Capital One 2003 Annual Report Download - page 34

nonpublic personal information about them with nonaffiliated third persons. The Corporation and the Bank each
have a written privacy notice posted on the Corporation’s web site which is delivered to each of its customers
when customer relationships begin, and annually thereafter, in compliance with the GLB Act. In accordance with
that privacy notice, the Corporation and the Bank protect the security of information about their customers,
educate their employees about the importance of protecting customer privacy, and allow their customers to
remove their names from the solicitation lists they use and share with others. The Corporation and the Bank
require business partners with whom they share such information to have adequate security safeguards and to
abide by the redisclosure and reuse provisions of the GLB Act. The Corporation and the Bank have developed
and implemented programs to fulfill the expressed requests of customers and consumers to opt out of information
sharing subject to the GLB Act.
If the federal or state regulators of the financial subsidiaries establish further guidelines for addressing customer
privacy issues, the Corporation and/or the Bank may need to amend their privacy policies and adapt their internal
procedures. During the fourth quarter, the federal banking regulators indicated they will adopt the “Interagency
Guidance on Response Programs for Unauthorized Access to Customer Information and Customer Notice”,
which will instruct financial institutions on how to notify their customers who are affected by a security breach at
the financial institution that damages the integrity of customer information held by the financial institutions. This
Guidance may encourage litigation when a security breach occurs, even if the financial institution is in
compliance with security standards and follows the Guidance strictly. In addition to adopting federal
requirements regarding privacy, the GLB Act also permits individual states to enact stricter laws relating to the
use of customer information. California, Vermont and North Dakota have done so by statute, regulation or
referendum, and other states may consider proposals which impose additional requirements or restrictions on the
Corporation and/or the Bank. Like other lending institutions, the Bank utilizes credit bureau data in its
underwriting activities. Use of such data is regulated under the Fair Credit Reporting Act (“FCRA”) on a
uniform, nationwide basis, including credit reporting, prescreening, sharing of information between affiliates,
and the use of credit data. The Fair and Accurate Credit Transactions Act of 2003 (the “FACT Act”), which was
enacted by Congress and signed into law this quarter, extends the federal preemption of the FCRA permanently,
although the law authorizes states to enact identity theft laws that are not inconsistent with the conduct required
by the provisions of the FACT Act. If financial institutions and credit bureaus fail to alleviate the costs and
consumer frustration associated with the growing crime of identity theft, financial institutions could face
increased legislative/regulatory and litigation risks.
Investment in the Corporation, the Bank and the Savings Bank
Certain acquisitions of capital stock may be subject to regulatory approval or notice under federal or Virginia
law. Investors are responsible for ensuring that they do not, directly or indirectly, acquire shares of capital stock
of the Corporation in excess of the amount which can be acquired without regulatory approval. The Bank and the
Savings Bank are each “insured depository institutions” within the meaning of the Change in Bank Control Act.
Consequently, federal law and regulations prohibit any person or company from acquiring control of the
Corporation without, in most cases, prior written approval of the Federal Reserve or the OTS, as applicable.
Control is conclusively presumed if, among other things, a person or company acquires more than 25% of any
class of voting stock of the Corporation. A rebuttable presumption of control arises if a person or company
acquires more than 10% of any class of voting stock and is subject to any of a number of specified “control
factors” as set forth in the applicable regulations. Although the Bank is not a “bank” within the meaning of
Virginia’s reciprocal interstate banking legislation (Chapter 15 of Title 6.1 of the Code of Virginia), it is a “bank”
within the meaning of Chapter 13 of Title 6.1 of the Code of Virginia governing the acquisition of interests in
Virginia financial institutions (the “Financial Institution Holding Company Act”). The Financial Institution
Holding Company Act prohibits any person or entity from acquiring, or making any public offer to acquire,
control of a Virginia financial institution or its holding company without making application to, and receiving
prior approval from, the Bureau of Financial Institutions.
16