Duke Law Journal: Michael E. Staten, The Impact Of Opt-In Privacy Rules On Retail Credit Markets: A Case Study Of Mbna, 52 Duke L. J. 745 (2003)

Cited: 52 Duke L. J. 745
[*pg 745]

THE IMPACT OF OPT-IN PRIVACY RULES ON RETAIL CREDIT MARKETS: A CASE STUDY OF MBNA

MICHAEL E. STATEN^† FRED H. CATE^††

ABSTRACT

TABLE OF CONTENTS

INTRODUCTION

I. THE MBNA EXPERIENCE
   A. Free-Flowing Information Transformed the Credit Card Industry
   B. Personal Information as the Cornerstone of the MBNA Strategy

II. DIMENSIONS OF THE OPT-IN VERSUS OPT-OUT DEBATE
   A. Opt-In Regimes
   B. The Differential Impact of Opt-In Versus Opt-Out

III. THE IMPACT OF OPT-IN ON MBNA PRODUCTS, SERVICES AND CUSTOMERS
   A. Impact on Affinity Cards, Customers and Prospects
   B. Impact on Cross-Selling
   C. Impact on Efforts to Prevent and Detect Fraud and Identity Theft

CONCLUSION

FOOTNOTES

ABSTRACT

U.S. privacy laws are increasingly moving from a presumption that consumers must object to ("opt out" of) uses of personal data they wish to prohibit to a requirement that they must explicitly consent ("opt in") to uses they wish to permit. Despite the growing reliance on opt-in rules, there has been little empirical research on their costs. This Article examines the impact of opt-in on MBNA Corporation, a diversified, multinational financial institution. The authors demonstrate that opt-in would raise account acquisition costs and lower profits, reduce the supply of credit and raise credit card prices, generate more offers to uninterested or unqualified consumers, raise the number of missed opportunities for qualified consumers, and impair efforts to prevent fraud. These costs would be incurred despite the fact that as of the end of 2000, only about two percent of MBNA's customers had taken advantage of existing voluntary opportunities to opt out of receiving MBNA's direct mail marketing offers. If Congress were to adopt opt-in laws applicable to financial information, the impact across the economy on consumers and businesses would be significant.

[*pg 746]

Introduction 785 I. The MBNA Experience 785 A. Free-Flowing Information Transformed the Credit Card Industry 785 B. Personal Information as the Cornerstone of the MBNA Strategy 785 II. Dimensions of the Opt-In Versus Opt-Out Debate 785 A. Opt-In Regimes 785 1. Opt-In Regime One¾Third-Party-Sharing Opt-In. 785 2. Opt-In Regime Two¾Affiliate Sharing Opt-In 785 3. Opt-In Regime Three -- Blanket Opt-In 785 B. The Differential Impact of Opt-In Versus Opt-Out 785 III. The Impact of Opt-In on MBNA Products, Services and Customers 785 A. Impact on Affinity Cards, Customers and Prospects 785 1. Acquisition of Member Lists 785 2. Culling Prospect Lists to Target Solicitations. 785 B. Impact on Cross-Selling 785 1. Cross-Selling as Customer Service. 785 2. The Impact on Efficient Corporate Organizational Structure 785 C. Impact on Efforts to Prevent and Detect Fraud and Identity Theft 785 Conclusion 785

INTRODUCTION

The free flow of information has become a defining characteristic of the New Economy in the United States.¹ Economists have long recognized that the costs of acquiring information and arranging transactions are like sand in the gears of commerce.² Markets function more efficiently when it is less costly to identify and design the right product for the right consumer and deliver it at the right time. Many [*pg 747] of the factors underlying the remarkable growth in productivity during the 1990s, including just-in-time delivery, total quality management, and electronic commerce, are a consequence of advances in information technology that support the rapid acquisition and transfer of information.

The financial services sector has benefited substantially from these advances in information technology, especially through the industry's use of personally identifiable information. As Comptroller of the Currency John Hawke, Jr., testified before Congress in 1999, the financial services market is an "information-driven industry . . . . Information exchanges thus serve a useful and critical market function that benefits consumers and financial institutions alike, in facilitating credit, investment, insurance and other financial transactions."³

Much of that essential information relates to individuals and their specific transactions. Notwithstanding the resulting benefits, surveys over the past decade document that consumers have become increasingly sensitive about the collection and commercial use of personal information (financial and otherwise) by businesses. In a 1999 IBM/Harris survey, 94 percent of Americans said they were worried about "possible misuse" of their personal information, and 80 percent thought that "consumers have lost all control over how personal information about them is collected and used by companies."⁴ Consumer surveys suggest a growing demand for privacy, as that term refers to the ability to control or conceal the use of information about oneself, at least in certain circumstances.⁵

The explicit assignment of property rights to the use of personal information in U.S. law has lagged far behind the development of technology to capture and transfer such information, but it is begin-[*pg 748] ning to catch up.⁶ With a few exceptions, until the late 1990s, firms were legally able to use and exchange most customer and transaction data. The primary constraint on information exchange was the threat of alienating privacy-sensitive customers. Judging from consumer privacy surveys, market discipline in the form of potential customer attrition over privacy issues has grown steadily throughout the past decade, making that constraint more binding. Over the past five years, the concept that consumers should have the legal right to exercise some degree of choice over commercial use of personal information has become an accepted principle underpinning public policy toward privacy in the United States.⁷ However, the form in which that choice must be offered is far from settled.

One approach to giving consumers control over how data about them is used is an "opt-out" system. Under opt-out, consent to a specified use of information may be inferred from the fact that an entity gave the consumer notice of the intended use and an opportunity to restrict it, but the consumer did not object. In those industries in the United States, where laws currently mandate that consumers be given a choice, opt-out is the consent system most commonly used.⁸ However, legislation being proposed with increasing frequency at both the federal and state levels would require that firms obtain explicit consent from individuals before collecting, using or exchanging [*pg 749] information about them.⁹ Such "opt-in" rules have already been incorporated into many European data protection laws,¹⁰ and have been adopted in federal regulations¹¹ and local ordinances.¹²

Despite the widespread debate over, and growing reliance on, opt-in rules, there has been little empirical research on the costs of opt-in and differences, if any, between, the cost of opt-in and opt-out systems. Policymakers are increasingly considering, and in some instances adopting, opt-in rules without any sense of their practical impact on consumers, business, or the economy.

Research about the relative costs of opt-in versus opt-out rules would be irrelevant in a world of costless transactions. A Coasian view of bargaining over the rights to use personally identifiable information concludes that if negotiating and contracting is costless, the usage rights will accrue to the party with the greatest value, regardless of the initial assignment.¹³ That is to say, if the consumer places a suf-[*pg 750] ficiently high value on privacy, she can pay the company a sum sufficient to persuade it not to transfer the information to a third party (or, possibly, to discourage the reuse of the information by the company itself in preparing subsequent marketing messages). Possibly this payment could be in the form of foregone discounts that are otherwise available to consumers who consent to subsequent usage.

Where corporations incur positive costs to contract for the use of information, the initial assignment of rights and rules governing information usage has economic consequences. In this Article, we demonstrate that although the opt-in versus opt-out approaches sound similar, they differ dramatically in their practical impact on, and economic consequences for, both companies and individuals. The following case study assesses the impact of requiring a large U.S.-based financial services provider to obtain explicit consent from consumers before using personal information about them. We conclude that opt-in requirements mandated uniformly across the U.S. economy could threaten the viability of key services and products offered by U.S. financial services companies.

To illustrate the costs of moving to an opt-in system, we examine MBNA Corporation, a financial institution that offers consumers a variety of loan and insurance products (primarily credit cards), takes deposits, but operates entirely without a branch network. Incorporated in 1981 and publicly traded since 1991, the company has compiled a stunning growth record in just two decades. As of the end of 2000, the company provided credit cards and other loan products to 51 million consumers, had $89 billion of loans outstanding, and serviced 15 percent of all Visa/MasterCard credit card balances outstanding in the United States.¹⁴

MBNA's ability to access and use information about potential and existing customers is largely responsible for it becoming the second largest credit card issuer in the United States in less than twenty years.¹⁵ To appreciate the critical role that the sharing of information has played in MBNA's remarkable history, one need only reflect on the challenge of acquiring 51 million customers with no brick-and-mortar stores or branches. Like firms in a variety of businesses, but especially financial services, MBNA harnessed information technol-[*pg 751] ogy as the engine for establishing and building customer relationships without ever physically meeting its customers. By using direct mail, telephone and, most recently, Internet contacts, the company has reached out to new prospects throughout the population, regardless of where they live, with offers tailored to their individual interests.

Part I of this Article discusses how MBNA currently uses personal information to bring products and services to existing customers and new prospects. Part II examines the opt-in versus opt-out debate, and the practical experience of U.S. companies with opt-out systems, in greater detail. Against this backdrop, in Part III, we examine the implications of opt-in rules that would restrict the flow of personal information into MBNA from external sources, and within MBNA through artificial barriers to sharing across affiliates. Through a series of specific examples we illustrate how opt-in laws neutralize many of the productivity gains generated by advances in information technology. These examples are cast specifically in terms of MBNA's products, services and customers, but most are also typical of the operations of the top ten credit card issuers who collectively held over 80 percent of the $605 billion in bank credit card receivables outstanding in the United States as of the end of 2001.¹⁶ Consequently, the lessons learned from examining the impact of opt-in on MBNA can be generalized across the credit card and financial services industries, and, more generally, to any business that substitutes information for physical contact in developing a customer base.

I. THE MBNA EXPERIENCE

A. Free-Flowing Information Transformed the Credit Card Industry

The credit card industry provides a compelling example of the power of information-sharing to transform a market, expand consumer choice, enhance service, and lower prices. MBNA was one of the leading players contributing to that transformation. Through the late 1970s, the majority of credit cards were provided to consumers through their local financial institutions. Choice was limited to issuers who happened to offer a card product through a local bank or other financial institution. Customers in smaller towns had fewer choices than residents of large cities. Local institutions faced little competition from financial institutions from other states or regions, and so [*pg 752] had little incentive to offer new card products, new services or lower prices.¹⁷

All of this began to change in the early 1980s. A key Supreme Court decision in 1978 gave national banks the ability to launch national credit card marketing programs at far lower cost than before.¹⁸ The ability to acquire information about potential cardholders -- irrespective of location -- made it possible for companies to enter new geographic markets, often with astounding speed.¹⁹ Both the established full-service banks with credit card programs, such as Citibank, Bank of America, First Chicago, Chase, and upstart, branchless, "monoline" entrants, like MBNA, Providian, First USA, and, later, Capital One, began national marketing campaigns.²⁰ These issuers used credit reports and other externally acquired information to identify and target low-risk borrowers for their low-rate cards throughout the United States.

Beginning in the mid-1980s, retailers and manufacturers, such as Sears (Discover card), General Motors, AT&T, and General Electric also began introducing their own "co-branded" bank credit cards as unique alternatives to the traditional Visa and MasterCard products being offered by banks.²¹ These entrants combined data about existing customers of their corporate affiliates with information from credit reports and other external sources to identify and reach likely pros-[*pg 753] pects. Many of these new products came without an annual fee and provided cash rebates or free products and services each year depending upon charge volume. Other new versions of the bank credit card product, including those offered by MBNA, allowed consumers to demonstrate loyalty to, and generate financial support for, an alma mater or professional organization by using cards embossed with the institution's logo. Thanks to the success of those new market entrants, cards offering frequent traveler miles, rebates and other consumer benefits have become commonplace.

The wave of new entrants to the bankcard market put great downward pressure on the finance charge rate and annual fees charged by existing issuers. In ways to be described in the following Sections, accessible third-party data, credit bureau data (authorized by the Fair Credit Reporting Act), and data about the existing customers of corporate affiliates made it possible for new entrants to identify and target low-risk borrowers for their low-rate cards wherever they were located. Competitors knew no borders. Existing issuers began to lose many of their customers -- including their lowest risk, most profitable ones -- to national competitors.²² All of this was possible because information that signaled which consumers had the potential to become new cardholders negated some of the advantages of the incumbent issuers.²³ Information about existing and potential customers therefore facilitated national competition among card issuers, the entry of new issuers, and the development of new card products and options.

Incumbent issuers were forced to make a choice: either (1) leave their rate unchanged and risk defection of their best customers to the new, low-rate entrants, or (2) cut finance charge rates and fees. In late 1991, to slow customer defections, American Express became the first [*pg 754] major issuer to unveil a tiered pricing structure. Holders of American Express' Optima card with a high charge volume and no delinquency in the previous twelve months, received a low 12.5 percent rate on their revolving balances, well below the average 18 to 20 percent rates typically charged. This was the beginning of sophisticated risk-based pricing within major credit card portfolios. Shortly thereafter, Citibank announced a similar pricing structure for its Classic cardholders, who had been paying 19.8 percent. Citibank officials estimated that, by the end of 1992, nine million Citibank Classic cardholders would benefit from the new tiered rate structure.²⁴ The proportion of all revolving balances in the United States being charged an APR greater than 18.0 percent plummeted from 70 percent to 44 percent in just twelve months (see Figure 1).

*Proportion of outstanding bank card balances.
Source: CARDTRAK (CardTrak of Am., Inc., New York, N.Y.), Aug. 1995, at 1;
CARDTRAK (RAM Research Corp., New York, N.Y.), Apr. 1993, at 1.

The ability of new entrants to use personal information to establish and cultivate relationships with customers thousands of miles away has transformed the competitive landscape in the United States, injecting intense price and service competition into the credit card [*pg 755] market, which had not been historically noted for either.²⁵ Economists Richard Schmalensee and David Evans reinforce this point:

The industry has expanded robustly in the past twenty years. Output measured by the number of cards issued, the amount charged on cards, and the amount of charges that are financed, has risen dramatically. Prices, measured by the average revenue issuers receive after adjusting for charge-offs, have fallen. . . . The expansion of this industry has taken place through both the continual entry of new issuers and the growth of existing ones.²⁶

Regarding the choices now available to consumers as a result of national marketing campaigns, Schmalensee and Evans further observe that

[a] 1998 Federal Reserve System survey of 148 of the largest credit card issuers in the United States found that seventy-two issuers distribute their cards nationally. . . . Consumers in Chicago, for instance, can therefore obtain cards from more than seventy national issuers in addition to many more local and regional issuers. Consumers have more choice in their credit card issuer than they have for many other services. For example, in Chicago a typical consumer can choose among fifteen grocery store chains, twenty-seven health maintenance organizations, and eighty-two national or regional newspapers.²⁷

Tiered, risk-based pricing according to portfolio segment has made it possible for any given company to serve a broad range of customers. "Many card issuers that in the past offered programs with a single interest rate now offer a broad range of card plans with differing rates depending on credit risk and consumer usage patterns."²⁸ [*pg 756] Consequently, new entrants not only triggered a dramatic reduction in credit card pricing to lower-risk customers, but also substantially broadened access to the bank credit card product to millions of higher-risk households. Figure 2 illustrates the dramatic increase in the percentage of U.S. households owning at least one bankcard between 1983 and 1998. The largest increases in card ownership occurred in the lower income segments of the population.

**Percent of households with at least one bank card.
Source: Fed. Reserve Bd., Survey of Consumer Finances: 1998 Survey Data, at http://www.federalreserve.gov/pubs/oss/oss2/98/scf98home.html (last visited Mar. 30, 2003); Fed. Reserve Bd., Survey of Consumer Finances:
1983 Survey Data, at http://www.federalreserve.gov/pubs/oss/oss2/98/scf83home.html (last visited Mar. 30,
2003).

MBNA is the epitome of the new credit card entrant, and it has succeeded better than most. MBNA was incorporated in Delaware in 1981 as the credit card subsidiary of Maryland National Bank with an initial base of 600 thousand credit card accounts and $209 million in [*pg 757] receivables.²⁹ The company grew to 7 million accounts during its first decade. Following its initial public offering in 1991, the customer base grew from 7 million to 51 million during its second decade, with $89 billion of receivables at the end of 2000. Not only did millions of MBNA cardholders gain access to a versatile credit card product, but the threat of losing business to companies like MBNA put competitive pressure on the incumbent card issuers in the industry to lower their prices and broaden their product selection, benefiting all cardholding consumers.

B. Personal Information as the Cornerstone of the MBNA Strategy

The slogan on the cover of MBNA's 2000 Annual Report summarizes the company's strategic plan: "Success is getting the right customers and keeping them."³⁰ Like most major credit card issuers today, MBNA identifies prospects, establishes relationships, anticipates customer needs, and provides personalized service, but does all this without meeting its customers in person. How does it find new prospects and service existing customers without branches or stores?

At the core of its marketing and targeting strategies is the proposition that consumers who share a common institutional bond or experience will have an affinity for using a card that lets them demonstrate their affiliation each time they use it to pay for a purchase. The affinity for the institution raises the probability that a prospect will be converted to a customer. Equally important, the institution or organization usually maintains a list of members on which MBNA can focus its marketing efforts. Following this "affinity group" marketing strategy, MBNA designs a card product tailored to members of a particular group, negotiates a financial arrangement with the organization for the exclusive rights to market an affinity card to its members, and uses the member list as a source of potential names to contact via direct mail or telemarketing.

Over 4,700 affinity organizations endorse MBNA products to their members and receive financial benefits from the company in return.³¹ A sampling of that list includes:

[*pg 758]

the professional organization sector of the card portfolio includes over 1,400 professional organizations. The company reports that MBNA affinity cards are carried in the United States by 72 percent of all physicians, 68 percent of all dentists, 59 percent of all nurses, 53 percent of all lawyers, and 52 percent of all engineers;³²

nearly 4 million alumni and students of over 700 colleges and universities use MBNA products endorsed by their alumni associations or schools;³³

9.1 million people carry MBNA credit cards featuring their favorite sports teams, racecar drivers or other sports-related activities;³⁴

hundreds of affinity programs have been created for people with a common interest but no formal organization (e.g., "Don't Mess with Texas" card; Irish-American heritage card).³⁵

Design of new affinity cards is an ongoing process. In 2000 alone, MBNA acquired the endorsements of 459 new groups, including the United States Tennis Association, the Atlanta Braves, National Audubon Society, barnesandnoble.com, and the Thurgood Marshall Scholarship Fund.³⁶

Although targeting prospects through affinity groups has proven to be a clever strategy, not every group member is offered a card product. The key to the company's profitability and earnings growth, especially given the rapid growth in the size of the customer base, has been in screening the prospects from each affinity group to identify those likely to be quality customers. Given that MBNA's fundamental business is lending money via an unsecured credit card with a revolving line of credit attached, the company wants to put the card in the hands of customers who will use it, but who will not default on [*pg 759] their balances. Consequently, MBNA uses information to screen prospects both before it makes card offers (the targeting process) and after it receives applications (the underwriting process).

The combination of affinity marketing and stringent underwriting means that consumers are more likely to be offered products that are appropriate for them¾and that fewer consumers are bothered with offers that are inappropriate for them. Across the entire portfolio, MBNA customers carry balances about 52 percent higher than the industry average ($3,519 for MBNA versus $2,311 industry-wide), and have an average transaction size 30 percent higher than the industry average ($129 per card use for MBNA versus $99 industry-wide).³⁷ At the same time, the portfolio delinquency rate was 4.49 percent, and net credit losses at the end of 2000 were 4.39 percent of average managed receivables,³⁸ both well below the credit card industry average delinquency rate of 4.91 percent and charge-off rate of 6.67 percent.³⁹

By the end of 2000, MBNA had experienced forty consecutive quarters of growth in earnings per share.⁴⁰ Standard and Poor reported that MBNA had the best five-year annualized return of any bank in the S&P 500. CIO magazine named MBNA one of the top 100 companies in the United States for excellence in management and strategic use of technology.⁴¹ For the year 2000, Business Week gave MBNA its fourth consecutive best-in-industry rank and inclusion in the Business Week 50, an annual ranking of America's best performing companies.⁴² However, the ultimate testament to the viability of the MBNA business model for delivering value to consumers is that the number of customers using the company's products and services has grown from several hundred thousand to over fifty million in just eighteen years. Through the responsible use of personal information, MBNA has not only built itself into one of the United States' most successful financial services companies, meeting the needs of more [*pg 760] than 50 million customers; it has also contributed significantly to increasing the availability and lowering the price of retail credit for all consumers.

II. DIMENSIONS OF THE OPT-IN VERSUS OPT-OUT DEBATE

A. Opt-In Regimes

A common theme that implicitly runs through both federal and state laws in the United States is that governmental privacy protections are only permitted when they target specific types of information and providers, and where a balancing test can be reasonably construed to warrant government intervention. The Supreme Court has struck down many ordinances that would require affirmative consent before receiving door-to-door solicitations,⁴³ before receiving Communist literature,⁴⁴ even before receiving "patently offensive" cable programming.⁴⁵ The words of the Court in the first case -- involving a local ordinance that banned door-to-door solicitations without affirmative householder consent -- are particularly apt:

Whether such visiting shall be permitted has in general been deemed to depend upon the will of the individual master of each household, and not upon the determination of the community. In the instant case, the City of Struthers, Ohio, has attempted to make this decision for all its inhabitants.⁴⁶

The Tenth Circuit reached precisely the same conclusion in 1999, when the court struck down the Federal Communications Commission's (FCC) opt-in rule for the use of telephone subscriber information.⁴⁷ The appellate court found that the FCC's rules were subject to First Amendment review because, by limiting the use of personal information when communicating with customers, they restricted U.S. West's speech. Although the court applied intermediate scrutiny, it determined that under the First Amendment, the rules were presumptively unconstitutional unless the FCC could prove otherwise by demonstrating that the rules were necessary to prevent a "specific and [*pg 761] significant harm on individuals," and that the rules were "'no more extensive than necessary to serve [the stated] interests.'"⁴⁸

Although we may feel uncomfortable knowing that our personal information is circulating in the world, we live in an open society where information may usually pass freely. A general level of discomfort from knowing that people can readily access information about us does not necessarily rise to the level of a substantial state interest for it is not based on an identified harm.⁴⁹

The court found that for the FCC to demonstrate that the opt-in rules were sufficiently narrowly tailored, it must prove that less restrictive opt-out rules would not offer sufficient privacy protection, and it must do so with more than mere speculation:

Even assuming that telecommunications customers value the privacy of [information about their use of the telephone], the FCC record does not adequately show that an opt-out strategy would not sufficiently protect customer privacy. The respondents merely speculate that there are a substantial number of individuals who feel strongly about their privacy, yet would not bother to opt-out if given notice and the opportunity to do so. Such speculation hardly reflects the careful calculation of costs and benefits that our commercial speech jurisprudence requires.⁵⁰

The court found that the FCC had failed to show why more burdensome opt-in rules were necessary, and therefore struck down the rules as unconstitutional. The fact that the information was being used for purposes other than publication was irrelevant. The Supreme Court declined to review the case.⁵¹

Despite the constitutional issues that opt-in raises, opt-in proposals aimed at providers of financial services have proliferated in recent years at both the federal and state levels. Proposed opt-in laws take many forms. Indeed, one of the problems muddying the ongoing debate over opt-in and opt-out is a lack of specificity about the scope of coverage (i.e., exactly what types of information sharing and usage is the consumer being given the opportunity to approve). For purposes of this study we discuss examples that illustrate the impact of three distinct and successively more restrictive opt-in regimes. The [*pg 762] three regimes described below are points along a continuum of rules that range from no restrictions on the sharing of personal information at one extreme to explicit consumer permission for the use of any kind of personal information at the opposite extreme. Elements of each of these regimes can be found in laws already enacted in the United States and Europe and in major proposals for new opt-in legislation currently pending before state legislatures and Congress. 1. Opt-In Regime One¾Third-Party-Sharing Opt-In. The least restrictive set of rules that we consider are opt-in laws that would permit an organization's internal use of personal information about customers or members, but would require opt-in consent before personal information could be disclosed to third parties outside the organization. This type of opt-in can be found in bipartisan proposals that would amend the privacy provisions of the Gramm-Leach-Blilely Financial Services Modernization Act (the GLB Act) that cover the use of personal information by financial institutions.⁵² A similar application of opt-in principles governing data sharing with third parties has been suggested in a number of states for businesses other than financial institutions. Opt-in limits on certain kinds of public records have also been proposed or enacted, such as the 1999 amendments to the federal Drivers Privacy Protection Act.⁵³ Those amendments generally prohibit state motor vehicle departments from disclosing information from motor vehicle registration records (such as owner's age and the type of car owned) without first obtaining opt-in consent. As we explain in the next Section, the adoption of opt-in rules for third-party sharing would affect MBNA mostly by reducing or eliminating certain types of information from external sources upon which the company depends. 2. Opt-In Regime Two¾Affiliate Sharing Opt-In. Moving toward the more restrictive end of the spectrum, the second opt-in regime we [*pg 763] consider would limit the sharing of personal information across corporate affiliates within the same organization, as well as with third parties. Affiliate sharing of personal information is a key issue in proposed amendments to the GLB Act and in proposed legislation in many states. In essence, the debate centers on whether separate affiliates under a single corporate umbrella should be treated as third parties. At present, most U.S. privacy laws (including the GLB Act) do not apply an opt-in standard to information sharing among affiliates, but bills pending in Congress and at the state level propose to do so, and ordinances adopted by local municipalities have already done so.⁵⁴

The irony in the proposed opt-in amendments to the GLB Act is that the Act itself was predicated on the concept that many financial services could be offered at lower cost to consumers if provided by affiliated companies under a single corporate umbrella, rather than kept separate by artificial limits on the scope of services that could be provided by a single company.⁵⁵ Accordingly, the privacy provisions of the GLB Act established tiered consent rules regarding the sharing of personal financial information.⁵⁶ The GLB Act requires financial institutions to offer customers a mechanism to opt-out of data sharing with third parties, but does not give consumers the option to limit the sharing of such information across the institution's corporate affiliates, or its partners in joint marketing agreements.⁵⁷

The rationale for putting fewer limits on data-sharing among affiliates reflects two significant considerations. First, the responsible sharing of information among affiliates creates demonstrable benefits for the customer, as illustrated by the examples below. Second, as a practical matter, consumers expect different divisions of the same [*pg 764] company to know them and to offer services and benefits based on that knowledge. A consumer's decision to do business with a company carries an implicit approval (and expectation) of information-sharing under the corporate umbrella. This is true whether the affiliate is a credit card division of a bank or the auto servicing division of a major retail store chain. The expectation of information-sharing is especially true if affiliates are all operating under the same brand name, such that the affiliate distinction is invisible to the consumer (and often even to company employees).

Corporations organize themselves into divisions that may or may not exist as separately owned affiliates for a variety of reasons including federal and state tax laws, licensing rules and insurance regulations. For these and other legal reasons, MBNA Corporation is organized into the affiliated subsidiary units listed below.⁵⁸

MBNA America Bank, N.A. The principle subsidiary of MBNA Corporation, MBNA America is a national bank with $87.7 billion in managed loans.
MBNA Europe. This subsidiary issues credit cards in the United Kingdom and Ireland.
MBNA Canada. This subsidiary issues credit cards in Canada.
MBNA Insurance Agency, Inc. Markets and services credit-related Life and Disability, personal Property and Casualty, and Life and Health insurance products.
MBNA Marketing Systems, Inc. Maintains and operates telephone sales facilities to support account acquisition and cross-sell consumer loan, deposit and insurance products; facilities are located in Delaware, Florida, Maine, Maryland, New Hampshire, Ohio, Pennsylvania and Texas.
MBNA Hallmark Information Services, Inc. Provides information technology support and services to MBNA America bank and its affiliates; headquartered in Texas.
MBNA.com. The online division of MBNA Corporation; allows customers to access their account information, apply for new credit products, shop for other products and services, plan and finance travel, and open deposit accounts.

[*pg 765]

An affiliate opt-in regime would restrict the sharing of personal information about prospects and customers across these corporate divisions, all of which operate under the MBNA brand name and under its direct management, despite the fact that customers are likely unaware of the legal distinctions that make certain divisions "affiliates." 3. Opt-In Regime Three -- Blanket Opt-In. In the most restrictive of the three scenarios we consider, opt-in consent would be required for any internal use of personal information subject to exceptions specified in the law (such as for collecting debts, performing requested services, or providing product recall and safety notices). Examples of this form of opt-in can be found both in the United States and abroad. The FCC adopted this type of opt-in system when it prohibited telephone companies from using information about their customers' calling patterns for marketing new services without first obtaining those customers' explicit consent.⁵⁹ The European Union's Data Protection Directive also mandates such a system.⁶⁰ The impact of blanket opt-in will obviously depend upon the scope of information uses for which opt-in consent is required (and the companion list of exemptions), but blanket opt-in limits what a business or other organization can do with information it already legally possesses.

B. The Differential Impact of Opt-In Versus Opt-Out

Proponents of opt-in claim that requiring explicit consent for the use of personal information gives consumers greater privacy protection than an opt-out system.⁶¹ But, in fact, both opt-in and opt-out give consumers the final say about whether their personal information is used. Neither approach gives individuals greater or lesser rights than the other. Under both systems the customer makes the final and binding determination about data use. However, there is a [*pg 766] stark difference between the opt-in and opt-out systems in terms of their cost.

A pipeline analogy is helpful in thinking about how opt-in versus opt-out rules affect the flow of personal information through the economy. An opt-out system sets the default rule governing use of personal information to "free flow." In essence, opt-out presumes that consumers do want the benefits (greater convenience, wider range of services, and lower prices) facilitated by a free flow of information, and then allows people who are particularly concerned about privacy risks to remove their information from the pipeline. In contrast, an opt-in system sets the default rule to "no information flow," under the presumption that consumers harbor greater concern about the risk of information usage than the loss of benefits consequent to shutting off the flow. Under an opt-in system, those benefits evaporate unless consumers explicitly grant permission for information about them to flow in the pipeline.

By setting the default rule to "no information flow," an opt-in system restricts the information lifeblood on which today's economic activity depends. Companies that seek to use personal information to enter new markets, target their marketing efforts, and improve customer service must restore the information flow by contacting one customer at a time to gain their individual permission to use information. Consequently, an opt-in system for giving consumers choice over information usage is always more expensive than an opt-out system. Opt-in requires that every consumer be contacted individually to gain an explicit consent. In contrast, opt-out is less costly because it infers permission if consumers do not explicitly object. Information about consumers who are either indifferent about the usage or for whom it matters so little as to not be worth the trouble of responding remains in the pipeline.

How large a drag does an "explicit-consent" system impose on economic efficiency? According to the U.S. Postal Service, 52 percent of unsolicited mail in this country is never read.⁶² If that figure translates to opt-in requests, then more than half of all consumers in an opt-in system would lose the benefits or services that could result from the use of personal information because the mandatory request for consent would never receive their attention. Moreover, even if an unsolicited offer is read, experience with company-specific and indus-[*pg 767] try-wide opt-out lists demonstrates that less than 10 percent of the U.S. population ever opts out of a mailing list -- often the figure is less than 3 percent.⁶³ Indeed, the difficulty (and cost) of obtaining a response of any sort from consumers is the primary drawback of an opt-in approach.

Under an opt-out system, the failure of consumers to respond does not limit either the use of information about them in the market or the benefits that flow from such use. Under opt-in systems, however, the failure to respond makes the collection and use of personal information illegal in the absence of explicit consent. To the extent that consumers do not respond to requests for opt-in consent¾whether due to the failure to receive or read them, lethargy, confusion, or the competing demands of modern life¾their inaction amounts to a total prohibition on the collection and use of information about them.

In addition, because opt-in requires specific, individual contact with each consumer, such a system imposes higher costs that may make the proposed use of information, and the services and products that depend on that use, economically untenable even for those consumers who would have opted in. In 1997, U.S. West (now Qwest Communications), one of the largest telecommunications companies in the United States, conducted one of the few affirmative consent trials for which results are publicly available. In that trial, the company sought permission from its customers to utilize information about their calling patterns (e.g., volume of calls, time and duration of calls, etc.) to market new services to them. The direct mail appeal for permission received a positive response rate between 5 and 11 percent for residential customers (depending upon the size of a com-[*pg 768] panion incentive offered by the company).⁶⁴ Residential customers opted in at a rate of 28 percent when called about the service.⁶⁵

When U.S. West was actually communicating in person with the consumers, the positive response rate was three to six times higher than when it relied on consumers reading and responding to mail.⁶⁶ But even with telemarketing, the task of reaching a customer is daunting. U.S. West determined that it required an average of 4.8 calls to each consumer household before they reached an adult who could grant consent.⁶⁷ In one-third of households called, U.S. West never reached the customer, despite repeated attempts.⁶⁸ In any case, many U.S. West customers received more calls than would have been the case in an opt-out system, and despite repeated contact attempts, one-third of their customers missed opportunities to receive new products and services.⁶⁹ The approximately $20 cost per positive response in the telemarketing test and $29 to $34 cost per positive response in the direct mail test led the company to conclude that opt-in was not a viable business model because it was too costly, too difficult, and too time intensive.⁷⁰

Undoubtedly, explicit consent is easier to obtain in some settings. For example, online requests for consent that require a response prior to advancing into a website reduce the nonresponse problem, although there is mounting evidence that consumers click through these notices without reading them in an effort to obtain the desired products and services. However, direct mail response rates and the very few publicly available studies of telemarketing opt-in campaigns suggest that a broad-based opt-in system would be so costly as to pose a [*pg 769] significant risk to the flow of personal information that supports competition and commerce in the United States.

Consequently, for analytical purposes in the following Part, we assume that each opt-in regime effectively blocks the affected forms of data sharing. That is, we assume that the response to opt-in requests would be too small and costly to make the collection and subsequent distribution of such data economically viable. Depending upon the specific data context, this may or may not be a strong assumption. However, the advantage is tractability of the analysis. By posing the issue this way, we can assess the impact on the operations of the business units we study if certain categories of data currently in use were to become unavailable (versus being devalued to some intermediate degree in terms of accuracy, depth, currency, etc.). Consequently, the resulting discussion illustrates the benefits at risk should opt-in be broadly applied without implementing ways for even indifferent consumers to register their opinions at little or no cost to themselves.

III. THE IMPACT OF OPT-IN ON MBNA PRODUCTS, SERVICES AND CUSTOMERS

The following examples illustrate how each of the three opt-in regimes described in the prior Part would affect both MBNA and its customers. At the outset we note that MBNA does not derive revenue streams from selling information about its customers to third parties. Rather, it purchases information from third parties, gathers information from its own affiliates, and makes extensive use of that data to identify those consumers to whom offers of credit cards and other products should be made. Consequently, broad-based opt-in rules impact MBNA by restricting its ability to collect and use it to deliver products and services to customers and prospects. The examples below do not catalog all the effects of various opt-in laws. Instead, they have been selected to illustrate the broad and often subtle impact that a rule as seemingly innocuous as requiring affirmative consent can have on businesses and consumers alike.

A. Impact on Affinity Cards, Customers and Prospects

Any of the opt-in regimes would substantially increase the cost to MBNA of booking new credit card accounts, result in more defaults on credit accounts, increase the cost of providing credit cards, and threaten the company's economic viability. [*pg 770]

1. Acquisition of Member Lists. MBNA's core product is the affinity card tailored for and marketed to each of more than 4,700 affinity groups. As discussed in Part II, the foundation of MBNA's affinity strategy is access to the member lists of each of its affinity organizations. This marketing partnership with thousands of member organizations nationwide makes MBNA unique among major credit card issuers and accounts for much of the company's superior financial performance and reputation for outstanding customer service. However, in the absence of an explicit joint-marketing exception in an opt-in law, a third-party opt-in regime could effectively end MBNA's unique direct marketing approach by sharply limiting an organization's ability to share its member list.⁷¹ One result could be that no new affinity programs would be created for the benefit of the organization's members, and existing programs would wilt over time, because acquisition of new member names and addresses would be subject to the opt-in requirement. Had a third-party or blanket opt-in statute existed twenty years ago, MBNA likely would not have built account base around the affinity marketing strategy. 2. Culling Prospect Lists to Target Solicitations. Like all major credit card issuers, MBNA uses personal information to increase the chance that its credit card offer will reach an interested and qualified customer. This process greatly reduces the number of solicitations that must be sent to achieve a given target volume of new accounts, thereby reducing the cost of account acquisition. It also reduces the volume of junk mail in the form of card offers sent to consumers who are not qualified. Third-party or affiliate opt-in systems would eliminate MBNA's access to a significant portion of the information that it currently uses to identify which individuals on the member lists it receives would be good prospects for a given credit card or other product. A blanket opt-in system applicable to marketing activities would impose similar limits.

[*pg 771]

The MBNA direct mail marketing operations obtain and consider about 800 million consumer "leads" during the course of a year.⁷² The vast majority of these leads are names that appear on affinity group member lists (e.g., university alumni groups and professional associations), or names of consumers who are customers of institutions that have endorsed MBNA's credit card product. Because this is an annual figure, many names appear more than once because the individuals are on more than one list acquired during the course of a year, or may be considered in conjunction with a specific group's marketing campaign several times during the year.⁷³ The most creditworthy names among them may receive multiple solicitations during the year.

MBNA does not wish to mail to all names on the list. Not all are equally likely to respond to a solicitation, nor will all meet the credit underwriting standards for a particular card product. In 2000, the MBNA direct marketing budget supported approximately 400 million mailings of card offers.⁷⁴ The challenge to the company in managing the acquisition of new accounts is to cull the "lead list" of 800 million prospect names to identify and target the 400 million direct mail solicitations to consumers who are most likely to become new cardholders. Generally speaking, MBNA has developed a set of targeting criteria such that names reaching the final mailing list of 400 million: (1) are most likely to respond to the offer and the use of the credit card, and (2) are most likely to meet MBNA's creditworthiness standards for the card.

MBNA prepares hundreds of distinct solicitations throughout the year for its various affinity groups. As part of the targeting process for each new solicitation, the prospect list is scrubbed via comparison to a series of "suppression files" that the company maintains and routinely updates. These files pull information about either individu-[*pg 772] als or addresses from a variety of internal and external data sources. A few examples of the specific criteria illustrate the process.

Use of public records. The company builds and maintains a list of business addresses and prison addresses that it uses to pare the "prospect" list. In large part these address lists are acquired from external sources. These screens result in about one million names being dropped from the annual prospect list.⁷⁵ Another one million names may be eliminated after being matched against a file of deceased individuals obtained from external public record sources.⁷⁶ Altogether, perhaps twenty million names are suppressed based on all kinds of public record information obtained externally.⁷⁷

Response modeling. Like most direct marketers, MBNA has developed proprietary response models that help it determine which customers are likely to respond to offers for a credit card, or a card with particular features. These models are based on the company's past experience with solicitations, and were developed from analyses of the demographic and credit characteristics of those who have accepted past card offers versus those who did not respond. For these models to be useful, MBNA must gather some demographic information from external sources about its prospects. The models use this information to gauge the likelihood of response. Those least likely to respond are dropped from the list. Removing the likely nonresponders would reduce the prospect list by another forty-five to fifty million names.⁷⁸

Creditworthiness . Likelihood that a cardholder will repay, of course, is another key component of a well-targeted credit card solicitation. MBNA's large national portfolio gives it credit history information for many of the consumers on the prospect list because they already have another card or loan account with the company. For a variety of credit-related reasons, including past or current delinquency, or high existing balances outstanding relative to payment ability, typically another 100 to 120 million names will be eliminated from the prospect list because they do not meet MBNA's underwriting standards for a particular card offer. The individuals dropped from the target list exhibit a higher risk of delinquency or probability of a loss at the time the solicitation mailing is prepared than those [*pg 773] who remain on the list.⁷⁹ Credit information can also identify those consumers who, due to their extraordinary creditworthiness, are probably solicited frequently by card issuers and are consequently not likely to respond to yet another offer. Perhaps another twenty to twenty-five million names fall into this category of "unlikely to respond" and are dropped.⁸⁰

The bottom line from the culling process is that approximately 40 percent of the eight hundred million names are suppressed.⁸¹ The initial lead list is typically reduced by an additional 10 percent through a combination of eliminating duplicate records, suppressing undeliverable addresses, and dropping customer names that appear on various "do not mail" lists that record customer preferences not to be solicited.⁸² This last point will be addressed in greater detail below. The approximately four hundred million names remaining on the lead list receive targeted direct mail offers with the endorsement of the affinity group to which they belong.

Both third-party and affiliate-sharing opt-in regimes would dramatically limit MBNA's ability to access the information necessary to determine which of the eight hundred million "leads" it receives are appropriate candidates to receive card offers. So even if a third-party opt-in regime exempted the exchange of organization member lists through some type of joint-marketing exception, opt-in rules would still impose costs on both MBNA and consumers by reducing the availability of the other external and internal data upon which the company relies to refine its targeted marketing.

For purposes of this case study, we worked with MBNA analysts to estimate the likely impact of various opt-in rules on its ability to effectively target its offers to prospective cardholders. For analytical purposes, we assume that opt-in rules prevent the company from using three categories of information that it normally uses to screen prospect lists. Specifically, we assume that third-party and affiliate [*pg 774] opt-in rules (1) prevent MBNA from accessing data from companies that collect and sell public record information, (2) eliminate MBNA's sources of external demographic information on prospects, and (3) block the utilization of credit information about a prospect who also held another MBNA account unless that credit information was based exclusively on the customer's handling of the MBNA account. That is, MBNA could use only its own experience with that customer, but could not use information it might have on that customer based on a credit report, such as balances with other creditors or a bureau-based risk score.⁸³

MBNA's proprietary response models indicate that its use of information in these three categories to cull likely prospects accounts for approximately a 19 percent reduction in names from the annual prospect list.⁸⁴ In other words, by targeting offers under current rules, about 150 million names on the prospect list during the course of a typical annual solicitation cycle do not receive solicitations, because the direct mail piece would otherwise reach a consumer who was either not interested or not qualified for the card product.

The loss of the information used to cull these names from the prospect list blurs the company's view of likely prospects. After the culling process under the opt-in scenario, approximately 550 million names would remain, instead of 400 million under the current rules. Lacking the information necessary to further distinguish good prospects from poor prospects, the company's targeting efficiency would be impaired.

MBNA would have two choices. It could increase its direct mail volume to send solicitations to all 550 million names remaining on the prospect list after the culling process, or it could arbitrarily remove 150 million names from the list after the culling process so that its direct mail volume remained unchanged at 400 million. Under either scenario, approximately 27 percent of the solicitations (150 million of 550 million) would go to consumers who were less interested in, and/or less qualified for, the offer, and who would have been dropped from the target list had MBNA been allowed to access and use the information on which its presently relies under current privacy rules.

[*pg 775]

Under the expanded-mailing option, 150 million solicitations would go to consumers who would have been eliminated from the target list had MBNA been permitted to use the best information available. The resources devoted to the extra mail volume are essentially wasted purely as a result of artificial limits on MBNA's access to more complete information about its prospects. Some unqualified prospects would undoubtedly respond, so MBNA would also incur the extra cost of receiving, reviewing and ultimately rejecting these applications.

Alternatively, suppose that MBNA chooses to leave the direct mail volume unchanged at four hundred million pieces. Without more precise targeting information, MBNA must randomly select 400 million prospects from the 550 million names on the list. The probability of selecting a less qualified prospect onto the final mailing list is 0.273 (150 million out of 550 million). Consequently, we would expect that out of the 400 million recipients of the resulting card offers, 109 million (27.3 percent) will be consumers who would otherwise have been excluded for lack of interest or qualifications. Significantly, this also means that another 109 million consumers who should have received the solicitation (i.e., who the available information would have predicted were both interested in and qualified for the offer), miss out on the opportunity to learn about the product or service. And, the exclusion of these 109 million likely prospects means that the average quality (as measured by expected profitability) of the responses received by MBNA will fall.

Applying the known response and approval rate factors for each of the formerly screened groups, we worked with MBNA analysts to calculate that the net converted rate (percentage of individuals receiving an offer who actually become new cardholders) under the opt-in scenario would fall by 18 percent. This results in a 22 percent increase in the direct mail cost per account booked.⁸⁵

Although MBNA's actual response rate and cost per account booked is proprietary, we can illustrate the impact of the decline by utilizing the credit card industry average response rate to direct mail [*pg 776] solicitations for 2000, which was 0.6 percent.⁸⁶ For every 100 million solicitations mailed to individuals under the opt-in scenario, only 492 thousand new accounts would be booked, as compared to 600 thousand if the offers were targeted under existing rules, an 18 percent reduction in new accounts for the same expenditure on direct mail solicitations. Of course, the higher cost per account booked is borne not only by MBNA, but by MBNA's customers as well, in the form of higher prices, reduced benefits, diminished service, and higher acceptance standards for new credit products.

But, the negative impact does not stop there. Regardless of whether MBNA's response to opt-in is to mail more solicitations or mail the same number to a less-targeted prospect list, under either scenario, the recipient group of four hundred million individuals will -- on average -- be more risky and less profitable than MBNA's target group reached under the current rules. As a result, MBNA's delinquency and charge-off rates will rise, relative to its current experience, thereby imposing additional costs that will be passed along to all of MBNA's customers. Card usage will also be affected by booking cardholders who are less likely to use the card.

In a simulation using MBNA's proprietary data on average card balances, finance charges and operating expenses (based on the company's current experience with new accounts), we determined that the first five years of account activity for the cohort of new accounts generated annually under the opt-in scenario would generate an 8 percent reduction in net income before taxes, relative to the more precisely targeted group acquired under existing rules.⁸⁷ It is important to note that this cost only measures the impact of opt-in on the credit card account acquisition component of MBNA's business, and does not reflect the impact on cross-selling opportunities or customer service. Examples of how opt-in affects these activities are discussed in the next Section.

To summarize, third-party and affiliate opt-in would raise by 22 percent the cost to MBNA of booking a new credit card account via direct mail. In addition, because offers would be sent to customers [*pg 777] less interested in using the card as well as higher risk customers, third-party opt-in would cost MBNA and its shareholders approximately 8 percent of the net income earned before taxes on each new cohort of accounts over a five-year period.

Moreover, only 130 thousand customers have responded to the more than 30 million notices mailed by MBNA alerting them that they could opt-out of the transfer of their credit report information across affiliates. Just over one million customers have opted out of receiving any type of direct mail marketing offers from the company. The move to an opt-in regime would therefore burden 98 percent of MBNA customers with the obligation to act -- to opt in -- to enhance the convenience of the 2 percent of MBNA customers who currently opt-out. This suggests that opt-in will not only hurt MBNA' s revenues and lead to higher prices for credit, but also increase the burden on virtually all of MBNA's customers.

B. Impact on Cross-Selling

1. Cross-Selling as Customer Service. Like most financial institutions, MBNA builds value for its customers by offering them additional financial services tailored to their needs. Mass marketing of products is being supplanted by Customer Relationship Management (CRM), a fundamentally different approach in which customer acquisition (e.g., via a credit card product) is just one stage of a long-term relationship between a business and its customers.⁸⁸

Nowhere are the advantages of CRM more keenly felt than in the financial services industry. An Executive Vice President in charge of the consumer credit division at Wachovia Bank wrote in 1999 that

[i]t used to be relatively simple for a skilled banker to create an effective banking experience for customers. But today there are diverse products, a broader geography, new technology, and new delivery channels. Even the best and brightest bankers cannot service their customers in a customized manner. They must rely on informa-

[*pg 778] tion to direct their efforts more effectively, to personalize the interaction their customers have with the bank . . . ."⁸⁹

The concept of "know your customer" is at once ancient and revolutionary. The nineteenth century shopkeeper built long-term relationships with his customers. The storeowner knew customers personally, could greet them, anticipate their needs, and win their continued business. In today's markets dominated by large corporations, relationships cannot be built around a customer contacting the same company employee every time. Instead technology allows firms of all sizes to collect and store information about customers at every opportunity, and make it available to company employees in order to personalize the service whenever they have contact with customers. In essence, today's company knows its customers through its database.

MBNA offers a variety of financial services in addition to credit cards, including home equity loans, closed-end installment loans, a variety of property, life, and casualty insurance products, and various deposit products. The company's cross-sell challenge is to identify which of its products would be useful to a particular cardholder. Because it never sees its cardholders, the process of getting to know its customers in order to tailor new opportunities must rely solely on the skillful acquisition of relevant data and the use of information technology to translate the data into products and service.

MBNA analyzes card usage patterns and appends additional information acquired from a variety of external sources as well as other MBNA affiliates to put a face on the customer. As a simple but typical example, an MBNA affiliate may build a telemarketing campaign to offer home equity loans to current credit cardholders. The process would begin with a list of existing cardholders who have high balances on their MBNA cards, and match it against an externally acquired list of homeowners. Targeting the solicitation at homeowners avoids the obvious waste of contacting renters for a home equity product. The use of the high-balance cardholder list reduces the likelihood of contacting a cardholder with no current need or interest in tapping a home equity product. Presumably, credit information on the current cardholder (either based on MBNA experience or possibly credit bureau information) would be applied to screen for creditworthiness, [*pg 779] which reduces the potential ill will associated with the company offering a product to an existing customer and later rejecting them.

How would the opt-in regimes impact this home equity offer? Opt-in for third-party sharing would limit the availability of the externally acquired homeowner list. Opt-in for affiliate sharing would limit the ability of the credit card affiliate to share the prospect list with the home equity affiliate. And blanket opt-in applicable to marketing would restrict MBNA's ability to use any customer information to cross-sell. All three regimes would sharply reduce MBNA's ability to get the right offer to the right cardholder. Nascent CRM efforts would be crippled, and cross-selling would revert to the bygone days of blind mass-marketing, generating a higher percentage of offers to unqualified or uninterested consumers.

If the low response rate and potentially high annoyance factor among current cardholders prevented such a marketing campaign from being launched, many cardholders would miss the opportunity to even learn about a useful product. In the example above, customers who maintain high balances on their credit cards would miss the opportunity to reduce both their monthly payments and their interest rate with lower-rate home equity loans.

MBNA's diverse activities offer other examples of lost opportunities to customers as a result of an opt-in applied to affiliate sharing. For example, MBNA will occasionally do direct marketing of closed-end consumer finance loans to consumers who have been rejected for credit cards. The company's ability to find a way to serve that customer, even if not with a credit card, would be impaired if opt-in limited the ability to transfer the rejection list data across the affiliates participating in building the offer.

Consider the reverse situation. Currently, the company has the ability to coordinate new offers with the activities of other affiliates. So, for example, the credit card unit can suppress direct mail offers to individuals who have recently been declined by the consumer finance affiliate. Because the approval criteria for consumer finance loans is typically less stringent than for the credit card products, the company already knows that the customer is unlikely to be approved for a new card. The ability to suppress such names saves the irritation to the consumer (and ill will toward the company and possibly the affinity organization) from soliciting a customer one has already turned down and knows one will turn down again. [*pg 780]

2. The Impact on Efficient Corporate Organizational Structure. A separate but important dimension of opt-in's impact on MBNA's cross-selling activities deserves mention. An opt-in rule for affiliate sharing would limit MBNA's ability to telemarket its cardholders for any product or service because the company's call centers are administratively housed within a separate affiliate.⁹⁰ Consequently, the data needed to assemble and screen the prospect list could not be transferred from the other company affiliates without the customer's explicit permission. To overcome this problem, the obvious solution would seem to be to reorganize the company's administrative structure to bring the telemarketing unit back into the credit card affiliate, making opt-in consent unnecessary. Of course, this perfectly legal move highlights the inherently arbitrary nature of opt-in limits on the movement of data across affiliates.

The practical implications are more complex. The existing corporate structure was not chosen by accident. Like many service organizations, MBNA located its telephone sales call centers (which handle outbound telemarketing) in areas where labor is plentiful and skilled, and labor costs are relatively low. The company maintains telemarketing call centers in states such as Texas, Maine, New Hampshire, Ohio and Florida.⁹¹ However, if the telemarketing centers were administratively part of the credit card affiliate, then locating the telemarketing centers in a variety of states other than where the credit card affiliate was headquartered (Delaware)⁹² would open the credit card unit to tax, licensing and regulatory exposure in multiple jurisdictions. Consequently, to capture the advantages of both lower operating costs and lower administrative costs, the existing administrative structure was adopted to set up the telemarketing and card-issuing units as separate affiliates. Of course, although the savings to the company are significant, both the administrative structure and its rationale are invisible to MBNA's customer.

Nevertheless, if an opt-in regime restricted its ability to move data from the credit card affiliate to the telemarketing affiliate, MBNA would be forced to administratively move the telemarketing unit back into the card division (being unwilling to operate without a telemarketing function). But, the threat of multiple-state tax and [*pg 781] regulatory liability could force the company to physically move the telemarketing unit back to Delaware, and to incur relocation costs, disruption to services, and lost efficiency over the long term, as well as lost jobs in the vacated communities.

C. Impact on Efforts to Prevent and Detect Fraud and Identity Theft

Like all major financial institutions, MBNA invests heavily in preventing and detecting credit card and other forms of financial fraud. The single most important tool in that fight is personal information. For example, MBNA monitors account activity to determine unusual or out-of-the-ordinary charges. Through sophisticated computer models, and access to a wide range of information from many sources about "normal" charging patterns, MBNA can spot unusual charges that may indicate a card has been stolen or an account has been taken over by an identity thief. Many MBNA customers report that they first learn of a missing card or fraudulent activity when an MBNA Customer Service representative calls to verify unusual charges.⁹³

MBNA also monitors account activity to apprehend criminals perpetrating fraud. Close monitoring can identify patterns of activity that help law enforcement officials track down crime syndicates, fraud rings, and other sophisticated, organized efforts to defraud the company and its customers.

MBNA uses data from across its affiliates to identify suspicious behavior, watch for identity thieves who attempt to open multiple accounts in the names of other people, and prevent people who are delinquent on one MBNA account from inappropriately opening other accounts with the company to cover their shortfall. Data about identified thieves is shared among affiliates to help reduce losses and protect customers, employees, and shareholders.

With fifty-one million customers, MBNA receives thousands of change-of-address notices every day.⁹⁴ Most involve routine moves, but a few reflect the efforts of an identity thief to take over an existing account by changing the address to which statements are sent. By accessing directory information from public records and third parties, MBNA can verify a change of address to see if it matches any known [*pg 782] address of the account holder. If not, MBNA can inquire further to determine whether the change is legitimate.

Each MBNA unit makes extensive use of information from its own accounts in the fight against fraud, and shares information across affiliates to gather a more complete picture of charging patterns, target troubled accounts, warn of known identity thieves, and ensure that customers are served both efficiently and safely when changing address or updating account information. MBNA also relies heavily on third-party data to verify addresses and other information, spot abnormal charges, prevent and detect fraud, and apprehend perpetrators. All of these efforts require ready access to personal information from both internal and external sources. Any form of opt-in regime¾whether it applied to third parties or affiliates¾would degrade the effectiveness of those efforts.

Even if an opt-in regime specifically exempted the use of personal information for antifraud uses, the reality is that many of the external sources of information that MBNA uses to prevent and detect fraud could be seriously diminished (if not eliminated) by broadly applied opt-in rules. Few such data sources are assembled only for antifraud purposes or paid for only by such uses. The data and systems that support antifraud uses also serve other purposes, which help cover the cost of collecting and maintaining the information. For example, the records used to verify addresses are affordable precisely because they are used for a variety of marketing purposes.⁹⁵ These [*pg 783] other uses subsidize the fraud prevention and detection services. Permitting their use in connection with antifraud measures, although using an opt-in regime to restrict their use for those other, economically important uses, is tantamount to preventing access altogether.

CONCLUSION

The practice of offering consumers a choice over many uses of their personally identifiable data is now well accepted in both the public policy and business communities. If a way could be devised such that consumers could register their preferences regarding personal data usage at no cost to themselves or to businesses, then the debate over whether to impose an opt-in versus opt-out rule would largely disappear. However, in the absence of a costless method of registering consumer preferences, an opt-in system remains significantly more restrictive than an opt-out system, because nonresponse is treated as disapproval, even if it arises from consumer inattention or indifference to the choices.

The preceding case has demonstrated a variety of ways in which a move to opt-in would impact a large financial services firm. We have considered the imposition of three types of opt-in rules: third-party data sharing, affiliate-sharing and blanket opt-in, which restricts use of data a company already possesses. Based on prior experience, we assumed for analytical purposes that a move to opt-in would effectively block the affected forms of data sharing. That is, we assumed that the positive response to opt-in requests would be insufficient to make the collection and subsequent distribution of such data economically viable. We then examined the impact on MBNA's operations if certain categories of data currently in use were to become unavailable.

To briefly summarize the impact on MBNA, we found that mandatory opt-in requirements on MBNA's operations would impair MBNA's affinity group business model, raise account acquisition costs and lower profits, reduce the supply of credit and raise credit card prices, generate more offers to uninterested or unqualified consumers and raise the number of missed opportunities for qualified consumers, and impair efforts to prevent fraud and identity theft.

[*pg 784]

A third-party opt-in rule would drastically affect MBNA's central business model that has built a cardholder base of over 50 million customers around the affinity marketing strategy. Access to member lists for organizations such as professional associations and alumni groups allows MBNA to identify likely cardholder prospects and tailor a product for them that builds on their affinity for the organization. This strategy implodes with loss of access to member records. Of course, a joint-marketing exception to a third-party opt-in rule could be written to preserve access to such member lists. But, the need to do so reinforces the point that broadly applied opt-in rules can undermine relationships and widely accepted marketing practices that have brought benefits to millions of American consumers. More generally, a public policy approach of writing exceptions into broad-based opt-in rules in an attempt to preserve certain practices clearly runs the risk of overlooking some beneficial relationships.

Opt-in would also raise account acquisition costs and lower profits. Target marketing efficiency deteriorates under opt-in rules. Both third-party and affiliate-sharing opt-in regimes would dramatically limit MBNA's ability to acquire and use the information necessary to determine which of the 800 million annual "leads" it receives are appropriate candidates to receive card offers. By reducing its ability to cull prospect lists, these opt-in rules would boost MBNA's cost-per-account-booked via direct mail by 22 percent. Moreover, the accounts booked would have lower revenues and higher losses relative to the more precisely targeted group, yielding an 8 percent reduction in net income over the first five years of experience.

Because opt-in restrictions of the type analyzed above would impact all credit card issuers (not just MBNA), the reduction in supply (from both incumbent firms and new entrants) consequent to higher production costs would inevitably impact all cardholding consumers through higher prices, limits on card features or reduced access to credit cards. Part I presented evidence of a dramatic drop in credit card interest rates between 1990 and 1993 consequent to the influx of new competitors. The friction imposed by opt-in restrictions would begin to reverse that trend. Simulating the impact on credit card interest rates is beyond the scope of this paper. However, to gain some perspective on the stakes, consider that if the adoption of opt-in restrictions limited competition and new entry such that average credit card interest rates rose even 1 percentage point (100 basis points), it [*pg 785] would cost consumers approximately $5 billion in additional finance charges annually.⁹⁶

Not all of the additional costs imposed by opt-in would be financial. All of the opt-in scenarios considered in this case study would reduce the targeting accuracy of credit card solicitations. More consumers would receive offers in which they were not interested and for which they are not qualified, resulting in a higher incidence of junk mail and higher rejection rates on card applications. In addition, each of these opt-in regimes impairs MBNA's ability to implement effective Customer Relationship Management, and cross-sell other financial services. Consequently, consumers would miss opportunities for products and services that they might value.

Broad-based opt-in laws would pose a significant risk to the antifraud efforts of all credit card companies, even if written to exempt the specific use of personal information to prevent and detect fraud. Much of the external information on which MBNA and other companies rely may no longer be available under broadly applied opt-in rules. Uses of such information for a variety of commercial purposes make it economically feasible to create the databases that are later tapped in conjunction with antifraud efforts. MBNA and all of its customers would be harmed if opt-in rules led to shrinkage of those databases and subsequent dilution of MBNA's effectiveness at preventing fraud.

The irony is that MBNA already offers customers opportunities to limit the company's use of their personal information. As of the end of 2000, about 130 thousand customers had opted out of having their credit report information transferred across MBNA affiliates. Over one million customers had opted out of receiving any type of direct mail marketing offers. Because these customers have their preferences respected under the current privacy rules, it suggests that an opt-in regime to accomplish the same purpose is unnecessary, as well as expensive and burdensome to all customers regardless of their privacy preferences.

Finally, it should be noted that although legislation may impose practical limits on business access to personal information, it does not [*pg 786] change the underlying value of that information. MBNA has an economic incentive to improve its targeting efficiency in either an opt-in or opt-out environment. Legal restrictions on the collection of useful data simply boost the incentives to devise proxies for the attributes the restricted data were useful for measuring. These proxies are necessarily less accurate and/or more expensive (or they would have been used in the first place), and quite possibly more intrusive and less equitable. For example, if individually specific data is no longer available, MBNA and other card issuers might adopt rougher proxies for an individual's attributes based on census tract data for the person's neighborhood.

Movement in this direction as a consequence of opt-in rules, especially in the context of credit and financial services markets, is a step backward from the broad "democratization of credit" experienced over the past generation. Opponents of targeted marketing would do well to study the lessons learned following the implementation of statistical risk scoring in consumer credit markets. The use of risk scoring to evaluate loan applications has garnered both overwhelming commercial success and regulatory approval precisely because the resulting credit decision is based on an applicant's own credit history and past payment performance. Relative to older "judgmental" underwriting rules, credit decisions that incorporate risk scoring have repeatedly been shown to be more accurate (lower losses for a given number of approvals) and more equitable in terms of making more credit available to a wider range of consumers.

Similarly, targeted marketing of financial services toward consumers uses information about each individual's past purchasing experience to tailor future offers. Targeted solicitations and messages liberate marketing from reliance on stereotypes that lump consumers into categories based on socioeconomic characteristics rather than actual behavior. More precise information about consumers' likes and dislikes (as inferred from past shopping and buying patterns) gives marketers an incentive to design and deliver solicitations to the mix of prospects most likely to be interested in the offers. Businesses incur lower costs of reaching interested customers. Consequently, consumers enjoy greater access to new products. But, opt-in rules in the name of privacy "protections" choke off the information flows that make targeting possible.

FOOTNOTES

†	Distinguished Professor and Director of the Credit Research Center, The Robert Emmett McDonough School of Business, Georgetown University.
††	Distinguished Professor and Ira C. Batman Faculty Fellow, Indiana University School of Law-Bloomington; Senior Policy Advisor, Hunton & Williams Center for Information Privacy Leadership. We thank MBNA America for its participation in this case study and all of the MBNA employees who shared their time and expertise throughout the project. In addition, we received helpful comments and suggestions on earlier versions of this Article from Martin Abrams, Dan Jaffe, David Klaus, Mark MacCarthy, Harriet Pearson, and Michael Turner. This project was supported by a grant to Georgetown University from the Privacy Leadership Initiative.
1.	The phrase "free flow of information" throughout this Article refers to personally identifiable information flowing between consumers and companies, among affiliated and nonaffiliated companies, and to and from public record repositories.
2.	For the seminal article on the role of information costs, see George J. Stigler, The Economics of Information, 69 J. POL. ECON. 213, 213-25 (1961).
3.	Financial Privacy: Hearing Before the Subcomm. on Fin. Inst. and Consumer Credit of the House Comm. on Banking and Fin. Servs., 106th Cong. (1999), 1999 WL 528367 (statement of John D. Hawke, Jr., Comptroller of the Currency).
4.	Alan F. Westin, Intrusions: Privacy Tradeoffs in a Free Society, PUB. PERSPECTIVE, Nov./Dec. 2000, at 9.
5.	The concept of privacy utilized throughout this Article follows the definition first posed by Professor Alan Westin in 1967: informational privacy is "the claim of individuals, groups, or institutions to determine for themselves when, how, and to what extent information about them is communicated to others." ALAN F. WESTIN, PRIVACY AND FREEDOM 7 (1967). Subsequently, Professor George Stigler examined the economics of "concealment of information" that may have value in sorting individuals and matching preferences and opportunities. George J. Stigler, An Introduction to Privacy in Economics and Politics, 9 J. LEGAL STUD. 623, 624 (1980) (exploring the nature of privacy in economic behavior, the economic effects of contemporary privacy policies, and the reasons for the enactment of privacy legislation).
6.	In keeping with recent U.S. privacy legislation, we use the term "personal information" to refer to any data relating to a specific individual, unless those data are routinely available from public sources, such as telephone directories.
7.	See Internet Privacy: Hearing Before the S. Commerce Comm., 107th Cong. (2001), 2001 WL 21756980 (statement of Fred H. Cate, Professor, Indiana University School of Law-Bloomington) (noting that "the dominant trend in . . . privacy legislation is to invest consumers with near absolute control over" personal information).
8.	For examples of federal statutes and regulations adopting the opt-out approach, see the Gramm-Leach-Bliley Act, Pub. L. No. 106-102, § 502, 113 Stat. 1338, 1437-40 (1999) (codified in scattered sections of 15 U.S.C.) (setting forth a financial institution's obligations regarding disclosure of personal information); Fair Credit Reporting Act (FCRA), 15 U.S.C. § 1681b(e) (2000) (allowing the consumer to elect to have the consumer's name and address excluded from consumer reporting agency lists); Telephone Consumer Protection Act, 47 U.S.C. § 227©(3) (2000) (concerning residential telephone subscribers' right to avoid receiving objectionable telephone solicitations); 47 C.F.R. § 64.1200(e) (2002) (restricting telephone solicitation). In contrast, individually identifiable health information is increasingly subjected to opt-in rules, like those found in recent federal health privacy rules. See, e.g., Standards for Privacy of Individually Identifiable Health Information, 45 C.F.R. §§ 164.502, 164.506 (2002) (allowing health care organizations to use or disclose legislatively protected, individually identifiable health information with the individual's consent).
9.	For examples of federal opt-in legislation introduced during the 107th Congress, see the Consumer's Right to Financial Privacy Act, H.R. 2720, 107th Cong. (2001); Privacy Act of 2001, S. 1055, 107th Cong. (2001); Unsolicited Commercial Electronic Mail Act of 2001, H.R. 718, 107th Cong. (2001); Online Personal Privacy Act, S. 2201, 107th Cong. (2001); Financial Institution Privacy Protection Act of 2001, S. 450, 107th Cong. (2001); Consumer Online Privacy and Disclosure Act, H.R. 347, 107th Cong. (2001); Unsolicited Commercial Electronic Mail Act of 2001, H.R. 95, 107th Cong. (2001). For examples of recently introduced state opt-in legislation, see S.B. 1258, 45th Leg., 2d Sess. (Ariz. 2002) (relating to consumer information privacy); Financial Privacy Protection Act of 2002, A.B. 1775, 2001-02 Reg. Sess. (Cal. 2002); H.F. 285, 79th Gen. Assemb., 1st Sess. (Iowa 2001) (relating to disclosure of consumer information by financial institutions); Consumer Privacy Act, S.B. 2988, 224th Leg. Sess. (N.Y. 2001); Consumer Internet Privacy Act, S.B. 4402, 224th Leg. Sess. (N.Y. 2001); S.B. 1547, 48th Leg., 2d Sess. (Okla. 2001) (prohibiting disclosure of certain information relating to insurance).
10.	See, e.g., European Parliament and Council Directive 95/46/EC on the Protection of Individuals with Regard to the Processing of Personal Data and on the Free Movement of Such Data, art. 7, 1995 O.J. (L 281), LEXSEE 1995 OJ L 281 [hereinafter European Parliament and Council Directive 95/46/EC] (establishing that personal data may not be "processed" without the subject's unambiguous consent).
11.	See, e.g., Standards for Privacy of Individually Identifiable Health Information, 45 C.F.R. §§ 164.502, 164.506 (2002) (requiring health care providers to obtain consent from patients before using or disclosing certain protected health information).
12.	See, e.g., CONTRA COSTA COUNTY, CAL., CODE ch. 518-4 (2002) (requiring financial institutions to obtain consent before sharing customer information); Daly City, Cal., Ordinance 1295 (Sept. 9, 2002) (requiring notice and consent prior to disclosure of confidential consumer information by financial institutions); Daly City, Cal., Ordinance 1297 (Nov. 12, 2002) (same); S.F., CAL., BUS. & TAX REGS. CODE art. 20 (2002) (providing protection of private financial information); San Mateo County, Cal., Ordinance 4126 (Aug. 6, 2002) (regulating the disclosure of confidential consumer information), San Mateo County, Cal., Ordinance 4144 (Nov. 5, 2002) (same).
13.	For a development of a Coasian framework for examining the allocation of privacy rights, see CHARLES M. KAHN ET AL., A THEORY OF TRANSACTION PRIVACY (Fed. Reserve Bank of Atlanta, Working Paper No. 2000-22, 2000). That article relies on insights first posited in Ronald H. Coase, The Problem of Social Cost, 3 J.L. & ECON. 1 (1960).
14.	MBNA CORP., 2000 ANNUAL REPORT 6-7 (2001).
15.	THOMSON MEDIA, CARD INDUSTRY DIRECTORY 42 (2003).
16.	Id. at 17.
17.	For further discussion of competitive conditions in credit card markets, see CHRISTOPHER R. KNITTEL & VICTOR STANGO, PRICE CEILINGS AS FOCAL POINTS FOR TACIT COLLUSION: EVIDENCE FROM CREDIT CARDS (Fed. Reserve Bank of Chi. Working Paper No. WP2001-12, 2001).
18.	See Marquette Nat'l Bank of Minneapolis v. First of Omaha Serv. Corp., 439 U.S. 299, 310 (1978) (holding that the solicitation and extension of credit to residents of a foreign State does not change the State in which the bank is "located" under Section 85 of the National Banking Act of 1864).
19.	Following its introduction in 1992, the General Motors MasterCard established two million accounts and more than $500 million of balances in its first sixty days, making it the most successful credit card launch in U.S. history. The GM card rollout eclipsed the record set previously by the AT&T Universal card, which had opened one million accounts seventy-eight days after its launch in 1990. As further evidence that the GM card reached its targeted audience, the company reported that its cardholders were using the GM card 12 times per month, versus an industry average of 3.5 times monthly, and the average purchase was $112, versus an industry average of $58. Martin Dickson, Record Take-up for GM Card, FIN. TIMES (London), Nov. 17, 1992, at 26.
20.	John M. Barron & Michael E. Staten, The Value of Comprehensive Credit Reports: Lessons from the U.S. Experience, in CREDIT REPORTING SYSTEMS AND THE INTERNATIONAL ECONOMY (Margaret Miller ed., forthcoming 2003) (on file with the Duke Law Journal).
21.	DAVID EVANS & RICHARD SCHMALENSEE, PAYING WITH PLASTIC: THE DIGITAL REVOLUTION IN BUYING AND BORROWING 74-75 (1999).
22.	For a description of the attrition pressures that led to rate cuts by incumbent issuers in response to the wave of new entrants, see Citibank Leads an Exodus from High Interest Rates, CREDIT CARD NEWS, May 1, 1992, 1992 WL 2711864; David B. Hilder & Peter Pae, Rivalry Rages Among Big Credit Cards, WALL ST. J., May 3, 1991, at B1; Peter Pae, Credit Cards: Success of AT&T's Universal Card Puts Pressure on Big Banks to Reduce Rates, WALL ST. J., Feb. 4, 1992, at B1; Leah Nathans Spiro, How AT&T Skimmed the Cream Off the Credit-Card Market, BUS. WK., Dec. 16, 1991, at 104; A. Charlene Sullivan, The Push for Tiered-Rate Cards, CREDIT CARD MANAGEMENT, Oct. 1990, at 81.
23.	For general discussions about the impact on competition and pricing of new entrants into the credit card business, see generally Dennis W. Carlton & Alan S. Frankel, Antitrust and Payment Technologies, REVIEW (Fed. Reserve Bank of St. Louis), Nov./Dec. 1995, at 41; Dennis W. Carlton & Alan S. Frankel, The Antitrust Economics of Credit Card Networks, 63 ANTITRUST L.J. 643 (1995).
24.	Citibank Leads an Exodus from High Interest Rates, supra note 22; see also Hilder & Pae, supra note 22, at B1 (discussing how Chemical moved to a variable rate plan for its credit card holders); Sullivan, supra note 22, at 81 (referring to the adoption of a tiered interest rate system by credit card companies).
25.	Alan Greenspan, Chairman, Federal Reserve Board, Remarks to the Charlotte Chamber of Commerce (July 10, 1998), at http://www.federalreserve.gov/boarddocs/speeches/1998/19980710.htm: Once again, perhaps the most profound development has been the rapid growth of computer and telecommunications technology. The advent of such technology has lowered the cost and broadened the scope of financial services. These developments have made it increasingly possible for borrowers and lenders to transact directly and for a wide variety of financial products to be tailored for very specific purposes. As a result, competitive pressures in the financial services industry are probably greater than ever before.
26.	DAVID S. EVANS & RICHARD SCHMALENSEE, PAYING WITH PLASTIC 246 (2000).
27.	Id. at 225.
28.	BD. OF GOVERNORS OF THE FED. RESERVE SYS., THE PROFITABILITY OF CREDIT CARD OPERATIONS OF DEPOSITORY INSTITUTIONS 6 (2001), http://www.federalreserve.govboarddocs/rptCongress. The report also notes that "credit card interest rates fell sharply from mid-1991 through early 1994 after being relatively stable for most of the previous twenty years." Id. at 6. The decline in the average "most common interest rate" on issuer credit card plans between 1991 and 1994 was 244 basis points. Id. at 8 tbl. 2. "Since early 1994, credit card interest rates have fluctuated in a narrow range between 14.32 and 16.25 percent. For 2000, credit card interest rates averaged 14.91 percent, the second consecutive year such rates have averaged below 15 percent." Id. at 6.
29.	Historical data on the growth of MBNA accounts and receivables were provided by MBNA. Interviews with MBNA America executives, in Wilmington, Del. (Dec. 11, 2000) (on file with the authors).
30.	MBNA CORP., supra note 14, at 10.
31.	Id.
32.	MBNA CORP., 2001 ANNUAL REPORT 12 (2002).
33.	Id.
34.	Id.
35.	MBNA CORP., 1999 ANNUAL REPORT 9 (2000).
36.	MBNA CORP., supra note 14, at 4. It should also be noted that although MBNA has no bank branches of its own, its products are marketed in more than twelve thousand bank offices around the United States and United Kingdom through the endorsement of several hundred financial institutions for whom it was more economical to contract out the credit card product rather than to offer it themselves. The financial institution "affinity" sector of the portfolio includes several million customers. Id. at 10-11.
37.	Id. at 9.
38.	Id. at 28.
39.	William A. Black & Christophe Germain, Credit Card Indexes: December 2000 MOODY'S INVESTORS SERV. CREDIT SURVEY, Feb. 9, 2001, at 1 (noting that these calculations are based on its rating of $325 billion of securitized credit card receivables).
40.	MBNA CORP., supra note 14, at 5.
41.	100 Leaders for the New Millennium: The Honorees, CIO MAG., Aug. 15, 1999, www.cio.com/archive/081599_chart.html (on file with the Duke Law Journal).
42.	Amy Barrett et al., The 50 Best Performers, BUS. WK., Mar. 27, 2000, at 124 (ranking credit card issuer MBNA Corporation as thirty-fifth on this list).
43.	Martin v. City of Struthers, 319 U.S. 141, 149 (1943).
44.	Lamont v. Postmaster Gen., 381 U.S. 301, 307 (1965).
45.	Denver Area Educ. Telecomm. Consortium, Inc. v. FCC, 518 U.S. 727, 733 (1996).
46.	Martin, 319 U.S. at 141.
47.	U.S. West, Inc. v. FCC, 182 F.3d 1224 (10th Cir. 1999).
48.	Id. at 1235, 1238 (quoting Rubin v. Coors Brewing Co., 514 U.S. 476, 486 (1995)).
49.	Id. at 1235.
50.	Id. at 1239.
51.	US West Communications, Inc. v. FCC, 528 U.S. 1188 (2000).
52.	Gramm-Leach-Blilely Act, Pub. L. No. 106-102, §§ 501-527, 113 Stat. 1338, 1436-50 (1999) (codified at scattered sections of 15 U.S.C.). The list of organizations covered under the GLB Act as financial institutions is broad. It includes regulated financial companies such as banks, securities firms, insurance companies, insurance agencies, thrifts, and credit unions, as well as other institutions "the business of which is engaging in financial activities," 15 U.S.C. § 6809(3)(A) (2000), such as finance companies, mortgage brokers and check cashers. So, for example, retailers with credit programs are covered under the GLB Act.
53.	Department of Transportation and Related Agencies Appropriations Act of 2000, Pub. L. No. 106-69, § 350, 113 Stat. 986, 1025-26 (1999) (codified as amended at 18 U.S.C. §§ 2721-2725 (2000)).
54.	See supra notes 9, 12 and accompanying text.
55.	See GRAMM-LEACH-BLILEY FIN. MODERNIZATION ACT, H.R. CONF. REP. NO. 106-434, at 151 (1999), reprinted in 1999 U.S.C.C.A.N. 245, 245-46 (setting forth the purpose of the legislation as eliminating many barriers to creating affiliations between various financial service providers); S. REP. NO. 106-44, at 3-6 (1999) (explaining that combining the sectors of the financial services industry into one organization will serve customers better than the current system, which maintains divisions between the various sectors).
56.	Gramm-Leach-Bliley Act § 503(b), 113 Stat. at 1439.
57.	Separately from the GLB Act, the 1996 amendments to the Fair Credit Reporting Act do require companies to offer their customers a chance to opt out of having credit report information acquired for one purpose from being shared across affiliates for other purposes. Consumer Credit Reporting Reform Act of 1996, Pub. L. No. 104-208, §§ 2401-2422, 110 Stat. 3009-426, 3009-426 to 3009-454 (1996) (codified at 15 U.S.C. §§ 1681-1681t (2000)). This provision does not restrict a company from sharing its own transaction experience with the customer among its affiliates.
58.	MBNA CORP., supra note 14, at 85.
59.	Telecommunications Carriers' Use of Customer Proprietary Network Information and Other Customer Information, 63 Fed. Reg. 20,326, 20,327 (1998).
60.	European Parliament and Council Directive 95/46/EC, supra note 10, art. 7.
61.	Consumer Protection: Hearings Before the S. Comm. on Banking, Housing, and Urban Affairs, 107th Cong. (2002), 2002 WL 31105436 (statement of the Honorable Mike Hatch, Attorney General, State of Minnesota); id. (statement of James M. Kasper, North Dakota House of Representatives); Internet Privacy: Hearing Before the S. Comm. on Commerce, Sci. and Transp., 107th Cong. (2001), 2001 WL 771617 (statement of Marc Rotenberg, Executive Director of the Electronic Privacy Information Center); id. (statement of Jason Catlett, President and CEO, Junkbusters Corp.); Commerce, Trade and Consumer Protection: Hearings Before the House Comm. on Energy and Commerce, 107th Cong. (2001), 2001 WL 338574 (statement of Ed Mierzwinski, Consumer Program Director, U.S. Public Interest Research Group).
62.	Briefs, CIRCULATION MGMT., May 1999, http://www.circman.com/ar/marketing_briefs_7/index.htm (referring to the U.S. Postal Service's 1997 household diary study).
63.	Internet Privacy, supra note 7 (statement of Fred H. Cate, Professor, Indiana University School of Law-Bloomington).
64.	Telecommunications Carriers' Use of Customer Proprietary Network Information and Other Customer Information, 63 Fed. Reg. 20,326, 20,330 (1998); Brief for Petitioner and Intervenors at 15, U.S. West, Inc. v. FCC, 182 F.3d 1224 (10th Cir. 1999) (No. 98-9518) ("[T]he outbound mail campaign produced affirmative consents in the range of 6-11%. The offering of incentives appeared to have no material impact on the frequency with which consents were provided."); Ex parte letter from Kathryn Krause, Senior Attorney, U.S. West, to Dorothy Attwood, Senior Attorney, Common Carrier Bureau, Federal Communications Division at 11 (Sept. 9, 1997), in the proceeding In re Implementation of the Telecommunications Act of 1996 (on file with the Duke Law Journal).
65.	U.S. West, Inc. v. FCC, 182 F.3d 1224, 1239 n.12 (10th Cir. 1999). Interestingly, when an opportunity to consent was presented to the customer at the conclusion of a call that the customer initiated, 72 percent opted in. Id. at 1239.
66.	Ex parte letter from Kathryn Krause to Dorothy Attwood, supra note 64, at 9-10.
67.	Id. at 10.
68.	Id.
69.	Id.
70.	See id. at 10-18 (evaluating the results of an affirmative consent trial).
71.	In light of U.S. West's and other companies' experience with affirmative consent trials, it seems unlikely that many of the 4,700 organizations that currently offer their members an MBNA affinity card product would incur the costs of soliciting affirmative consent from their customers or members. Of course, some or all of those costs could be passed along to the companies (including MBNA) with which the affinity organization negotiates marketing agreements. But, the result would be to drive up the cost of new account acquisition for those companies, possibly by several multiples, relative to the existing environment in which member lists can be legally exchanged. This would neutralize much of the advantage of the affinity marketing strategy.
72.	Interviews with MBNA marketing executives, in Wilmington, Del. (Dec. 11, 2000 and Apr. 6, 2001) (on file with the authors).
73.	Think of the 800 million names on the company's annual master lead list as the sum of all the separate member-prospect lists obtained from each affinity organization during the course of a year. Duplication on consecutive versions of the same organization list is actually desirable. Most prospect names remain candidates for solicitations multiple times during a year because circumstances that make them likely cardholders continually change. For example, a customer who appears too risky to solicit in February may have a substantially improved credit profile by September. Similarly, a prospect who declines a solicitation one month may be interested in a new card nine months later. Consequently, the company will end up screening 800 million names during the course of a year to develop its targeted mailings.
74.	Interviews with MBNA marketing executives, supra note 72.
75.	Id.
76.	Id.
77.	Id.
78.	Id.
79.	Because of its heavy reliance on the affinity group member lists to identify prospects and its large existing portfolio, MBNA is unusual among major credit card issuers in that it does not make extensive use of prescreening (as authorized under FCRA) to identify creditworthy customers. MBNA indicated that only about 25 percent of all direct mail offers are prescreened by credit bureaus. In part this is also due to its underwriting practice, also unusual in the industry, of manual (as opposed to automated), judgmental review of each application that is returned, a process that presumably includes pulling credit bureau information at that time.
80.	Interviews with MBNA marketing executives, supra note 72.
81.	Id.
82.	Id.
83.	As previously noted, current FCRA rules require companies to give customers the chance to opt out of having information from their credit report shared across corporate affiliates. We are assessing the impact of a shift in the FCRA rules to an opt-in regime.
84.	Interviews with MBNA marketing executives, supra note 72.
85.	Let C1 = current cost per account booked, M = Total direct mail marketing budget, and X = number of accounts booked. Then, C1 = M/X. The MBNA simulation revealed that the percent of prospects receiving offers who actually become new cardholders would fall by eighteen percent under the opt-in scenario. Consequently, the accounts booked under the opt-in scenario = .82X. Let C2 = M/.82X = cost per account booked under the opt-in scenario. Then C2 = C1 /.82 = 1.22C1.
86.	According to BAIGlobal, Inc., a widely cited source of credit card marketing data based in Tarrytown, New York, card issuers mailed 3.543 billion card solicitations in 2000, with a response rate of 0.6 percent. Press Release, BAIGlobal, Credit Card Mail Volume Hits All Time High in 2000, as Response Rates Decline to New Low (Mar. 15, 2001), at http://www.baiglobal.com/Archives/2001/PRO301.htm
87.	Authors' analysis of MBNA's proprietary financial simulation models (on file with the authors).
88.	Three realities are pushing marketers like MBNA to adopt CRM strategies. First, the growing diversity of the U.S. population is making traditional segmentation overly complex so that even targeted marketing campaigns are increasingly missing their mark. Second, demographic shifts have reduced the flow of new, young customers entering the marketplace, raising the value to customer retention. Third, customers like personalized service and reward it with continued patronage.
89.	Beverly B. Wells, At Wachovia, Customer Focus Means Information-Driven Continuous Relationship Management, 21 J. RETAIL BANKING SERVICES 33, 34 (1999).
90.	MBNA Marketing Systems is the affiliate that administratively houses all telemarketing operations. MBNA CORP., supra note 14, at 85.
91.	Id.
92.	Id.
93.	Interviews with MBNA Security Unit, in Wilmington, Del. (Dec. 11, 2000) (on file with the authors).
94.	Id.
95.	The most sophisticated systems on the market for identifying individuals (i.e., ensuring that someone purporting to be John Doe is indeed John Doe) are "relationship databases." (We are aware of at least two companies, Experian, Inc. and Acxiom, that drive a variety of commercial identity-related applications from such databases.) Such databases assemble a wide variety of information (including age, social security number, previous addresses, etc.) in order to amass a knowledge base against which to evaluate new pieces of information. See generally Rajiv Kohli & Jatinder N.D. Gupta, Strategic Application of Organizational Data Through Customer Relational Databases, J. SYS. MGMT., Oct. 1993, at 22. If a name, address, and social security number combination does not exactly match the information on file, a relationship database can compare the new information against the collection of past information and determine the probability of a match. Cf. U.S. Patent No. 6,523,041 (issued Feb. 18, 2003) (describing an Acxiom data linking system). The deeper the knowledge base, the more reliable the match. These databases are built from billions of pieces of information collected mostly for commercial purposes and assembled to support a variety of commercial applications. See Acxiom Corporation, HOOVER'S COMPANY PROFILE DATABASE, LEXIS (2003) ("[Acxiom's] database of information encompasses more than 95% of the nation's households."). Fraud prevention is but one of them. When one piece of information is no longer available (e.g., date of birth), the ability to evaluate new information and verify identity with a given degree of precision is degraded. Thus, an opt-in statute like the 1999 amendments to the Drivers Privacy Protection Act, 18 U.S.C. § 2721 (2000), (which has all but eliminated state motor vehicle records as a source of age and date of birth data) has significant ripple effects because it degrades the value of such databases. 18 U.S.C. § 2721(b)(11) (prohibiting, with certain exceptions, the distribution of personal information obtained as part of the motor vehicle record unless "the State has obtained the express consent of the person to whom such personal information pertains").
96.	This calculation is based on average outstandings and total interest revenue for all general purpose credit cards in the United States for 2000. Total interest income for bank credit card issuers (including Visa, MasterCard, Discover and American Express) in 2000 was $64.3 billion, which equaled 13.7 percent of average receivables outstanding. Peter Lucas, The Unpredictable Details, in CARD INDUSTRY DIRECTORY 11 (2002).