Capital One 2011 Annual Report Download - page 30

liquidate the company in a way that mitigates significant risks to financial stability and minimizes moral hazard.
The costs of a liquidation of a financial company would be borne by shareholders and unsecured creditors and
then, if necessary, by risk-based assessments on large financial companies. The FDIC has issued rules
implementing this authority, and may issue additional rules in the future.
FFIEC Account Management Guidance
On January 8, 2003, the Federal Financial Institutions Examination Council (“FFIEC”) released Account
Management and Loss Allowance Guidance (the “Guidance”). The Guidance applies to all credit lending of
regulated financial institutions and generally requires that banks properly manage several elements of their
lending programs, including line assignments, over-limit practices, minimum payment and negative amortization,
workout and settlement programs, and the accounting methodology used for various assets and income items
related to loans.
We believe that our account management and loss allowance practices are prudent and appropriate and,
consistent with the Guidance. We caution, however, the Guidance provides wide discretion to bank regulatory
agencies in the application of the Guidance to any particular institution and its account management and loss
allowance practices. Accordingly, under the Guidance, bank examiners could require changes in our account
management or loss allowance practices in the future, and such changes could have an adverse impact on our
financial condition or results of operation.
Privacy and Fair Credit Reporting
The GLBA requires a financial institution to describe in a privacy notice certain of its privacy and data collection
practices and requires that customers or consumers, before their nonpublic personal information is shared, be
given a choice (through an opt-out notice) to limit the sharing of such information about them with nonaffiliated
third parties unless the sharing is required or permitted under the GLBA as implemented. We, the Banks and ING
Bank have written privacy notices that are available either through our website, the website of the relevant legal
entity, or both, and are delivered to consumers and customers when required under the GLBA. In accordance
with the privacy notices, we, the Banks and ING Bank protect the security of information about our customers,
educate our employees about the importance of protecting customer privacy and allow our customers to remove
their names from the solicitation lists used and shared with others by us and the Banks or ING Bank to the extent
they use or share such lists. We, the Banks and ING Bank require business partners with whom we share such
information to have adequate security safeguards and to abide by the redisclosure and reuse provisions of the
GLBA. To the extent that the GLBA and the FCRA require us or one or more of the Banks or ING Bank to
provide customers and consumers the opportunity to opt out of sharing information, then the relevant entity or
entities provide such options in the privacy notice. In addition to adopting federal requirements regarding
privacy, the GLBA also permits individual states to enact stricter laws relating to the use of customer
information. To date, at least California and Vermont have done so by statute, regulation or referendum, and
other states may consider proposals which impose additional requirements or restrictions on us, the Banks or
ING Bank. If the federal or state regulators of the financial subsidiaries establish further guidelines for
addressing customer privacy issues, we, one or more of the Banks, or ING Bank may need to amend our privacy
policies and adapt our internal procedures.
Under Section 501(b) of the GLBA, among other sources of statutory authority, including state law, we are
required to observe various data security-related requirements, including establishing information security and
data security breach response programs and properly authenticating customers before processing or enabling
certain types of transactions or interactions. The failure to observe any one or more of these requirements could
subject us to enforcement action or litigation.
Like other financial institutions, the Banks and ING Bank rely upon consumer reports for prescreen marketing,
underwriting new loans and for reviewing and managing risks associated with existing accounts. In addition, the
10