1)(i). Personally identifiable financial information means any information, in the context of the provision of a financial product or service, that (1) a consumer gives to a financial institution, (2) is about a consumer s transaction, or (3) a financial institution obtains from a consumer. 16 C.F.R. § 313.3(o)(1); see also 15 U.S.C. § 6809(4)(A)(i)-(iii). The FTC rule provides relevant examples of information that meets this definition. Meeting the definition are [i]nformation a consumer provides to you on an application to obtain a loan, 16 C.F.R. § 313.3(o)(2)(i)(A), [t]he fact that an individual is or has been one of your customers or has obtained a financial product or service from [a financial institution], 16 C.F.R. § 313.3(o)(2)(i)(C), and [a]ny information about [a financial institution s] consumer if it is disclosed in a manner that indicates that the individual is or has been [the financial institution s] consumer, 16 C.F.R. § 313.3(o)(2)(i)(D). See 16 C.F.R. § 313.3(h) (defining [c]ustomer ). Not meeting the definition of - 11 - Ameriquest Mortgage Co. v. Wash. State Office of the Att y Gen., No. 82690-1 [p]ersonally identifiable financial information is [i]nformation that does not identify a consumer, such as aggregate information or blind data that does not contain personal identifiers such as account numbers, names, or addresses. 16 C.F.R. § 313.3(o)(1), (2)(ii)(B). In the circumstances of this case, names, addresses, and phone numbers meet the definition of personally identifiable financial information. Not only are these bits of information personal identifiers, but also their disclosure by the AGO would reveal the fact that the individual is or has been Ameriquest s customer. See 16 C.F.R. § 313.3(o)(2)(i)(D). As noted above, the mere existence of the customer relationship is personally identifiable financial information. 16 C.F.R. § 313.3(o)(2)(i)(C). Only blind data or information stripped of personal identifiers are not protected information. 16 C.F.R. § 313.3(o)(2)(ii)(B). Notably, the definition of [p]ersonally identifiable financial information relates to information, and not to the vessel of the information (for example, a document or an e-mail). 16 C.F.R. § 313.3(o)(1). Therefore, any information meeting the definition of [p]ersonally identifiable financial information is subject to the GLBA and the FTC rule, regardless of whether the information appears in loan files, e-mails, or the AGO s internal work product. Id. If the AGO took protected information from a loan file and reproduced it elsewhere (e.g., a - 12 - Ameriquest Mortgage Co. v. Wash. State Office of the Att y Gen., No. 82690-1 memorandum listing the names of the consumers), the information does not lose its status as personally identifiable financial information. Next, the information at issue must be filtered through the definition of [p]ublicly available information. 16 C.F.R. § 313.3(p)(1). b. Any publicly available information? The AGO s primary argument is that it seeks to disclose only publicly available information. Any information that qualifies as publicly available information is exempted from the definition of nonpublic personal information, even if the information would otherwise meet the definition of personally identifiable financial information. 15 U.S.C. § 6809(4)(A); 16 C.F.R. § 313.3(n)(1), (2), (o)(1). The term [p]ublicly available information is defined as any information that you have a reasonable basis to believe is lawfully made available to the general public from: (i) Federal, State, or local government records; (ii) Widely distributed media; or (iii) Disclosures to the general public that are required to be made by Federal, State, or local law. 16 C.F.R. § 313.3(p)(1) (emphasis added).7 And widely distributed media includes information from a telephone book . . . or a [website] that is available to the general public on an unrestricted basis. 16 C.F.R. § 313.3(p)(3)(ii). 7 Because much of the The GLBA does not offer its own definition, leaving it to agency rule making to define the term. See 15 U.S.C. § 6809(4)(B). - 13 - Ameriquest Mortgage Co. v. Wash. State Office of the Att y Gen., No. 82690-1 information here is available through the telephone book, web sites, and recorded mortgage filings, the AGO argues that the names and addresses culled from the disputed records, as well as phone numbers and mortgage interest rates in some cases, meet the definition of publicly available information. This information would therefore be exempted from the definition of nonpublic personal information, and the federal restrictions would not apply. We reject the AGO s position. The key is the FTC rule s use of the word you in the definitions of [p]ublicly available information and [r]easonable basis. 16 C.F.R. § 313.3(p)(1), (2). The term [y]ou means each financial institution . . . over which the [FTC] has enforcement jurisdiction pursuant to [the GLBA]. 16 C.F.R. § 313.3(q). This definition expressly excludes any other person, id., which, in turn, is defined as third parties that are not financial institutions, but that receive nonpublic personal information from financial institutions with whom they are not affiliated, 16 C.F.R. § 313.1(b). Ameriquest is a you, and the AGO is an other person. Only a you --a financial institution--can form the reasonable basis to believe information is publicly available. For example, as to names, addresses, and loan information, the FTC rule says, You have a reasonable basis to believe that mortgage information is lawfully - 14 - Ameriquest Mortgage Co. v. Wash. State Office of the Att y Gen., No. 82690-1 made available to the general public if you have determined that the information is of the type included on the public record in the jurisdiction where the mortgage would be recorded. 16 C.F.R. § 313.3(p)(3)(iii)(A) (emphasis added). An other person like the AGO may not make this determination. As to phone numbers, the FTC rule says, You have a reasonable basis to believe that an individual s telephone number is lawfully made available to the general public if you have located the telephone number in the telephone book or the consumer has informed you that the telephone number is not unlisted. 16 C.F.R. § 313.3(p)(3)(iii)(B). Simply put, only a financial institution can form the reasonable basis necessary to think that information is publicly available. The FTC s Final Rule statement does not say why it chose this definitional route. See Privacy of Consumer Financial Information, 65 Fed. Reg. 33646. But its choice is consistent with the overall thrust of the federal regulations. The financial institution is allowed to scrutinize a consumer s information for what is publicly available and what is not because the financial institution already has the information, the consumer has consented to the situation, and the financial institution has a business incentive to respect its customers and be careful with their privacy. However, the vetting itself is an intrusion into a consumer s privacy. If a third party holding protected information were allowed to see whether some of the - 15 - Ameriquest Mortgage Co. v. Wash. State Office of the Att y Gen., No. 82690-1 information is publicly available, the third party would have greater reason to rummage through the consumer s information. This would conflict with the carefully drawn limits on a third party s use and redisclosure of the protected information. See 15 U.S.C. § 6802(c); 16 C.F.R. § 313.10(a)(1), .11(c)-(d). Additionally, because a different set of laws might apply to third parties, more information could be inadvertently treated as public. For instance, under the AGO s interpretation, all of the information it controls would be publicly available because PRA requests are [d]isclosures to the general public that are required to be made by Federal, State, or local law. 16 C.F.R. § 313.3(p)(1)(iii). In sum, any information that meets the definition of nonpublic personal information cannot be recast as exempt publicly available information by the AGO. Only Ameriquest can form the reasonable basis to color the information that way, and nothing suggests that Ameriquest has taken the necessary steps. c. Any list or grouping of consumers constituting nonpublic personal information? Information included in a list, description, or other grouping of consumers is automatically protected if it is derived using any nonpublic personal information. 15 U.S.C. § 6809(4)(C)(i); 16 C.F.R. § 313.3(n)(1)(ii). Even if some publicly available information is included in such a grouping, all of the information - 16 - Ameriquest Mortgage Co. v. Wash. State Office of the Att y Gen., No. 82690-1 in the list or grouping is deemed nonpublic personal information. 15 U.S.C. § 6809(4)(C); 16 C.F.R. § 313.3(n)(2)(i). Here, any list, description, or other grouping included in the records at issue are nonpublic personal information, because the AGO necessarily must derive the grouping using personally identifiable financial information, such as the fact that the consumer is or was an Ameriquest customer. To summarize our conclusions thus far, the only disputed information that is not subject to the federal nondisclosure rules is [i]nformation that does not identify a consumer, such as aggregate information or blind data that does not contain personal identifiers such as account numbers, names, or addresses. 16 C.F.R. § 313.3(o)(2)(ii)(B). - 17 - Ameriquest Mortgage Co. v. Wash. State Office of the Att y Gen., No. 82690-1 2. Does the GLBA or the FTC rule prohibit redactions or repackaging to yield solely public information? The FTC rule tightly restricts what a nonaffiliated third party may do with the protected information that it receives. The third party may disclose and use the protected information only in the ordinary course of business to carry out the activity covered by the exception under which it received the information. 16 C.F.R. § 313.11(c)(3). This use restriction recognizes that consumers have a privacy interest in the initial use of their nonpublic personal information for the creation of aggregate data. Individual Reference Servs. Group, Inc. v. F.T.C., 145 F. Supp. 2d 6, 38 (D.D.C. 2001). Here, the exception under which the AGO received the information from Ameriquest was the exception for a government investigation. 15 U.S.C. § 6802(e)(8); 16 C.F.R. § 313.15(a)(7)(ii). Public disclosures are not an ordinary part of an investigation. Thus, the AGO is not permitted to use any nonpublic personal information for purposes of public disclosure. We think use includes redactions and repackaging of information because the AGO is required to leave the information--and the consumer s privacy -undisturbed unless the AGO needs to use it in the ordinary course of business to carry out the investigation. Chao v. Community Trust Co., 474 F.3d 75 (3d Cir. 2007), which - 18 - Ameriquest Mortgage Co. v. Wash. State Office of the Att y Gen., No. 82690-1 contemplated redactions under the GLBA, is not on point. The Third Circuit reasoned that disclosures were permitted under the GLBA after redactions because there would not be a release of personal financial information. Id. at 87 n.6. However, the issue was a financial institution s disclosure of information to a nonaffiliated third party, not the use or redisclosure of that information by the third party. See id. at 84. As we have discussed, the use restriction of 16 C.F.R. § 313.11(c) imposes tight restrictions on what third parties can do with the protected information they receive. The financial institution might use protected information for redaction and repackaging, but the third party may not. To be sure, blind data and identifier-free information may be disclosed because it is not protected information. 16 C.F.R. § 313.3(o)(2)(ii)(B). If some of the records here already contain information in that permissible form (for example, a memorandum analyzing the interest rates given to certain income groups, with no names or addresses included), then the AGO may disclose it, because no additional use of protected information is necessary. Thus, the AGO may disclose blind data and identifier-free information if it has already been created. C. Do any exceptions to the GLBA or the FTC rule apply? The AGO s fallback position is the exceptions enumerated in § 6802(e) and 16 C.F.R. § 313.15. Because the language of the GLBA and the FTC differ - 19 - Ameriquest Mortgage Co. v. Wash. State Office of the Att y Gen., No. 82690-1 somewhat, we address each in turn. - 20 - Ameriquest Mortgage Co. v. Wash. State Office of the Att y Gen., No. 82690-1 1. The GLBA exceptions The GLBA prohibits nonaffiliated third parties from redisclosing nonpublic personal information [e]xcept as otherwise provided. 15 U.S.C. § 6802(c). Relying on this language, the AGO argues that it can disclose nonpublic personal information pursuant to the GLBA exception for disclosures necessary to comply with Federal, State, or local laws. 15 U.S.C. § 6802(e)(8). Because the PRA is a State . . . law, the AGO claims it may disclose to comply. Id. We disagree. The AGO cites the statute out of context. To understand the meaning of the exception in § 6802(e)(8), one has to read it together with the introduction to subsection (e) this way: Subsections (a) and (b) of this section shall not prohibit the disclosure of nonpublic personal information . . . to comply with Federal, State, or local laws. 15 U.S.C. § 6802(e). And subsections (a) and (b), in turn, are the notice and opt-out requirements imposed on financial institutions. 15 U.S.C. § 6802(a)-(b). Therefore, the exceptions enumerated in § 6802(e) are not general exceptions available to whoever holds protected information. Rather, the exceptions describe the limited circumstances under which a financial institution may bypass the notice and opt-out provisions. Thus, the § 6802(e) exceptions do not give nonaffiliated third parties an unrestricted escape - 21 - Ameriquest Mortgage Co. v. Wash. State Office of the Att y Gen., No. 82690-1 hatch from the nondisclosure rule of § 6802(c). The AGO may invoke an exception under § 6802(e) only if Ameriquest could. Section 6802(c) allows the AGO s disclosure if such disclosure would be lawful if made directly to such other person by the financial institution. By the terms of § 6802(c), the lawfulness of the disclosure is measured as if the financial institution were standing in the shoes of the nonaffiliated party. See Marks v. Global Mortgage Group, Inc., 218 F.R.D. 492, 496 (S.D. W. Va. 2003) ( The language in § 6802(e)(8) permitting disclosure to comply with Federal, State, or local laws, rules, and other applicable legal requirements refers to the numerous federal and state statutes, rules, and legal requirements that regulate the financial industry. ). Ameriquest could not disclose directly to Huelsman in order to comply with Federal, State, or local laws, § 6802(e), because the PRA applies only to state agencies, RCW 42.56.010(1), .070(1). Thus, the AGO may not invoke this exception.8 The AGO could plausibly argue that Ameriquest, and therefore it, could disclose to Huelsman after obtaining the consumers prior consent. 15 U.S.C. § 6802(e)(2). However, the FTC rule forecloses it. 8 The Court of Appeals held that the exception for disclosures to respond to judicial process, § 6802(e)(8), does not apply. Ameriquest, 148 Wn. App. at 165. The AGO does not challenge this holding, and we agree with the Court of Appeals that a public records request is not a judicial process. 15 U.S.C. § 6802(e)(8). - 22 - Ameriquest Mortgage Co. v. Wash. State Office of the Att y Gen., No. 82690-1 2. The FTC rule exceptions The AGO argues that the FTC rule broadens its access to the § 6802(e) exceptions. The AGO is incorrect; the FTC rule actually limits its access. The FTC s Final Rule says the third party may also disclose and use the information pursuant to one of the section [(§ 6802(e))] exceptions as noted in the rule. Privacy of Consumer Financial Information, 65 Fed. Reg. at 33667 (emphasis added). The § 6802(e) exceptions are contained in 16 C.F.R. § 313.15, including the familiar exceptions of prior consent, 16 C.F.R. § 313.15(a)(1), and [t]o comply with Federal, State, or local laws, 16 C.F.R. § 313.15(a)(7)(i). However, as with the GLBA, these are exceptions to the financial institution s duty to give notice and an opportunity to opt out, 16 C.F.R. § 313.15(a), and so the third party may invoke them only if the financial institution could. The FTC rule includes an additional limitation on a third party s access to the exceptions. It provides that, when a third party receives the protected information under an exception, the third party may subsequently invoke an exception to redisclose the information only in the ordinary course of business to carry out the activity covered by the exception under which it received the information. 16 C.F.R. § 313.11(c)(3). (This is the same part of the rule that limits a third party s - 23 - Ameriquest Mortgage Co. v. Wash. State Office of the Att y Gen., No. 82690-1 use of protected information, as discussed above.) Thus, not only must the redisclosure be adjudged as if the financial institution were making it, but also the redisclosure is lawful only if done in the ordinary course of the third party s reason for possessing the information. Here, the PRA does not apply to Ameriquest, and so the AGO may not disclose pursuant to 16 C.F.R. § 313.15(a)(7)(i). Further, although Ameriquest could disclose with the consumers consent, the AGO may not, because doing so would not be in the ordinary course of the AGO s investigation. Thus, these exceptions to the FTC rule do not apply here. D. Do the GLBA and the FTC rule preempt the PRA? By force of the supremacy clause of the United States Constitution, federal law can preempt state law. Wash. State Physicians Ins. Exch. & Ass n v. Fisons Corp., 122 Wn.2d 299, 326, 858 P.2d 1054 (1993). Preemption principles apply equally when the federal law is a regulation promulgated by a federal agency rather than a statute passed by Congress. Fid. Fed. Sav. & Loan Ass n v. de la Cuesta, 458 U.S. 141, 153-54, 102 S. Ct. 3014, 73 L. Ed. 2d 664 (1982). Ameriquest argues that the PRA s disclosure rules are preempted so completely that none of the information that Ameriquest gave to the AGO may be disclosed. Ameriquest is incorrect. Because there is no inconsistency with these federal laws and the PRA, there - 24 - Ameriquest Mortgage Co. v. Wash. State Office of the Att y Gen., No. 82690-1 is no preemption. Both the GLBA and the FTC rule provide that they are to be construed as superseding, altering, or affecting a state law only to the extent of [an] inconsistency. 15 U.S.C. § 6807(a); 16 C.F.R. § 313.17(a). Although the PRA requires state agencies to make available for public inspection and copying all public records, the PRA provides an exemption to this disclosure requirement if there is any other statute which exempts or prohibits disclosure of specific information or records. RCW 42.56.070(1). This other statute exemption avoids any inconsistency and allows the federal regulation s privacy protections to supplement the PRA s exemptions. We have held numerous other state statutes disclosure prohibitions are thus incorporated into the PRA. See Hangartner v. City of Seattle, 151 Wn.2d 439, 453, 90 P.3d 26 (2004) (RCW 5.60.060(2)(a)); Progressive Animal Welfare Society v. Univ. of Wash., 125 Wn.2d 243, 261-63, 884 P.2d 592 (1994) (Ch. 19.108 RCW; RCW 4.24.580). We see no reason why federal law should be treated differently. We conclude that the GLBA (together with the FTC rule enforcing it) is an other statute. RCW 42.56.070(1). We recognize the PRA s rule of construction, which dictates that [i]n the event of conflict between the provisions of [the PRA] and any other act, the provisions of this chapter shall govern. RCW 42.56.030. The only potential source of conflict that would call for a preemption analysis is the PRA s redaction - 25 - Ameriquest Mortgage Co. v. Wash. State Office of the Att y Gen., No. 82690-1 requirement. The PRA requires redactions and disclosure of the rest of the record, to the extent that exempted information . . . can be deleted from the specific records sought. RCW 42.56.210. We see no conflict. While the GLBA and the FTC prohibit the AGO s redactions or repackaging of information, the PRA s redaction requirement applies only where information . . . can be deleted. Id. Further, the PRA s other statute exemption allows for a separate statute to preclude disclosure of specific information or entire records. RCW 42.56.070(1). Thus, the PRA makes room for an other statute that expressly prohibits redactions or disclosures of entire records. As we have discussed, however, the GLBA and the FTC prohibit specific information, not entire records. These federal regulations are unconcerned with the containers in which the information is found. Thus, to the extent that a record contains unprotected information, the disclosure of which would not violate the GLBA or the FTC rule, the PRA is not preempted in requiring the record s disclosure. III. CONCLUSION For the foregoing reasons, we affirm on different grounds the Court of Appeals holding that federal privacy laws apply to the disputed information in this case. To summarize our conclusions, the restrictions of the GLBA and the FTC - 26 - Ameriquest Mortgage Co. v. Wash. State Office of the Att y Gen., No. 82690-1 apply to the AGO s disclosures of nonpublic personal information to Huelsman. Any information meeting the definition of personally identifiable financial information is nonpublic personal information that may not be disclosed, regardless of whether the information appears in loan files, e-mails, or the AGO s internal work product. Under the circumstances of this case, names, addresses, and phone numbers meet the definition of personally identifiable financial information. Not only are these bits of information personal identifiers, but also their disclosure by the AGO would impermissibly reveal the fact that the individual is or has been Ameriquest s customer. Any information that meets the definition of nonpublic personal information cannot be recast as publicly available information by the AGO. The only disputed information that is not subject to the federal nondisclosure rule is [i]nformation that does not identify a consumer, such as aggregate information or blind data that does not contain personal identifiers such as account numbers, names, or addresses. 16 C.F.R. § 313.3(o)(2)(ii)(B). However, the GLBA and the FTC do not permit the AGO to newly redact or repackage the information in its possession to yield the blind data, aggregate information, and personal-identifier-free information that can be treated as public information. Thus, the AGO may disclose blind data and identifier-free information only if it has - 27 - Ameriquest Mortgage Co. v. Wash. State Office of the Att y Gen., No. 82690-1 already been created. The nondisclosure rules of the GLBA and the FTC rule are incorporated as an exemption to the PRA through RCW 42.56.070(1). - 28 - Ameriquest Mortgage Co. v. Wash. State Office of the Att y Gen., No. 82690-1 AUTHOR: Justice Mary E. Fairhurst WE CONCUR: Chief Justice Barbara A. Madsen Justice Susan Owens Justice Charles W. Johnson Justice Gerry L. Alexander Justice James M. Johnson Justice Richard B. Sanders Justice Debra L. Stephens Justice Tom Chambers - 29 -

Some case metadata and case summaries were written with the help of AI, which can produce inaccuracies. You should read the full case before relying on it for legal research purposes.

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.