EDITOR'S NOTE

Weird things happened this quarter that read like plot devices that couldn't get past the censors of good taste for Jackass 3D. But being the optimists we are, let's do happy and focus on the bad things that could have happened, but didn't.

The End of Days didn't happen on May 21. Like everyone else, God appears to be overscheduled and can't get around to destroying us until his docket clears in October. We'll have to take a number, like at the DMV. Donald Trump is not running for president, which will disappoint those who had hoped he would replace "The Star-Spangled Banner" with "We Shall Overcomb." And we didn't win the competition for the new voice of the Aflac® duck either, despite many who believed us to be overqualified. Being a Manhattan hotel housekeeper is different now too. These days, they have to wear the "Do Not Disturb" tags. We had more to say about that item, but we were censored by our good taste editor, on loan from Jersey Shore.

Thankfully, Snooki didn't reject our featured tattoos. So, we report here on the "earthquake" in arbitration—AT&T v. Concepcion—as one leading class action lawyer called it, as well as the aftershocks already being felt to thwart that decision. Our Beltway Report could fill a newsletter of its own, from new rules about "living wills" to how much risk to retain when you sponsor ABSs. The still-unformed Consumer Financial Protection Bureau cut a friendship deal with the National Association of Attorneys General, which means it's time to worry. Lots of things happened in Mortgage (the beginning of the end for Fannie/Freddie?, new cost disclosure forms), and Privacy (e.g., "do not track" initiatives, federal breach notification, cybersecurity). And it looks like we're going to have to put Congress in a bouncing room to sort out the Durbin Amendment.

William Stern, Editor-in-chief

ARBITRATION REPORT

Supreme Court Resuscitates Class Action Waivers

For the past few years, courts throughout the U.S. have repeatedly struck down class action waivers under state unconscionability law. In a sweeping decision, the U.S. Supreme Court reversed that trend, handing down its much-awaited decision in AT&T Mobility v. Concepcion, 131 S. Ct. 1740 (U.S. 2011). The arbitration provision at issue was part of an AT&T service contract, requiring the Concepcions to arbitrate any disputes with AT&T and prohibiting them from adjudicating their disputes as part of a class action. In a 5-4 decision, the Supreme Court held that AT&T's arbitration clause was enforceable despite the class action waiver. The issue decided by the Court was whether the Federal Arbitration Act, 9 U.S.C. § 1 et seq. (FAA) preempts California's common law of unconscionability, pursuant to which California courts have struck most class action waiver clauses since 2005. The Supreme Court held that AT&T's arbitration agreement was enforceable notwithstanding the class action waiver because California law conflicts with—that is, is preempted by— the FAA. This decision will affect the class action exposure of businesses in a wide span of industries, and once again places class action waivers on equal footing with other contractual provisions that companies include in their arbitration agreements.

For more information, contact William Stern, wstern@mofo.com, or Rebekah Kaufman, rkaufman@mofo.com, or visit our website at: http://www.mofo.com/files/Uploads/Images/110428-Class-Action-Waivers.pdf .

"Not So Fast, Supreme Court," Says California Legislature

In response to the Supreme Court's decision in Concepion, the California Legislature has introduced AB 1062, which would amend Section 1294 of the California Code of Civil Procedure to make denials of orders to compel arbitration non-appealable— except in cases involving arbitration under collective bargaining agreements (the so-called union carve-out). This is a stealth effort by the State to limit consumer and employment arbitration. In a nut shell, it means that if you move to compel arbitration and lose, your only recourse is to file a writ. Otherwise you have to go to trial and that, effectively, means forfeiting arbitration. The validity of AB 1062, if it ever becomes law, will certainly be challenged on several grounds, including that it is yet another state-imposed, arbitration-unfriendly rule that is preempted under the FAA. The fact that it is spawned from the legislature rather then the judiciary almost certainly won't save it.

For more information, contact William Stern, wstern@mofo.com.

Will Congress or the CFPB Attack Concepcion?

On May 12, 2011, Senators Franken and Blumenthal reintroduced the Arbitration Fairness Act (AFA) which, if passed, would amend the FAA to render unenforceable any mandatory arbitration clause for employment, consumer, franchise, or civil rights disputes, as well as any dispute arising under any statute intended "to regulate contracts or transactions between parties of unequal bargaining power." The AFA failed to pass twice before and the third time is not likely to be the charm, given the current makeup of Congress. But the AFA may not be the only avenue for limiting Concepcion. The Dodd-Frank Act requires the Consumer Financial Protection Bureau (CFPB) to study and provide a report to Congress concerning the use of mandatory arbitration agreements in connection with consumer financial products and allows the CFPB to issue rules that may "prohibit or impose conditions" on the use of arbitration agreements if the study finds that it would be in the public interest and would protect consumers. While Concepcion holds that arbitration clauses are binding once they are part of a contract, the CFPB could attempt to prohibit their inclusion in a contract in the first place.

For more information, contact William Stern, wstern@mofo.com.

Stolt-Nielsen Doesn't Sway Second Circuit

On remand from the U.S. Supreme Court, and in a pre-Concepcion case, the Second Circuit didn't budge from its original decision: A class action waiver is unenforceable when it would effectively shut down an action seeking to vindicate statutory rights. In re Am. Express Merchants' Litig., 634 F.3d 187 (2d Cir. Mar. 3, 2011). In light of its holding in Stolt-Nielsen SA v. AnimalFeeds Int'l Corp., 130 S. Ct. 1758 (2010), the Supreme Court remanded the case for reconsideration. But the Second Circuit said that decision didn't change its analysis and held that a plaintiff can challenge a class action waiver clause on the ground that it would be cost-prohibitive to pursue a statutory right on an individual basis, so long as the plaintiff provides sufficient supporting proof. The court also "again conclude[d] that (1) the question of the enforceability of the class action waiver provision is properly decided by the court and (2) the class action waiver provision is unenforceable under the Federal Arbitration Act." The court made clear that there is not a bright line rule that all class action waivers in arbitration agreements are unenforceable; each case must be examined on its own merits.

For more information, contact Rebekah Kaufman, rkaufman@mofo.com.

Wondering How Broadly Courts Will Apply Concepcion? Read on.

In Arellano v. T-Mobile USA, Inc., No. C 10-05663 WHA, 2011 U.S. Dist. LEXIS 41667 (N.D. Cal. May 16, 2011), the court, applying Concepcion, granted a motion to compel arbitration claims for injunctive relief brought under the California Unfair Competition Law, California Consumer Legal Remedies Act, California False Advertising Act, and Federal Communications Act. The plaintiff argued that these claims for injunctive relief were not subject to arbitration because the California Supreme Court previously had held that suits for injunctive relief under those statutes were not subject to arbitration. The court held that Concepcion compels FAA preemption when "state law prohibits outright the arbitration of a particular type of claim" and thus the FAA "preempts California's exemption of claims for public injunctive relief from arbitration, at least for actions in federal court." Id. at *4.

For more information, contact Rebekah Kaufman, rkaufman@mofo.com.

BELTWAY REPORT

Fed Proposes New Regulatory Scheme for Remittance Transfers

On May 23, 2011, the Federal Reserve Board published in the Federal Register a proposed rule setting forth an entirely new regulatory scheme for companies, including banks, that provide electronic transfers of money from U.S. consumers to recipients in foreign countries. The FRB's proposal would (1) require that specific disclosures be given to each "sender" of a remittance transfer showing how much money will be received by the recipient of the transfer in local currency; (2) enable senders to dispute errors for up to 180 days following a remittance transfer; and (3) impose vicarious liability on remittance transfer providers for the acts or omissions of their agents. Comments on the proposal are due July 22, 2011.

For more information, contact Ezra C. Levine, elevine@mofo.com, or Andrew M. Smith, asmith@mofo.com, or visit our website at: http://www.mofo.com/files/Uploads/Images/110523-Federal-Reserve-Board-Proposes-New-Regulatory-Scheme-for-Remittance-Transfers.pdf .

Required to Keep a Horse in the Race

Six federal agencies are seeking comments on a proposed rule that would require sponsors of asset-backed securities (ABS) to retain at least 5 percent of the credit risk of the assets underlying the securities and would not permit sponsors to transfer or hedge that credit risk. In crafting the proposed rule, the agencies indicated that they sought to ensure that the amount of credit risk retained is meaningful, while reducing the potential for the rule to negatively affect the availability and cost of credit to consumers and businesses. The proposal includes descriptions of loans that would not be subject to these requirements, including asset-backed securities that are collateralized exclusively by residential mortgages that qualify as "qualified residential mortgages." The agencies request comments on the proposed rule by June 10, 2011.

For more information, contact Melissa D. Beck, mbeck@mofo.com, Jerry R. Marlatt, jmarlatt@mofo.com, Kenneth Kohler, kkohler@mofo.com, or Calvin Cheng, calvincheng@mofo.com, or visit our website at: http://www.mofo.com/files/Uploads/Images/110525-Impact-of-Dodd-Franks-Risk-Retention-Rules-on-CLOs.pdf .

CFPB and NAAG, So Happy Together?

On April 11, the Consumer Financial Protection Bureau (CFPB) and the Presidential Initiative Working Group of the National Association of Attorneys General (NAAG) announced agreement on a Joint Statement of Principles ("Joint Statement"). The Joint Statement was intended to advance three goals shared by the CFPB and the state AGs: (1) to protect consumers of financial products and services from unlawful acts and practices; (2) to provide clear rules that improve the marketplace for consumers and remove unfair competition for the benefit of law-abiding businesses; and (3) to find ways to promote consumer understanding and address concerns raised by consumers about financial products or services. In the Joint Statement, the CFPB and NAAG agree, among other things, to: (1) engage in regular consultations to identify mutual enforcement priorities that will ensure effective and consistent enforcement of consumer protection laws; (2) pursue legal remedies to foster transparency, competition, and fairness in the marketplace for consumer financial products and services without regard to corporate form or charter choice; and (3) share, refer, and route complaints and consumer complaint information between the CFPB and the state AGs.

For more information, contact Andrew M. Smith, asmith@mofo.com.

There's a New Sheriff in Town

Savings and loan holding companies (SLHCs) will face important changes when the Federal Reserve Board (FRB) takes over the supervisory responsibilities of the Office of Thrift Supervision (OTS) on July 21, 2011. The first formal step in this transition occurred on April 15, when the FRB published a notice seeking comment on the application to thrift holding companies of its examination and supervision framework for bank holding companies. The notice states that the FRB's supervision regime would not require "any specific action" by SLHCs before the transfer date. The notice appears to be the only written guidance from the FRB before the transfer date. The notice states that guidance and proposed rules will be issued after July 21, taking into account comments on the notice.

For more information, contact Dwight C. Smith, dsmith@mofo.com, or visit our website at: http://www.mofo.com/files/Uploads/Images/110516-Savings-and-Loan-Holding-Companies.pdf .

What's the Plan?

A recently proposed rule by the Federal Reserve Board and the Federal Deposit Insurance Corporation would systemically impose significant bank holding companies and nonbank financial companies to submit annual resolution plans and quarterly credit exposure reports.

The agencies are requesting comments on the proposal, which would implement requirements of Dodd-Frank by June 10, 2011. The requirements apply to bank holding companies with total consolidated assets of $50 billion or more and nonbank financial companies designated by the Financial Stability Oversight Council for supervision by the Board. The annual resolution plan would be required to describe the company's strategy for rapid and orderly resolution in bankruptcy during times of financial distress and include a detailed listing and description of all significant interconnections and interdependencies among major business lines and operations of the company that, if disrupted, would materially affect the funding or operations of the company or its major operations. The quarterly credit exposure report would be required to describe the nature and extent of the company's credit exposure to other large financial companies, as well as the nature and extent of credit exposure by other large financial companies to the company. The credit exposure report would be required to include information related to the aggregate credit exposure associated with a range of transactions.

For more information, contact Obrea Poindexter, opoindexter@mofo.com.

Risky Business

Several federal financial regulatory agencies have proposed a rule to ensure that regulated financial institutions design their incentive compensation arrangements to take account of risk. The proposed rule, which is being issued pursuant to Dodd-Frank, would apply to certain financial institutions with more than $1 billion in assets. It also contains heightened standards for the largest of these institutions. In prohibiting incentive compensation arrangements that could encourage inappropriate risks, the proposal would require compensation practices at regulated financial institutions to be consistent with three key principles: incentive compensation arrangements should appropriately balance risk and financial rewards, be compatible with effective controls and risk management, and be supported by strong corporate governance. The comment period ended on May 31, 2011.

For more information, contact Hillel T. Cohn, hcohn@mofo.com, or Dave Lynn, dlynn@mofo.com, or visit our website at: http://www.mofo.com/files/Uploads/Images/110315-SEC_Issues_Proposed_Rules_on_Incentive-Based_Compensation_Practices.pdf .

Reg Z Amended (Again)

The Federal Reserve Board on Friday approved a rule amending Regulation Z (Truth in Lending Act) to clarify aspects of prior Board rules implementing the Credit Card Accountability Responsibility and Disclosure Act of 2009 (Credit Card Act). The Board has indicated that this rule is intended to enhance protections for consumers who use credit cards and to resolve areas of uncertainty so that card issuers fully understand their compliance obligations. The Board's rule addresses practices that can result in extensions of credit to consumers who lack the ability to pay. Specifically, the rule states that credit card applications generally cannot request a consumer's "household income" because that term is too vague to allow issuers to properly evaluate the consumer's ability to pay. Instead, issuers must consider the consumer's individual income or salary. In addition, the Board's rule was intended to clarify that promotional programs that waive interest charges for a specified period of time are subject to the same Credit Card Act protections as promotional programs that apply a reduced rate for a specified period. For example, a card issuer that offers to waive interest charges for six months will be prohibited from revoking the waiver and charging interest during the six-month period, unless the account becomes more than 60 days delinquent. The rule also clarifies that application and similar fees that a consumer is required to pay before a credit card account is opened are covered by the same Credit Card Act limitations as fees charged during the first year after the account is opened. Because the total amount of these fees cannot exceed 25 percent of the account's initial credit limit, a card issuer that, for example, charges a $75 fee to apply for a credit card with a $400 credit limit generally will not be permitted to charge more than $25 in additional fees during the first year after account opening.

For more information, contact Joe Gabai, jgabai@mofo.com.

Ability-to-Pay Rule

The Federal Reserve Board recently requested public comments on a proposed rule under Regulation Z that would require creditors to determine a consumer's ability to repay a mortgage before making the loan and would establish minimum mortgage underwriting standards.

The revisions to the regulation, which implements the Truth in Lending Act (TILA), are being made pursuant to the Dodd- Frank Wall Street Reform and Consumer Protection Act. The proposal would apply to all consumer mortgages. The proposal would provide four options for complying with the ability-to-repay requirement. First, a creditor can meet the general ability-to-repay standard by considering and verifying specified underwriting factors, such as the consumer's income or assets. Second, a creditor can make a "qualified mortgage," which provides the creditor with special protection from liability, provided that the loan does not have certain features, such as negative amortization; the fees are within specified limits; and the creditor underwrites the mortgage payment using the maximum interest rate in the first five years. Third, a creditor operating predominantly in rural or underserved areas can make a balloon-payment qualified mortgage. Finally, a creditor can refinance a "non-standard mortgage" with risky features into a more stable "standard mortgage" with a lower monthly payment. The proposal would also implement the Dodd-Frank Act's limits on prepayment penalties. The comment period ends on July 22, 2011.

For more information, contact Joe Gabai, jgabai@mofo.com.

OPERATIONS REPORT

U.S. Retained Credit Risk Rules Take Shape

On March 29, 2011, the Federal Reserve Board and the FDIC separately approved a joint notice of proposed rulemaking (NPR) implementing the credit risk retention requirements of section 941 of the Dodd- Frank Act, which added a new section 15G to the Securities Act of 1933 (the "Securities Act"). The NPR was also subsequently approved by the Securities and Exchange Commission (SEC), the Department of Housing and Urban Development, the Federal Housing Finance Agency, and the Office of the Comptroller of the Currency. The NPR was jointly issued on March 31, 2011, for a 60-day comment period following publication in the Federal Register, which will end on June 10, 2011.

For more information, contact Melissa Beck, mbeck@mofo.com or Kenneth Kohler, kkohler@mofo.com, or visit our website at: http://www.mofo.com/files/Uploads/Images/110407-Credit-Risk-Rules.pdf .

2011 Debit Issuer Study Shows Durbin Anticipated to Be Debit Killer

PULSE recently released its 2011 Debit Issuer Study, which found that small debit card issuers on average expect a 73 percent decrease in debit interchange revenue as a result of pending interchange fee rules. While these issuers with less than $10 billion in assets are exempt from the regulations proposed by the Federal Reserve Board, they are critical of the interchange cap and skeptical that the exemption will be effective. The impact small issuers say they are expecting is greater than many anticipated. One exempt issuer in the 2011 Debit Issuer Study responded, "We see no impact in 2011, but over time (in 2012-2013), we expect interchange income will decrease due to marketplace pressures lowering the interchange rate." Another exempt issuer commented that, "Even if a network were to offer a two-tier pricing schedule, the shift in market conditions would eventually require the interchange rate for exempt institutions to be reduced."

For more information, contact Oliver Ireland, oireland@mofo.com.

MORTGAGE REPORT

Fed Requires Ten Banks for Mortgage Practices

The Federal Reserve Board announced enforcement actions against ten of the largest banks for alleged deficient practices in residential mortgage loan servicing and foreclosure processing. The Fed is requiring the parent holding companies to improve oversight of residential mortgage loan servicing and foreclosure processing. Banks that have servicing entities regulated by the Federal Reserve also are being required to correct alleged deficiencies in residential mortgage loan servicing and foreclosure processing identified by examiners during reviews conducted November 2010 to January 2011.

For more information, contact Oliver Ireland, oireland@mofo.com.

CFPB Tests Mortgage Cost Disclosure Forms Required by Dodd-Frank; Six Cities Selected

On May 19, 2011, the CFPB began testing two alternate prototype forms of a simplified mortgage costs disclosure form that will be given to potential borrowers in six cities: Baltimore, Chicago, Los Angeles, Albuquerque, NM, Birmingham, AL, and Springfield, MA. The CFBP hopes to select a single draft form that will be further refined and then published as a proposed rule sometime before July 2012. The agency will test both English- and Spanish-language versions of the two forms among mortgage consumers, lenders, and brokers. At least five rounds of testing are planned through the end of 2011 and possibly longer. Under Dodd-Frank, the CFPB is tasked with combining and simplifying two overlapping disclosure forms currently required under the Truth in Lending Act (TILA) and the Real Estate Settlement Procedures Act (RESPA).

Supreme Court Seeks Solicitor General's Views on RESPA

On May 16, 2011, the U.S. Supreme Court asked the Office of the Solicitor General to weigh in on the scope of the Real Estate Settlement Procedures Act and gauge class claims that Quicken Loans Inc. illegally charges mortgage borrowers closing fees. The high court invited the solicitor general to file a brief expressing the U.S. government's view on Quicken's loan origination and discount fees, which mortgage borrowers contend violate RESPA's prohibition on unearned fees for settlement services. While the plaintiffs argued that Quicken's "unearned, undivided" fees to borrowers at the closing of a mortgage transaction are outlawed by Section 8(b) of RESPA, the Fifth Circuit determined that the statute only bars fees that are divided between two parties, resembling a kickback or bribe. In similar cases, the Fourth, Seventh, and Eighth Circuits came out the same way while the Second, Third, and Eleventh circuits have rejected the two-party requirement under RESPA.

The Obama Administration's Finance Reform Proposal

Ending months of suspense, on February 11, 2011, the Department of the Treasury and the Department of Housing and Urban Development issued a report to Congress unveiling the Obama Administration's plans for the two giant, government-sponsored secondary mortgage market entities (GSEs), Fannie Mae and Freddie Mac, and for the future of the U.S. housing finance system generally (the "Proposal"). The first element of the plan is to reduce government support for housing finance in general, including the gradual but deliberate wind-down of Fannie Mae and Freddie Mac over a period of years. The second element of the plan is to remedy "fundamental flaws" in the mortgage finance market identified by the Administration as significant contributors to the financial crisis, by reforming loan origination and securitization practices as already provided for by the Dodd-Frank Act, and by reforming mortgage servicing and foreclosure processes. The third element of the plan is to better target the government's support for affordable housing by reforming and strengthening the Federal Housing Administration (FHA), rebalancing national housing policy to provide additional support for rental properties, and ensuring that housing capital reaches non-mainstream communities, including rural areas, economically distressed regions, and low-income communities.

For more information, contact Kenneth Kohler, kkohler@mofo.com, or Melissa D. Beck, mbeck@mofo.com, or visit our website at: http://www.mofo.com/files/Uploads/Images/110316-Housing-Finance-Reform.pdf .

Common Ground

Recently introduced legislation would replace mortgage giants Fannie Mae and Freddie Mac with at least five private companies that would issue mortgage-backed securities with explicit federal guarantees. The legislation's sponsors, Rep. John Campbell (R., CA) and Rep. Gary Peters (D., MI), feel that the measure is a compromise between conservative Republicans who have advanced bills to build a mostly private mortgage-finance system and Democrats, who say the government shouldn't abandon the mortgage market. Like Fannie and Freddie, the new entities would be restricted to buying loans that meet certain standards, including size caps. But the firms would have to hold much more capital than Fannie and Freddie. And only the mortgage-backed securities that they issue—not the companies themselves—would enjoy federal guarantees. The companies would operate more as public utilities and likely wouldn't have exchange-listed shares.

PRIVACY REPORT

Every Step You Take

A number of "do-not-track" bills have been introduced recently. Senator Rockefeller (D.,WV) introduced a bill which would mandate that the FTC promulgate a trade regulation rule creating a mechanism providing for consumers to express their preference not to be tracked online or on mobile devices, and a requirement for companies to honor the preference. Companies would be permitted to continue to collect the information necessary to function and be effective, though they would have to destroy or anonymize that information when it was no longer needed. Also, Representative Speier (D.,CA) has introduced another online tracking bill (H.R. 654). Specifically, H.R. 654 would direct the FTC to promulgate standards to provide for an online mechanism for consumers to opt out of the collection and use of their personal information online. Moreover, H.R. 654 would require online advertisers and website operators to disclose to the public their data collection, use, and disclosure practices.

For more information, contact Reed Freeman, rfreeman@mofo.com, Julie O'Neill, joneill@mofo.com, or Nathan Taylor, ndtaylor@mofo.com.

FRB-and FTC-Proposed Credit Score Disclosure Rules

The Dodd-Frank Act amended the Fair Credit Reporting Act (FCRA) to require companies that use credit scores to include those scores, and related information, in adverse action and risk-based pricing notices provided to consumers. On March 1, 2011, the Federal Reserve Board (FRB) and FTC proposed two rules to implement these provisions. Highlights of the proposals include: (a) no proposed changes to the "Credit Score Exception Notices" under the risk-based pricing rule, allowing lenders to continue to use existing notices following the effective date of the new requirements; (b) new credit score disclosure language for the Regulation B sample adverse action notices, which could in some cases require the disclosure of up to nine reason codes in adverse action notices; and (c) a clarifying statement in the proposals that only one credit score must be disclosed in connection with an adverse action or a risk-based pricing notice.

For more information, contact Andrew Smith, asmith@mofo.com.

FTC Proposed Settlement with Google

On March 30, 2011, the FTC announced a proposed privacy settlement with Google that would set new precedents about current FTC privacy expectations. The FTC alleged that Google violated its privacy policy, specifically a provision in which Google states that if it uses information differently from the purpose for which it was collected, Google will obtain consent. The FTC alleged that Gmail users' personal information was made public through the Google Buzz social marketing service without their consent, and even sometimes when the users tried to opt out of the Buzz service. The FTC also alleged that Google misrepresented its compliance with its U.S.-EU Safe Harbor certification because (according to the FTC) the company failed to give consumers notice and choice before using their information for a purpose different from that for which it was collected. This is the FTC's first case alleging substantive violations of the U.S.-EU Safe Harbor provisions and its first settlement requiring the implementation of a comprehensive "privacy by design" program for all future products and services and also requiring biannual, independent privacy audits for twenty years. The proposed settlement also would require Google to get opt-in consent for secondary uses or disclosures of data.

For more information, contact Reed Freeman, rfreeman@mofo.com, or Julie O'Neill, joneill@mofo.com.

No Credit, No Cry

On April 12, Maryland Governor O'Malley signed into law bills prohibiting employer use of credit report data, becoming the fifth state to enact such limitations. The Maryland law, effective October 1, 2011, prohibits employers from using credit report data to deny employment, discharge a worker or set compensation, terms, conditions or privileges of employment, unless, after making an employment offer to an individual, the employer has a use for the credit report data that is substantially job-related. In such instances, the employer must provide written notice of its use of credit report data to the employee or applicant. The Maryland law exempts certain employers, including financial institutions. In addition to Maryland, Hawaii, Illinois, Oregon, and Washington also have recently enacted similar legislation.

For more information, contact Nathan Taylor, ndtaylor@mofo.com.

Federal Security Breach Notification Bills

As the privacy debate continues to heat up in Congress, the issue of data security is seeing renewed attention. Two similar bills have recently been introduced in the House that include security breach notification requirements. First, Representative Rush (D.,IL) reintroduced the Data Accountability and Trust Act (H.R. 1707), which includes wide-sweeping data security requirements, including directing the FTC to issue regulations requiring persons engaged in interstate commerce that own or possess personal information in electronic form to implement information security policies and procedures. H.R. 1707 also would establish a nationwide standard for security breach notification for breach incidents involving personal information in electronic form. The bill would be enforced not only by the FTC, but also by state AGs. In addition, on May 11, 2011, Representative Stearns (R.,FL) introduced a data security bill which contained many similarities to HR 1707 but would require that companies provide security breach notices "without unreasonable delay," compared to H.R. 1707 which would provide companies with up to 60 days following discovery of a breach.

For more information, contact Nathan Taylor, ndtaylor@mofo.com.

Administration Issues Cybersecurity Legislative Proposal

On May 12, 2011, the Obama Administration provided Congress with proposed legislation designed to improve the country's cybersecurity. Notably, the Administration's proposal would include a national standard for security breach notification relating to incidents involving computerized data and would preempt state breach laws (at least to the extent that they apply to incidents involving computerized data). Although the notice requirements would include a risk-of-harm exception, this exception would be contingent on providing a detailed risk assessment to the FTC. The breach requirements would be enforceable by the FTC and state AGs.

For more information, contact Nathan Taylor, ndtaylor@mofo.com.

Administration Finalizes National "Trusted Identities" Strategy

On April 15, 2011, the Obama Administration released a final version of its national strategy to increase the security of online transactions and reduce fraud and identity theft on the Internet. The goal of the Administration's strategy is for the private sector to create an "identity ecosystem" in which consumers would be able to obtain a single credential (e.g., a smart card) that would generate a one-time digital password for use on the Internet. Consumers would be able to use this single credential to log into any website in a more secure fashion than using the plethora of different passwords that they currently use. In addition, the Administration hopes that this strategy would provide significant benefits to businesses, particularly small businesses, by allowing more businesses to conduct their business online without the need to build and manage login systems and user accounts. The Administration's strategy also calls for additional privacy protections, such as limiting the collection of consumer information online to the minimum needed to accomplish the transaction and meet legal requirements.

For more information, contact Nathan Taylor, ndtaylor@mofo.com.

OCC Issues Data Security Alert

In light of a number of highly publicized security breaches involving service providers, on April 18, 2011, the Office of the Comptroller of the Currency (OCC) issued an alert highlighting the need for national banks and their technology service providers (TSPs) to take steps to ensure that their enterprise risk management is sufficiently robust to protect and secure bank and customer information. The alert highlights that national banks and their TSPs should perform periodic risk assessments of their information security programs with respect to the prevention and detection of security incidents. Moreover, the OCC indicated that it expects national banks and their TSPs to review specific advisories issued following a recent security incident to ensure that their information security programs appropriately address recommendations made in those advisories, based on their environment and risk profiles.

For more information, contact Nathan Taylor, ndtaylor@mofo.com.

State Data Security Legislation

A number of state legislatures are once again considering data security legislation. For example, the Nevada Senate is considering a bill that would require businesses to encrypt or destroy personal information stored on copiers, fax machines, and other devices before relinquishing ownership, custody, or control of the devices (S.B. 267). The California Senate once again approved a bill that would amend and expand the state's security breach notification statute. S.B. 24 would, among other things, provide requirements for the content of notices that businesses must send to consumers when there is a security breach. Moreover, S.B. 24 would require that businesses notify the California AG of breaches involving more than 500 state residents. S.B. 24 is substantially similar to three previous bills that were approved by the California legislature and then ultimately vetoed by the now-former Governor.

For more information, contact Nathan Taylor, ndtaylor@mofo.com.

Massachusetts AG Brings Data Security Enforcement Action

On March 28, 2011, the Massachusetts AG entered into a settlement with the owner and operator of a number of bars and restaurants with respect to a security breach and related data security failings. According to the Massachusetts AG's complaint, the restaurant chain experienced a data breach in April 2009 in which malware on its computer systems allowed hackers to access customer payment card information. In addition, the AG's complaint alleged, among other things, that the restaurant chain did not follow a number of basic computer security precautions, including, for example, failing to change the default usernames and passwords on its computer system and permitting employees to share common usernames and passwords. The settlement required the restaurant chain, among other things, to pay $110,000 in civil penalties, as well as to comply with the Massachusetts data security regulations. In making this announcement, the Massachusetts AG acknowledged that the breach at issue occurred prior to the date that compliance with the Massachusetts data security regulations was required (March 1, 2010), but "the data security standards set forth in the regulations were used in the settlement."

For more information, contact Nathan Taylor, ndtaylor@mofo.com.

PCI Guidance Expected

The PCI Security Standards Council is expected to soon release guidance on what constitutes secure mobile-payments software. In light of recent developments in the payment card industry, including the development of mobile devices that substitute for cards and mobile payments generally, the Council is reportedly developing guidelines not only for mobile payments, but also for encryption, tokenization, wireless security, and virtualization. The Council also is reportedly working on a simplified process for merchants to complete Self-Assessment Questionnaires, such as a common, online form that would route merchants to the appropriate Questionnaire of the five available based on the information that they input.

For more information, contact Nathan Taylor, ndtaylor@mofo.com.

PREEMPTION REPORT

Preemption Soft Ball

The OCC explained its interpretation of the Dodd-Frank preemption provisions in a May 12, 2011 letter responding to an inquiry from Senators Mark Carper and Mark Warner, who authored those provisions. Here are the highlights:

  • The "prevents or significantly interferes with the exercise by the national bank of its powers" language from Barnett Bank of Marion County, N.A. v. Nelson, Florida Insurance Commissioner, et. al., 517 U.S. 25 (1996) quoted in Dodd Frank is the "touchstone or starting point" in the analysis, but the analysis "may not stop there and must consider the whole of the conflict preemption analysis" in the decision and its progeny.
  • The OCC's 2004 regulations remain in full force and effect because they codify the Barnett Bank (ID cite) conflict preemption standard. However, the OCC will remove the "obstruct, impair, and condition" standard from those regulations in light of congressional intent to "eliminate uncertainty" created by this "distillation" of the conflict preemption principles in Barnett Bank.
  • The OCC will rescind its regulation concerning application of state laws to national bank operating subsidiaries, amend its regulations to provide that the same preemption standards apply to national banks and federal thrifts, and revise its regulations to comport with the Supreme Court's ruling in Cuomo v. Clearing House Ass'n, LLC, 129 S. Ct. 2710, 2715, 174 L. Ed. 2d 464 (2009), all of which reflect Dodd- Frank requirements.

For more information, contact Nancy Thomas, nthomas@mofo.com.

Op. Sub. Claims Sunk

Morrison & Foerster won a significant preemption victory in a class action filed against U.S. Bank contending the interest rate allegedly charged by the bank's operating subsidiary exceeded that permitted in Minnesota, the operating subsidiary's state of incorporation. Higginbottom v. U.S. Bank, N.A., 10-CV- 04593-LHK, 2011 U.S. Dist. LEXIS 46631 (N.D. Cal. Apr. 25, 2011). The Court granted U.S. Bank's motion to dismiss, holding a national bank's op. sub. may charge interest rates permitted in the national bank's home state rather than interest rates permitted by the op. sub.'s home state, and the NBA preempts state usury and UDAP claims because "[w]hat constitutes the taking of usury by a national bank is completely defined by federal law."

For more information, contact James McGuire, jmcguire@mofo.com. He represents U.S. Bancorp, U.S. Bank National Association, and U.S. Bank's operating subsidiary Lyon Financial Services, Inc. in this case.

First Out of the Box

The Eleventh Circuit has joined the Fifth Circuit and several district courts in holding a state par value statute was preempted to the extent that it prohibited national banks from charging check-cashing fees. Baptista v. JP Morgan Chase Bank, N.A., 2011 U.S. App. LEXIS 9568 (11th Cir. May 11, 2011). Although Dodd-Frank doesn't become effective until July 2011, the Court took the opportunity to opine that the Act codifies a conflict preemption standard, which the Court articulated as "whether there is a significant conflict between the state and federal statutes." Id. at *4. The OCC cited this interpretation in support of its view that the "prevents or significantly interfere" language is merely the beginning of the Dodd-Frank preemption analysis.

For more information, contact Nancy Thomas, nthomas@mofo.com.

To Defer or Not to Defer

Preemption wonks beware: according to a district court in West Virginia, "the analysis in Fidelity Fed. Sav. & Loan Ass'n v. de la Cuesta, 458 U.S. 141 (1982), of the standard of review to be applied to preemptive agency regulations, id., is in direct conflict with the majority decision in Wyeth[v. Levine, 129 S. Ct. 1187 (2009)]." Smith v. BAC Home Loans Servicing, LP, 2:10-cv-00354, 2011 U.S. Dist. LEXIS 26104, at *26-27 (S.D. W. Va. March 11, 2011). The Court explained that under the Wyeth analysis, the OCC regulations are entitled only to Skidmore deference because the NBA does not expressly confer preemptive rulemaking authority on the OCC. Id. at *16-*18. The Court further found that conflict rather than express preemption principles applied to the OCC regulations because those regulations merely codify NBA conflict preemption principles. Because the national bank had not explained how the application of a state UDAP statute obstructed the purposes and objectives of the NBA, the Court denied the national bank's motion for summary judgment on preemption grounds.

For more information, contact Nancy Thomas, nthomas@mofo.com.

Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Morrison & Foerster LLP. All rights reserved