## Facts

- Federal financial regulators issued privacy regulations implementing Title V of the Gramm-Leach-Bliley Act (GLBA), governing disclosure of “nonpublic personal information” by covered “financial institutions.”
- The regulations required, among other things, privacy notices and limits on disclosures to nonaffiliated third parties unless consumers were given an opt-out opportunity.
- The regulations treated certain identifying “credit header” data (e.g., names, addresses, Social Security numbers) as “nonpublic personal information” when obtained from or derived through a consumer’s relationship with a financial institution.
- Individual Reference Services Group, Inc. (a trade association of entities compiling and selling data about individuals) and Trans Union LLC (a consumer reporting agency) relied on obtaining and selling such information.
- Plaintiffs sought declaratory and injunctive relief under the Administrative Procedure Act (APA), arguing the regulations exceeded statutory authority and violated constitutional protections.
- The parties filed cross-motions for summary judgment.

## Issues

1. Whether the regulators’ definitions of “nonpublic personal information” and related terms were a permissible construction of GLBA.
2. Whether a consumer reporting agency such as Trans Union could be treated as a “financial institution” subject to GLBA privacy rules.
3. Whether the regulations conflicted with GLBA provisions permitting certain disclosures to consumer reporting agencies.
4. Whether limits on disclosure and sale of covered information violated the First Amendment.
5. Whether the regulations violated the Fifth Amendment or were arbitrary and capricious under the APA.

## Decision

- Defendants’ cross-motions for summary judgment were granted, and plaintiffs’ motions were denied.
- The court upheld the regulations’ definitions of covered information as reasonable under GLBA.
- The court held that Trans Union could be regulated as a “financial institution” because it was significantly engaged in financial activities tied to consumer credit information.
- The court found no unlawful conflict with GLBA’s consumer-reporting-related exemption; the regulations preserved exempt disclosures while regulating non-exempt uses.
- The court rejected First Amendment, Fifth Amendment, and APA challenges and declined to enjoin enforcement.

## Legal Principles

- Under Chevron, if a statute does not unambiguously resolve the precise question, a court defers to a reasonable agency interpretation.
- GLBA permits regulators to treat information obtained in connection with providing financial products or services as “nonpublic personal information,” even when the data is not inherently “financial” in content.
- Regulators may classify entities as “financial institutions” when they are significantly engaged in activities that qualify as financial in nature under GLBA’s framework.
- Restrictions on disclosure of consumer information tied to financial relationships are evaluated as commercial speech regulation and may be sustained when they materially advance a substantial governmental interest in consumer privacy and are reasonably fitted to that interest.
- Under APA arbitrary-and-capricious review, regulations are sustained when agencies consider relevant factors and provide a reasoned explanation grounded in the rulemaking record.

## Conclusion

The court sustained GLBA privacy regulations restricting disclosure of nonpublic personal information, deferred to regulators’ statutory interpretations, treated a consumer reporting agency as a covered financial institution, and rejected constitutional and APA challenges to the privacy regime.


Individual Reference Servs. Grp., Inc. v. FTC, 145 F. Supp. 2d 6 (D.D.C. 2001)