|TABLE OF CONTENTS|
|Title and Revision History||Page 1|
|Table of Contents||Page 2|
|Applicability Statement –Section 2.0||Page 3|
|Federal Law–Section 3.0||Page 3|
|Who Must Comply –Section 4.0||Page 4|
|What is Protected –Section 5.0||Page 4|
|Chief Privacy Officer –Section 6.0||Page 4|
|Delivery Rules –Section 7.0||Page 5|
|Real Estate Brokers –Section 8.0||Page 5|
|Practical Tips –Section 9.0||Page 6|
|Disposal Rule –Section 10.0||Page 7|
|Posting of Opt-Out Notices –Section 11.0||Page 7|
|Violation of Policy –Section 12.0||Page 8|
|WFG Privacy Form||Page 9|
First and foremost, it is to protect consumers’ non-public personal information (“NPI”).
three potential “consumers” – the buyer, the seller and, on a refinance transaction, the borrower.
2.0 Applicability Statement.
This Policy and Procedures applies to Williston Financial Group LLC and all of its subsidiaries.
3.0 Federal Law
The Gramm-Leach-Bliley Act (“GLBA”) was enacted in 1999 to protect the NPI of individual consumers engaged in non-commercial transactions. The GLBA regulates financial institutions, which are broadly defined to include: “Any institution, the business of which is engaging in activities that are financial in nature or incidental to such financial activities, as determined by Section 4(k) of the Bank Holding Company Act of 1956. Financial institutions can include banks, securities brokers and dealers, insurance underwriters and agents, finance companies, mortgage bankers, and travel agents.” The Federal Trade Commission (“FTC”) includes in the definition of financial institutions, anyone who performs settlement services involving the sale, purchase, or finance of an individual’s home. Under the GLBA, a customer may include an insured under a title policy or a buyer/borrower or seller who obtains settlement (title and/or closing) services.
WFG must provide a notice of its privacy policies and allow consumers to opt out of the disclosure of the consumer’s NPI to a non-affiliated third party. A non-affiliated third party is described as any person, except a financial institution’s affiliate or a person employed jointly by a financial institution, and any company that is not the institution’s affiliate. This definition fails to provide much clarity regarding who is and is not a non-affiliated third party. It is easier to first define an affiliated entity, which is any entity that controls, is controlled by, or is under common control with another entity. Any company that falls outside this definition would be a non-affiliated third party.
4.0 Who Must Comply
The FTC is charged with enforcing GLBA. The FTC includes, in the definition of financial institutions, anyone who performs settlement services involving the sale, purchase, or finance of an individual’s real estate, including those who provide the following products or services:
|• Closings||• Escrows||• Surveys|
|• Appraisals||• Flood certifications||• Exchange services|
|• Tax searches||• Title searches||• Title insurance policies|
|• Credit reports||• Notary services||• Document preparation|
5.0 What is Protected
NPI is protected. The following list contains examples of NPI that is protected under GLBA:
- Social Security Numbers
- Driver License Numbers
- Credit Reports
- Bank Account Numbers
- Credit Card Numbers
- Loan Numbers
- Loan Applications
- Tax Returns
- 1099 Forms
- Loan/Credit Payoff Amounts
- Purchase/Sale Contract Information
- Sales Price (if not in Public Records)
- GFE/TIL Information (Loan Estimate Form)
- HUD-1 or HUD-1A Information (Closing Disbursement Form)
- Owner’s Title Insurance Policies (Policy Number and Amount of Insurance)
- Address and phone numbers unless known to be public information
6.0 Chief Privacy Officer
WFG is committed to protecting the NPI of its customers. The Chief Technology Officer of WFG also serves as its Chief Privacy Officer (“CPO”). The CPO is responsible for maintaining the integrity of WFG’s systems to protect all NPI. The CPO will determine (in consultation with the Legal and Compliance Departments) whether any NPI may ever be shared with any non-affiliated third party entities for marketing or other purposes. If a WFG employee receives a request from a non-affiliated third party to purchase or access NPI, the employee should direct that inquiry to the CPO. If an employee believes that a WFG system protecting NPI has been compromised or that any WFG employee has breached the security of NPI, the employee must immediately notify the CPO and the Compliance Department.
7.0 Delivery Rules
Escrow must include the form Notice in the buyers’, sellers’ and borrowers’ closing or signing packages. The form Notice does not need to contain the underwriter’s name.
WFG provides the Notice on its websites as an additional courtesy to our consumers and customers.
However, it is not enough to simply post the Notice on our websites since customers must agree to receive notices electronically in order for this to satisfy the GLBA’s notice requirement. Since not all customers conduct business online and since not all of those who do will agree to receive notice electronically, the safest route is to provide the Notice as set forth above, even when the Notice is posted on our websites.
WFG provides the Notice at the earliest point of contact by providing it in three steps, as shown under “Title” and “Escrow” above:
- At time of issuance of the title commitment or preliminary title report, where delivered prior to issuance of the final policy;
- At time of closing, where we perform settlement/escrow services; and/or
- At time of issuance of the owner’s title policy (buyers) or loan policy (seller financing).
WFG and its subsidiaries provide the Notice to the company’s consumers and customers on a per transaction basis and do not provide annual notices pursuant to the rules of the FTC and the National Association of Insurance Commissioners.
8.0 Real Estate Brokers
Real Estate Brokers often request copies of the signed HUD-1, closing disbursement form, other closing statements, and other forms at closing that contain NPI. In order to provide such forms, the following language should be included in the Company’s escrow instructions signed by the buyers and sellers:
“The undersigned hereby authorizes WFG to provide copies of any closing statements, loan documents, financial information, commitments, approval letters, appraisals, inspection reports, insurance policies, contracts, payoffs, transaction documents, and other nonpublic personal information in connection with the transaction to the real estate broker and real estate agent representing the undersigned.”
For those states that close sales transactions without escrow instructions, you must confirm the real estate broker’s relationship to the transaction before providing a copy of the settlement statement to the broker. If the purchase and sale agreement discloses that the broker represents both the buyer and the seller, you may provide the full settlement statement to the broker without further written authorization. If the broker represents only the buyer or seller, you may only provide a settlement statement that discloses only that party’s information and charges. Otherwise, you must obtain written authorization from the parties to disclose the settlement statement to the broker. You may not disclose any other NPI to the broker without written authorization from the parties.
9.0 Practical Tips
In compliance with the GLBA, we do not share NPI about a consumer with a nonaffiliated third party, unless allowed by law. To help you fully understand, please follow these practical tips in your daily duties:
- Protect NPI of customers and consumers.
- Allow access on a need-to-know basis only. Only company personnel who need to know can access the information. Examples include: bookkeepers, title examiners, title underwriter personnel, auditors, closers and their assistants, management, scanning personnel, and claims related investigation personnel, including but not limited to in-house and retained counsel.
- Allow customers and consumers to review their NPI that we have collected, and allow them to provide us with requests for amendment or deletion of such information, to which we will reasonably respond.
- Require consent from a proper party to the transaction to provide NPI relating to that transaction. On closed files, require a written instruction by a party.
- Allow only authorized personnel to review the information.
- Keep closed files in secure storage, with limited access, or store the files electronically with limited password access.
- Do not keep copies of credit reports, loan applications, tax returns, cancelled credit card information, HUD-1 or closing disclosures from prior transactions on consumers and customers.
- Don’t share copies of owner’s policies of customers on residential transactions, unless at the request of the insured owner.
• For starter files, don’t share NPI, such as sales price (unless it is public information), file numbers/commitment numbers, final policy numbers, amount of insurance, or insured or proposed insured on commitments/preliminary title reports/owner’s policies issued to customers.
Don’t share NPI by disclosing social security numbers and driver’s license numbers on affidavits of identity if they are to be filed of record.
- Comply with the Clear Screen/Secure Workstation Policy and Procedure and review training materials regularly.
- Don’t share NPI with independent contractors unless there is a need to process the transaction as allowed by law, and the contractors agree in writing not to further share the information.
- Comply with all privacy-related bulletins provided by our underwriters.
- Provide requested information to persons acting in a fiduciary or representative capacity on behalf of the consumer (i.e., the consumer’s attorney).
- Forward any requests for information from insurance rate advisory organizations, persons assessing compliance with industry standards, the company’s attorneys, accountants, auditors and underwriters to the Compliance Department.
- Forward any requests for information from law enforcement entities or self-regulatory groups as directed in the Legal Process Policy and Procedure.
- Forward any requests in the form of subpoenas or other judicial process as directed in the Legal
Process Policy and Procedure.
- Do not share or sell lists that contain NPI to real estate brokers/agents, loan originators, or others. A list that contains even one piece of NPI turns the entire list into NPI.
- Do not record documents that contain NPI – such as a non-identity affidavit where the seller, buyer or borrower states that one or more judgment lien(s) are not his/her lien(s). Do not record the affidavit if it contains NPI such as social security numbers or driver’s license numbers.
- Sharing NPI with non-affiliates may require additional disclosures – contact the CPO with any request to share NPI.
- When outsourcing to a third-party service provider, WFG must obtain, review, and maintain oversight of the written regulatory compliance and risk management plans of such providers to ensure ongoing compliance. This includes, but is not limited to:
1) WFG and subsidiaries outsourcing witness signings/mobile signings to independent notaries. (Refer to WFG Internal and External Notary Public and Signing Services Policy and Procedure.)
2) WFG and subsidiaries outsourcing title search and examination to independent abstractors. (Refer to WFG Vendor Services Agreement Policy and Procedure and WFG Business Process Outsource Vendor Policy and Procedure.)
3) WFG outsourcing document disposal to document disposal companies. (Refer to WFG Record Retention Policy and Procedure.)
10.0 Disposal Rule (also see WFG Record Retention Policy and Procedure)
The FTC has adopted disposal rules for proper disposal of consumer information by businesses. Consumer information means a consumer report or any document that “is derived from a consumer report”, which may include information in a lender package. Refer to the WFG Record Retention Policy and Procedure for the WFG disposal rules for paper and electronic data.
11.0 Posting of Opt-Out Notices
All Opt-Out Notices that are returned to WFG must be posted on our internal SharePoint website at http://sharepoint.williston.local/opt-out/Lists/Opt%20Out%20Database/AllItems.aspx. Connect to the
company’s network or VPN before attempting to connect to SharePoint. Once there, click the plus symbol in the circle to post the consumers/customers information.
Notices must be posted to the website within one day from receiving the notice.
12.0 Violation of Policy
The terms of this Policy are mandatory and every WFG employee is expected to follow this Policy. In the event any employee needs further information or an interpretation of its purpose, definitions, terms or requirement they are encouraged to consult with their supervisor or manager or with a representative from the WFG Compliance and Audit Department. The failure to follow and adhere to all requirements contained in this Policy and procedures enumerated herein could result in disciplinary action up to and including termination.
This material is and should be considered by others to be proprietary intellectual property owned by Williston Financial Group LLC (WFG). As such, this material is protected by one or more copyrights, trademarks or service marks, which are owned by WFG. Anyone found to be using this material improperly or without the express prior written consent of WFG will be held liable for its misuse or unauthorized use to the fullest extent of the law.
ABOUT YOUR PRIVACY
At WFG, we believe it is important to protect the privacy and confidences of our customers. This notice is intended to explain how we collect, use, and protect any information that we may collect. It will explain the choices you may make about the use of that information.
What Information Do We Collect About You?
We collect certain types of information about you. This may consist of:
- Your name, address, and telephone number.
- Your email address.
- Your social security or government ID numbers.
- Your financial information.
We collect this information from:
- The application or other forms you fill out with us.
- The correspondence you and others direct to us.
- Our transactions with you.
- Others involved in your transaction, including the real estate agent or lender.
In some cases, we collect information from third parties. For instance, we may receive real estate information from local assessor’s offices.
How Do We Use This Information?
We use the information we collect to respond to your requests. WE DO NOT SHARE your information with other companies.
How Can You “Opt Out?”
We do not share your information so there is no need to opt out.
The information We Collect About You On Our Website
When you enter our website, we automatically collect and store certain information. This consists of:
- Your IP Address
- (Internet Protocol Address) and domain name.
- The type of browser and operating system you use.
- The time of your visit.
- The pages of our site you visit.
If you register with us or fill out an on online survey, we will collect additional personal information, such as your name, telephone number, email address and mailing address.
In order to provide you with customized service, we make use of “cookies.” Cookies are essentially files that help us identify your computer and respond to it. You may disable cookies on your own computer, but you may not be able to download online documents unless cookies are enabled.
How We Use Information
The information we collect concerning:
- Your browser
- The time and date of your visit
- The web pages or services you accessed
is used for administrative and technical purposes. For instance, we may use it to count the number of visitors to our site and determine the most popular pages. We may also use it to review types of technology you are using, determine which link brought you here, assess how our advertisements on other sites are working, and to help with maintenance.
We use information contained in your emails only for the purpose of responding to those emails. If we ask you to fill out any forms or surveys, we will use the information we receive only for the specific purposes indicated in those forms or surveys.
Your Right to See and Correct Information
If you wish to see the information collected about you, please contact your settlement agent.
We do not knowingly collect information from children under the age of 18. We delete any information that we discover has been provided by children.
We make every effort to protect the integrity of your information. Any personal information you enter into online forms or surveys will be encrypted to ensure it remains private. We limit the right of access to your information to employees that need to use the information to respond to or process your request or transaction. We also take industry standard (IPSEC) measures to protect our sites from malicious intrusions or hacking.
–Phishing and Pretexting
As you know, consumers are increasingly targeted by unscrupulous persons attempting to acquire sensitive personal or financial information, by impersonating legitimate businesses. We will never send you an unsolicited email or other communication requesting your private information. If you receive a communication directing you to enter your personal information, please disregard the instruction and contact us immediately at Compliance@wfgnationaltitle.com.
Do Not Track
Because there is not an industry-standard process or defined criteria to permit a user to opt out of tracking their internet access (Do Not Track or DNT), we do not currently respond to the various DNT signals.
How to Contact Us
- By email: Compliance@wfgnationaltitle.com
- By telephone: 800-385-1590
- By fax: 503-974-9596
- By mail: 12909 SW 68th Pkwy, Suite 350, Portland, OR 97223
- In person: 12909 SW 68th Pkwy, Suite 350, Portland, OR 97223
We may not disclose personal or privileged information about you unless we provide you with a disclosure authorization form that is executed by you or your representative and otherwise complies with certain statutory requirements. Any such authorization is not valid for more than 24 months and may be revoked by you at any time, subject to the rights of anyone who relied on the authorization prior to your notice of revocation.
In addition, if your personal or privileged information was collected or received by us in connection with a title insurance transaction, we cannot disclose such information if the disclosure authorization form that you executed is more than one year old or if the requested disclosure is for a purpose other than a purpose expressly permitted by statute.
You have the right at any time to request in writing access to recorded personal information about you that is reasonably described by you and reasonably available to us. Within 30 days of the date of our receipt of any such written request from you, we will inform you of the nature and substance of any such information, permit you to see and copy that information or obtain a copy by mail, disclose the identity, if recorded, of the persons to whom we have disclosed such information during the previous two years, and provide you with a summary of the procedures by which you may request that such information be corrected, amended or deleted.
WILLISTON FINANCIAL GROUP LLC
WFG NATIONAL TITLE INSURANCE COMPANY WFG LENDER SERVICES, LLC
WFGLS TITLE AGENCY OF UTAH, LLC
WFG NATIONAL TITLE COMPANY OF WASHINGTON, LLC WFG NATIONAL TITLE COMPANY OF CALIFORNIA
WFG NATIONAL TITLE COMPANY OF TEXAS, LLC D/B/A WFG NATIONAL TITLE COMPANY UNIVERSAL TITLE PARTNERS, LLC
VALUTRUST SOLUTIONS, LLC
WILLISTON ENTERPRISE SOLUTIONS & TECHNOLOGY, LLC