This appeal presents the question of when a district court may enforce a government agency's subpoena duces tecum against a financial institution in light of two statutes which protect private consumer financial information, the Right to Financial Privacy Act (RFPA), 12 U.S.C. § 3401, et seq. and the Gramm-Leach-Bliley Act (GLBA), 15 U.S.C. § 6801 et seq.

In February 2004, the United States Department of Labor (DOL) initiated an investigation into unspecified fiduciary duty violations of the Employee Retirement Income Security Act of 1974, 29 U.S.C. § 1001 et seq. (ERISA), involving the Regional Employers' Assurance Leagues' Voluntary Employees' Beneficiary Association (REAL VEBA). REAL VEBA is a multiple-employer/employee welfare benefit trust. The individual employees, who are beneficiaries of the REAL VEBA Trust, receive various benefits from the trust, including life insurance. REAL VEBA pays the premiums of each participant's separate insurance policy. REAL VEBA does not, however, maintain separate accounts in each participant's name. Each participant in REAL VEBA has executed a limited power of attorney for REAL VEBA to act on his or her behalf.

As part of her investigation, the Secretary of Labor issued an administrative subpoena duces tecum to Penn-Mott Benefit Services, Inc., the REAL VEBA plan administrator, and to John J. Koresko. Koresko is the sole shareholder in Koresko and Associates, a law firm that represents Penn-Mott. Penn-Mott has no employees or assets. Penn-Mott and Koresko refused to comply with the subpoena based on attorney-client privilege and financial privacy rights. As a result, in April 2004, the Secretary instituted an enforcement action in the Eastern District of Pennsylvania. Our Court ultimately ordered in Chao v. Koresko, 2005 WL 2521886 (3d Cir. Oct. 12, 2005), 2005 U.S.App. LEXIS 22025, that the subpoenas against Penn-Mott and Koresko be enforced.1

Community Trust Company (CTC) is state-chartered trust company. It is the trustee of REAL VEBA and maintains an account in REAL VEBA's name. CTC accepts deposits for policy premiums to be paid for certain benefits, such as life insurance, for specific employee beneficiaries. CTC maintains the deposits, invests them in a money market account, and remits payment of the premiums to insurance companies for individual employees' policy premiums. The Secretary, in December 2004, issued a second subpoena duces tecum to CTC, directed at the REAL VEBA documents.

CTC maintains a copy of the REAL VEBA Trust organizational documents, such as the trust agreement.2 However, the vast majority of the documents covered by the CTC subpoena contain personal private financial information specific to each employee receiving benefits under the REAL VEBA Trust. CTC claims that the subpoena requires it to disclose documents which are either personal financial records of REAL VEBA beneficiaries or copies of documents which the Secretary has already received from the respondents in Koresko.3 Therefore, CTC refused to furnish the information, arguing that it would violate financial privacy rights set forth in the RFPA and the GLBA.

On January 1, 2005, the Secretary filed a petition to enforce the CTC subpoena in the District Court for the Eastern District of Pennsylvania. CTC filed a motion to dismiss under FED.R.CIV.P. 12(b)(1) and 12(b)(6). CTC argued that the Secretary could not enforce the subpoena because REAL VEBA is not covered by ERISA and, therefore, the Secretary lacked jurisdiction to issue the subpoena.4 CTC claims that, because the scope of the investigation is beyond the Secretary's investigatory authority, CTC is forbidden by the GLBA and the RFPA from releasing the information.

The District Court held that the plain language of the RFPA made its protections inapplicable to REAL VEBA and that the Secretary did not need to establish jurisdiction to enforce the subpoena under the GLBA. Accordingly, the District Court entered judgment for the Secretary and ordered CTC to comply with the subpoena. CTC then moved for a stay of enforcement pending appeal. The District Court denied the motion, found CTC in contempt for refusing to comply with the subpoena, and fined CTC.

CTC has appealed the District Court's rulings that DOL did not need to establish jurisdiction and that REAL VEBA is not protected by the RFPA. CTC has also appealed the District Court's denial of the stay of enforcement pending appeal. We consolidated the denial of stay and contempt ruling with the initial appeal.

The District Court exercised jurisdiction under 28 U.S.C. § 1331, 15 U.S.C. § 49, and 29 U.S.C. §§ 1132 and 1134. CTC challenged this jurisdiction on the bases discussed below. We have jurisdiction under 28 U.S.C. §§ 1291 and 1294(1) because this is an appeal from an order enforcing an administrative subpoena, which is a final order. In re Kaiser Aluminum & Chem. Co., 214 F.3d 586, 589 (5th Cir.2000).

We review orders enforcing administrative subpoenas for abuse of discretion. FDIC v. Wentz, 55 F.3d 905, 908 (3d Cir.1995). Abuse of discretion occurs when "the district court's decision rests upon a clearly erroneous finding of fact, an errant conclusion of law or an improper application of law to fact." NLRB v. Frazier, 966 F.2d 812, 815 (3d Cir.1992). We review the District Court's interpretation of federal statutes de novo. Gagliardo v. Connaught Labs., Inc., 311 F.3d 565, 570 (3d Cir.2002).

We also review the denial of stays from injunctive relief pending appeal, including from contempt orders, for abuse of discretion. Socialist Workers Party v. Att'y Gen. of the United States, 419 U.S. 1314, 1315, 95 S. Ct. 425, 42 L. Ed. 2d 627 (1974).

To enforce an administrative subpoena, an agency must demonstrate that the subpoena meets certain threshold requirements. SEC v. Wheeling-Pittsburgh Steel Corp., 648 F.2d 118, 128 (3d Cir.1981) (en banc). Those requirements are "(1) the inquiry must be within the authority of the agency, (2) the demand for production must not be too indefinite, and (3) the information sought must be reasonably relevant to the authorized inquiry." United States v. Westinghouse Elec. Corp., 638 F.2d 570, 574 (3d Cir.1980). "If the government makes this preliminary showing, the burden then shifts to the respondent to prove that enforcement of the subpoena would be improper...." Wheeling-Pittsburgh, 648 F.2d at 128.

CTC objects to the District Court's enforcement of the subpoena on the grounds that the District Court erred as a matter of law in its rulings that enforcement was not barred by the RFPA and the GLBA. CTC also claims that the subpoena was not issued within the authority of the Department of Labor to investigate. CTC finally contends that the District Court erred in not deferring enforcement pending appeal.

The RFPA was enacted by Congress "to protect the customers of financial institutions from unwarranted intrusion into their records while at the same time permitting legitimate law enforcement activity." 1978 U.S.C.C.A.N. 9273, 9305. The RFPA seeks to strike a balance between the right of privacy of customers and the need for law enforcement agencies to obtain financial records as a part of legitimate investigations. Id. CTC contends that because the specific requirements of the RFPA were not met, CTC has an affirmative obligation not to, directly or indirectly, produce the financial records of its customers to any government authority. For that reason, CTC asserts that the District Court erred in holding that the RFPA did not bar enforcement of the subpoena.

The RFPA provides that, unless a statutory exception applies:

no Government authority may have access to or obtain copies of, or the information contained in the financial records of any customer from a financial institution unless the financial records are reasonably described and —

...

(2) such financial records are disclosed in response to an administrative subpoena or summons which meets the requirements of section 1105 [12 U.S.C. § 3405]....

12 U.S.C. § 3402 (emphasis added). None of the statutory exceptions to section 3402 apply in this case. Rather, the question under the RFPA is whether the financial records, sought by the subpoena, are records of CTC's "customers."

any person or authorized representative of that person who utilized or is utilizing any service of a financial institution, or for whom a financial institution is acting or has acted as a fiduciary, in relation to an account maintained in the person's name.

12 U.S.C. § 3401(5) (emphasis added). The RFPA defines "person," in turn, as "an individual or a partnership of five or fewer individuals." 12 U.S.C. § 3401(4).

The District Court held that the REAL VEBA beneficiaries are not customers of CTC because REAL VEBA does not maintain accounts at CTC in plan beneficiaries' names. Instead, the court determined that REAL VEBA was CTC's customer, but because the RFPA protects only "customers" who are individuals or small partnerships, 12 U.S.C. § 3401(4), REAL VEBA does not qualify as a "customer" under the RFPA. Therefore, the RFPA does not bar enforcement of the subpoena.

CTC urges to the contrary that the definition of "customer" should be read so that the final phrase in section 3401(5), "in relation to an account maintained in the person's name," modifies only "a financial institution [that] is acting or has acted as a fiduciary" rather than modifying the whole subsection, including "any person or authorized representative of that person." Accordingly, CTC argues that, on the basis of its limited power of attorney, it is the "authorized representative" of the REAL VEBA plan beneficiaries who utilize its services. Since the requirement that the account be in "the person's name" applies only to fiduciaries, the RFPA applies here to prevent disclosure of the beneficiaries' information.

Because CTC does not maintain accounts in the names of the REAL VEBA beneficiaries, however, if the final phrase modifies both clauses of the subsection — the authorized representative clause and the fiduciary relationship clause — then under the language of the RFPA the plan beneficiaries are not "customers" of CTC.

CTC presents four arguments in support of its reading of RFPA section 3401(5). First, CTC argues that the canon of statutory construction known as the "doctrine of last antecedent" counsels in favor of limiting the phrase "in relation to an account maintained in the person's name" to modifying the phrase immediately preceding it, not both clauses of RFPA section 3401(5). The doctrine of last antecedent requires "qualifying words, phrases, and clauses to be applied to the words or phrase immediately preceding, and are not to be construed as extending to and including others more remote." J.C. Penney Life Ins. Co. v. Pilosi, 393 F.3d 356, 365 (3d Cir.2004). But "this rule [of the last antecedent] is not an absolute and can assuredly be overcome by other indicia of meaning...." Id. (citing Barnhart v. Thomas, 540 U.S. 20, 124 S. Ct. 376, 157 L. Ed. 2d 333 (2003) (applying the rule of last antecedent to statutes)).

CTC's statutory construction argument is undone by a comma. In J.C. Penney, this Court applied the rule to a phrase in an insurance contract that had no commas. 393 F.3d at 365 (citing Resolution Trust Corp. v. Nernberg, 3 F.3d 62 (3d Cir. 1993)). In Resolution Trust Corp., we noted that "[t]he use of a comma to set off a modifying phrase from other clauses may indicate that the qualifying language is to be applied to all of the previous phrases and not merely the immediately preceding phrases." 3 F.3d at 65 (citing Nat'l Sur. Corp. v. Midland Bank, 551 F.2d 21, 34 (3d Cir.1977) (lack of a comma limited application of the qualifying language to the word immediately preceding it)).

In this case, there are two telltale commas. Not only is the modifying phrase "in relation to an account maintained in the person's name" set off by a comma, but the phrase to which CTC would like to limit the language, "or for whom a financial institution is acting or has acted as a fiduciary," is also set off by commas. Under normal rules of grammar (which we assume Congress followed), a phrase that is set off by commas can be excised from a sentence. Thus, in this case, if we excise the second "fiduciary" clause of section 3401(5), it would leave the modifying phrase "in relation to an account maintained in the person's name" to qualify the initial phrase "any person or authorized representative of that person who utilized or is utilizing any service of a financial institution". Because the CTC account is in REAL VEBA's name and REAL VEBA is not a "person" under the RFPA, we conclude that CTC's statutory construction argument does not hold water.

Second, CTC argues that the RFPA's definition of "person" in section 3401(4) is inapplicable because REAL VEBA is a trust, which is a non-entity. CTC argues that in the case of a trust, we should look to the underlying entities — the trust settlors and beneficiaries. In light of the beneficiaries' equitable interest in the corpus of the trust, CTC argues that the beneficiaries qualify as "customers" — whatever the title of the CTC account, the "customers" are the individual REAL VEBA beneficiaries and their legal representative, the plan administrator. The question of the status of a trust in relation to section 3401(4) is a question of first impression. A trust differs from a corporation, large partnership, LLC, et cetera. Looking to the equitable beneficiaries of a trust — the real parties in interest — rather than to its legal owner is hardly a novel principle in trust law. Here, the privacy interests at stake are not the REAL VEBA's, but those of its beneficiaries'. While the Secretary claims that a broader reading of section 3401(4) would "allow any large entity to argue that it is really just the representative of its constituent members," we are not convinced by this slippery slope argument. See Ridgeley v. Merchs. State Bank, 699 F. Supp. 100, 102 (N.D.Tex.1988). We believe that it is possible to draw a principled distinction between a trust and other entities. Nonetheless, we decline to do so here; we are not inclined to carve out a "trust exception" to RFPA's definition of "person" solely on the principles of the common law of trusts.

Moreover, CTC's argument has no support in existing statute or caselaw. In Pittsburgh National Bank, we held that we are bound by the RFPA's unambiguous definition of "customer." 771 F.2d 73, 75-76 (3d Cir.1985) (holding that a corporation is not a person for section 3401(4)). CTC's policy argument fails to get around the plain statutory language that makes RFPA protections applicable only to accounts maintained in the customers' names. That is, RFPA requires a customer to hold both equitable and legal title. Thus, even if CTC is managing funds for REAL VEBA beneficiaries, applicable to the interests of these individual beneficiaries, CTC does not maintain accounts in the beneficiaries' names. Accordingly, this argument also fails.

Third, CTC argues that we should follow the Ninth Circuit's ruling in Donovan v. National Bank of Alaska, 696 F.2d 678 (9th Cir.1983). National Bank of Alaska involved a scenario very similar to this case. In National Bank of Alaska, the Secretary of Labor served an administrative subpoena duces tecum on the bank to determine if there was a violation of ERISA plans the bank administered. Id. at 680. The subpoena required the bank to produce the general plan documents for all the plans it administered. Id. The subpoena stated that upon receipt of the initial information, the Secretary would select twenty-five plans for more thorough examination, for which it requested "[a]ll documents maintained by the bank relating to transactions or dealings with, for or on behalf of the employee benefit plans selected...." Id. The bank was concerned that the additional information might include personal financial records of plan beneficiaries.

The Ninth Circuit opined that "[w]here the Department [of Labor] requests records which disclose transactions of bank customers with the plans, its request would fall within the scope of the Financial Privacy Act, and, absent certification, the bank may legally refuse to produce those records." Id. at 683-84. The court held that the RFPA was not an obstacle to enforcement of the first part of the subpoena. Id. at 684. The court went on, however, to comment on the second part:

As for the second part of the subpoena, absent selection of the actual plans to be investigated, neither the Department [of Labor] nor the bank has any way of knowing whether any individual privacy rights might be affected. The bank cannot refuse to comply with the subpoena as a whole on the basis of its vague allegations that it might be required at some time in the future to produce records in violation of the Financial Privacy Act.

Id. at 684. Thus, because National Bank of Alaska, at the stage at which it was decided, dealt only with organizational documents, not individual beneficiary accounts, it is distinguishable.

Finally, CTC argues that under the District Court's ruling, the right to financial privacy, the right protected by the RFPA, can be circumvented by the government depending upon which entity, in the chain of entities involved in the provision of financial services, the government chooses to be subject to the subpoena. According to CTC, the government could obtain documents to which it is not otherwise entitled simply by issuing a subpoena to an entity one step removed from the entity that maintains the direct account relationship with the individual customer. It is axiomatic that the executive branch may not do indirectly what Congress has forbidden it to do directly, particularly when privacy rights are involved.

Nevertheless, even though we may agree that, under the RFPA, it is the REAL VEBA beneficiaries who should be protected, we cannot reshape clear statutory language. Moreover, the Supreme Court has made clear that RFPA is to be narrowly construed. See SEC v. Jerry T. O'Brien, Inc., 467 U.S. 735, 745, 104 S. Ct. 2720, 81 L. Ed. 2d 615 (1984). Congress enacted the RFPA in response to United States v. Miller, 425 U.S. 435, 96 S. Ct. 1619, 48 L. Ed. 2d 71 (1976), in which the Supreme Court held that there is no constitutional right to privacy of financial records. If Congress is dissatisfied with the treatment its legislative creation gives to a trust like the REAL VEBA trust held by CTC, Congress can rectify the situation.

Thus, we conclude that the District Court correctly found that the RFPA does not bar the enforcement of the Secretary's administrative subpoena.

CTC also contends that enforcement of the subpoena would violate the GLBA's prohibition on disclosure of consumer financial information to unaffiliated third parties. GLBA section 6802, entitled "Obligations with respect to disclosures of personal information," provides that:

(a) Notice Requirements. Except as otherwise provided in this subtitle, a financial institution may not, directly or through any affiliate, disclose to a nonaffiliated third party any nonpublic personal information, unless such financial institution provides or has provided to the consumer a notice that complies with section 503 [15 U.S.C. § 6803].

(b) Opt Out.

(1) In general. A financial institution may not disclose nonpublic personal information to a nonaffiliated third party unless —

(A) such financial institution clearly and conspicuously discloses to the consumer, in writing or in electronic form or other form permitted by the regulations prescribed under section 504, that such information may be disclosed to such third party;

(B) the consumer is given the opportunity, before the time that such information is initially disclosed, to direct that such information not be disclosed to such third party; and

(C) the consumer is given an explanation of how the consumer can exercise that nondisclosure option.

15 U.S.C. §§ 6802(a)-(b).

The GLBA defines "nonpublic personal information" as: personally identifiable financial information —

(i) provided by a consumer to a financial institution;

(ii) resulting from any transaction with the consumer or any service performed for the consumer; or (iii) otherwise obtained by the financial institution.

15 U.S.C. § 6809(4)(A).

If section 6802 applies to REAL VEBA, then CTC, as a financial institution, is prohibited from releasing any of the subpoenaed information, other than the REAL VEBA plan documents, to the Secretary, a nonaffiliated third party, unless an exception applies. The threshold question is whether section 6802 applies to REAL VEBA.

1. Is REAL VEBA a "Consumer" Under Gramm-Leach-Bliley?

For section 6802 to apply to REAL VEBA, REAL VEBA must be a "consumer" under section 6809(4). The parties disagree, however, as to whether REAL VEBA is a "consumer." The District Court did not address this question; it ruled for DOL on other grounds.5 The Secretary has, nonetheless, urged us to consider affirming the District Court on this alternative basis, as we are permitted to do. E.g., Storey v. Burns Int'l Sec. Servs., 390 F.3d 760, 761 n. 1 (3d Cir.2004).

an individual who obtains, from a financial institution, financial products or services which are to be used primarily for personal, family, or household purposes, and also means the legal representative of such an individual.

15 U.S.C. § 6809(9).

Obviously, REAL VEBA is not an individual. CTC, however, argues that REAL VEBA is still a "consumer" because its power of attorney from the beneficiaries makes it "the legal representative of the individuals who receive benefits through the Plan." The Secretary contends that CTC's claim to be REAL VEBA's legal representative cannot be maintained in the face of Federal Trade Commission (FTC) regulations adopted under the GLBA.

GLBA section 6804(a)(1) provides rulemaking authority to various regulatory agencies for the particular types of financial institutions within their regulatory purview. 15 U.S.C. § 6804(a)(1). Section 6805(7) provides that financial institutions like CTC, a state-chartered non-banking trust, are within the catch-all regulatory ambit of the FTC. 15 U.S.C. § 6805(7). FTC regulations provide examples of who is not a "consumer" under GLBA section 6809(9):

(vi) An individual is not your consumer solely because he or she has designated you as trustee for a trust.

(vii) An individual is not your consumer solely because he or she is a beneficiary of a trust for which you are a trustee.

(viii) An individual is not your consumer solely because he or she is a participant or a beneficiary of an employee benefit plan that you sponsor or for which you act as a trustee or fiduciary.

16 C.F.R. §§ 313.3(e)(2)(vi)-(viii).

The Secretary argues that the FTC definitions demonstrate that REAL VEBA is not a consumer under the GLBA. The Secretary, however, mistakenly attributes to FTC definitions the interpretative weight we would give in a DOL matter to those of the DOL. While we give agencies' regulations controlling-weight deference, Chevron U.S.A. Inc. v. Natural Res. Def. Council, Inc., 467 U.S. 837, 842-43, 104 S. Ct. 2778, 81 L. Ed. 2d 694 (1984), it is only when agencies are enforcing their own regulations. Sec'y of Labor v. Excel Mining, LLC, 334 F.3d 1, 7 (D.C.Cir.2003) ("we do not generally accord deference to one agency's interpretation of a regulation issued and administered by another agency"); Amerada Hess Pipeline Corp., v. Fed. Energy Reg. Comm'n, 117 F.3d 596, 600 (D.C.Cir.1997). When an agency seeks to piggyback upon another agency's regulation for its own enforcement purposes, such deference is inappropriate — both because of differences in agency expertise and because of the fact that deference follows Congressional delegation. Id. at 601.

Indeed, in the case of the GLBA, there is no reason to give FTC regulations deference in their interpretation by the Secretary of Labor because of the possibility of multiple, conflicting regulatory interpretations of the GLBA by the various agencies with overlapping rulemaking authority under GLBA section 6804(a)(1). It is conceivable that two or more agencies could create reasonable, but different, interpretative regulations regarding the same statutory term. The GLBA itself foresaw this possibility and its language urges agencies to coordinate their regulations to the extent possible. See 15 U.S.C. § 6804(a)(2). When it is possible for an agency to pick and choose between conflicting regulations, the agency should not be entitled to choose the convenient one and then receive Chevron deference. The mere fact that there could be conflicting regulations should preclude Chevron deference.

Thus, in the case before us, the Secretary is in the same position as a private party who might bring an action. In such a situation, federal regulations are persuasive, but no more, as to statutory interpretation. For that reason, we reject the Secretary's argument that REAL VEBA is not a consumer because it fails to fall within FTC regulations defining that term.

Our analysis of the situation leads us to the following conclusion: REAL VEBA serves as a legal representative of its beneficiaries and this role is sufficient to qualify REAL VEBA as a "consumer" of CTC under the GLBA if the plan beneficiaries are "individuals who obtain services from CTC."

The Secretary urges that REAL VEBA is not a consumer within section 6809(9) because the plan beneficiaries are not "individuals[ ] who obtain" services directly from CTC; rather, the beneficiaries "passively" receive benefits from the financial institution — this passive receipt does not amount to "obtaining." Thus, according to the Secretary, the beneficiaries are not themselves consumers, and their legal representative is not a consumer. The Secretary's definition of "obtain" is, however, dubious.

The parties both rely on a dictionary definition of "obtain": "To come into the possession or enjoyment of (something) by one's own effort or by request; to procure or gain, as the result of purpose and effort; hence, generally, to acquire, get." The Oxford English Dictionary, vol. 10, at 669 (2d ed.1989). Under this definition, it is clear that REAL VEBA beneficiaries "obtain" financial services from CTC, namely the payment of insurance policy premiums and the provision of ministerial financial services. We conclude that this is sufficient to qualify REAL VEBA beneficiaries as consumers and, thus, to qualify REAL VEBA a consumer if it is the beneficiaries' legal representative.

2. Was the Subpoena Properly Authorized?

The Secretary, however, goes on to argue that, even if REAL VEBA is a "consumer" and entitled to the protections of GLBA section 6802(a), a statutory exception to section 6802(a), applies here. Section 6802(e)(8) provides that 6802(a):

[S]hall not prohibit the disclosure of nonpublic personal information — . . .

(8) to comply with Federal, State, or local laws, rules, and other applicable legal requirements; to comply with a properly authorized civil, criminal, or regulatory investigation or subpoena or summons by Federal, State, or local authorities; or to respond to judicial process or government regulatory authorities having jurisdiction over the financial institution for examination, compliance, or other purposes as authorized by law.

15 U.S.C. § 6802(e)(8). The District Court found that the section 6802(e)(8) exception applied in this case even though the Secretary's jurisdiction to conduct the investigation had not yet been determined. The District Court considered that the question of statutory coverage of REAL VEBA under ERISA was "not ripe for decision because it is not a legal issue, but rather one that depends on the information sought by the subpoena ... [and] the secretary is not required to demonstrate that the Plan is covered by ERISA prior to seeking enforcement." The District Court did not cite any Third Circuit law for this last proposition; instead, it relied on a ruling by the Eighth Circuit Court of Appeals in Donovan v. Shaw, 668 F.2d 985, 989 (8th Cir.1982).

CTC disputes the District Court's ruling. CTC argues that the burden of proof of jurisdiction is on the Secretary and asserts that REAL VEBA is not covered by ERISA. The Secretary does not dispute that it bears the burden of proof of jurisdiction. Rather, it argues that the question is not ripe and that DOL needs the subpoenaed information to determine jurisdiction.

CTC claims that the District Court erroneously relied on preGLBA ERISA caselaw to determine if the investigation was properly authorized. Specifically, the District Court relied on Shaw in which the Eighth Circuit held that the Secretary could conduct an investigation before jurisdiction had been determined:

It is well-settled that a subpoena enforcement proceeding is not the proper forum in which to litigate the question of coverage under a particular federal statute. This question, reserved for initial determination by the administrative agency seeking judicial enforcement of its subpoena cannot be resolved before the agency has had an opportunity to examine the relevant records. Thus, in a subpoena enforcement action, the agency cannot be required to demonstrate that the very matter or entity it seeks to investigate under its statutory investigatory powers is covered by the enabling statute since the "(authority) to investigate the existence of violations . . . include(s) the authority to investigate coverage."

668 F.2d at 989 (citations omitted, ellipsis and parentheses in original). CTC argues that Shaw is contrary to the spirit of the GLBA and relies on the Seventh Circuit's opinion in Reich v. Great Lakes Indian Fish and Wildlife Commission, which held that the Secretary was required to establish regulatory jurisdiction in order to enforce a subpoena. 4 F.3d 490 (7th Cir. 1993).

The coverage question in Great Lakes was a question of law. In the instant case, however, regulatory jurisdiction involves questions of fact: (1) whether "the group of employers that establishes and maintains the plan" is "a `bona fide' association of employers `tied by a common economic or representation interest, unrelated to the provision of benefits'" and (2) whether "the employer-members of the organization that sponsors the plan" exercise control, directly or indirectly, in both form and substance, over the plan. Gruber v. Hubbard Bert Karle Weber, Inc., 159 F.3d 780, 787 (3d Cir.1998). Moreover, in ruling on the subpoena in Koresko, we adopted Shaw and held that the District Court properly enforced administrative subpoenas without inquiring into the question of the agency's jurisdiction because "coverage by the statute is not an element of [the Secretary]'s prima facie case, and lack of coverage is not a defense to enforcement ...." 2005 U.S.App. LEXIS 22025, at *10 (3d Cir. Oct. 12, 2005). Koresko, however, did not consider Shaw vis-à-vis the GLBA because the subjects of the subpoena in that case were not financial institutions. For that reason, Koresko and Penn-Mott were not able to invoke the GLBA as a defense. Therefore, Koresko is distinguishable on this point.

GLBA section 6802(e)(8) has three clauses, each of which provides an exception to section 6802(a)-(b). The Secretary relies on the second clause, which provides an exception to GLBA's prohibitions in order to "to comply with a properly authorized civil, criminal, or regulatory investigation or subpoena or summons by Federal, State, or local authorities . . . ." 15 U.S.C. § 6802(e)(8). The Secretary argues that the second clause is a separate exception to the GLBA from the first and third clauses of section 6802(e)(8) and that the language in the second clause does not require a finding of agency jurisdiction, in distinction to the third clause, which does expressly require the existence of jurisdiction to undertake the investigation. The Secretary claims that the second clause of section 6802(e)(8) is well within the ambit of Shaw and Koresko.

We find this distinction unconvincing. Implicit in the term "properly authorized" is a finding of jurisdiction to undertake the investigation. Applying Shaw and Koresko to the CTC subpoena would make a nullity of the GLBA's "properly authorized" language. Because disclosure is a bell that cannot be unrung, a later review of jurisdiction would not undo the harm from a disclosure that violated the GLBA and which might involve costly document production.

In this case, jurisdiction should be relatively easy for the Secretary to determine simply on the basis of REAL VEBA plan documents, which do not contain protected personal financial information and which appear to have already been turned over to the Secretary. To the extent that these documents are inadequate, the Secretary is entitled to significant document production from Penn-Mott and Koresko. Indeed, these organizational documents would appear to be adequate for a determination of jurisdiction, as the question of ERISA coverage relates to the role of the employers who are the plan sponsors, not to the beneficiary-employees. See, e.g., Gruber, 159 F.3d at 787.

It is well-established that administrative subpoenas will be enforced when the agency shows that "the investigation will be conducted pursuant to a legitimate purpose, that the inquiry is relevant, that the information demanded is not already within the agency's possession, and that the administrative steps required by statute have been followed." Wentz, 55 F.3d at 908 (emphasis added). We are aware of Koresko's intransigence in complying with the District Court's enforcement order that we affirmed. Nonetheless, we consider the information to be in the Secretary's possession because she is entitled to it by court order.6

Therefore, we hold that the District Court erred in ruling that the issue of the Secretary's jurisdiction was not ripe for adjudication. In order to make GLBA's protections meaningful, before private consumer financial information is released by a financial institution to the DOL, the Secretary must establish jurisdiction to conduct the investigation.

C. Stay of Enforcement Pending Appeal and Civil Contempt

The District Court denied CTC's motion to stay enforcement pending appeal. When CTC refused to comply with its order, the District Court held CTC in contempt and fined CTC $250 a day, explaining that "CTC has refused to comply with Court orders — even an order to which it agreed .... The Court has no choice but to hold CTC in civil contempt." While CTC did refuse to comply with a properly issued court order, in light of our reversal of the District Court's subpoena enforcement order, we will vacate its ancillary contempt order.

For the reasons stated above, we will vacate the District Court's orders enforcing the subpoena, denying the stay, and finding CTC in contempt, and we will remand this case to the District Court for further proceedings consistent with this opinion.