The question in this appeal is whether the federal Fair Credit Reporting Act ("FCRA") preempts the California Financial Information Privacy Act (commonly known as "SB1") insofar as it regulates the exchange of information among financial institutions and their affiliates. The district court granted summary judgment to the Attorney General, holding that SB1 is not preempted in any respect. We reverse. We hold that the FCRA preempts at least some part of SB1's affiliate-sharing provisions. Because there is a possibility that some part of these provisions may survive preemption, we remand to the district court for further proceedings consistent with this opinion.

The FCRA was passed in 1970 with the stated purpose of

requir[ing] that consumer reporting agencies adopt reasonable procedures for meeting the needs of commerce for consumer credit, personnel, insurance, and other information in a manner which is fair and equitable to the consumer, with regard to the confidentiality, accuracy, relevancy, and proper utilization of such information in accordance with the requirements of this subchapter.

15 U.S.C. § 1681(b). To accomplish this goal, the FCRA regulates the issuance and use of "consumer reports" by "consumer reporting agencies." The term "consumer report" is defined by the FCRA as "any written, oral, or other communication of any information by a consumer reporting agency bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living" that is or is expected to be used for determining eligibility for credit and employment, and for a few other authorized purposes (such as production in response to a court order). Id. § 1681a(d)(1) (emphasis added). As will become apparent below, the key to this appeal is the meaning of "information," as used in this and other provisions of the FCRA.

The FCRA defines a "consumer reporting agency" as an entity that, subject to certain conditions, "regularly engages ... in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties." Id. § 1681a(f). The FCRA imposes fairly stringent restrictions on credit reporting practices. Among its many provisions, it limits the circumstances under which consumer reporting agencies are permitted to furnish consumer credit reports, id. § 1681b, restricts the information that may be included in consumer reports, id. § 1681c, and requires consumer report information to be disclosed to consumers who request it, id. § 1681g. The FCRA authorizes actual and punitive damages for violation of its provisions. Id. §§ 1681n, 1681o.

The original version of the FCRA left financial institutions uncertain about whether the communication of information to affiliated institutions constituted a "consumer report" subject to the requirements of the FCRA. In 1996, in response to these concerns, Congress amended the FCRA. The 1996 amendments exclude some communications of some kinds of information between affiliate financial institutions from the definition of "consumer report." Because such communications do not come within the definition of "consumer report," they are not subject to the requirements of the FCRA. See id. § 1681a(d)(2)(A)(i-iii).

Two exclusions are important here. The first provides that the term "consumer report" does not include any "communication... among persons related by common ownership or affiliated by corporate control," id. § 1681a(d)(2)(A)(ii), of "information solely as to transactions or experiences between the consumer and the person making the report," id. § 1681a(d)(2)(A)(i) (emphasis added). In the terminology used by the financial industry, the information at issue in this exception is "experience information"—i.e., information obtained by financial institutions from their own dealings with their customers.

The second provides that the term "consumer report" does not include any "communication of other information among persons related by common ownership or affiliated by corporate control, if it is clearly and conspicuously disclosed to the consumer that the information may be communicated among such persons and the consumer is given the opportunity, before the time that the information is initially communicated, to direct that such information not be communicated among such persons." Id. § 1681a(d)(2)(A)(iii) (emphasis added). In industry terminology, this second category is known as "non-experience" information.

At the same time, Congress added a preemption clause to the FCRA providing that

[n]o requirement or prohibition may be imposed under the laws of any State ... with respect to the exchange of information among persons affiliated by common ownership or common corporate control, except that this paragraph shall not apply [to a certain Vermont statute].

Id. § 1681t(b)(2) (emphasis added) (hereinafter, the "affiliate-sharing preemption clause"). As originally enacted, the affiliate-sharing preemption clause did not apply to more-protective state laws enacted after January 1, 2004, that stated explicitly their intent to supplement the FCRA. See 15 U.S.C. § 1681t(d)(2)(2000) (repealed by Pub.L. No. 108-159, § 711(3), 117 Stat. 1952 (Dec. 4, 2003)). In 2003, however, Congress amended the FCRA in the Fair and Accurate Credit Transactions Act of 2003 (the "FACT Act") to eliminate the sunset provision for the affiliate-sharing preemption clause. FACT Act, Pub.L. No. 108-159, § 711(3), 117 Stat.1952 (2003).

In addition, the FACT Act prohibits affiliates from using information "that would be a consumer report, but for [the affiliate-sharing exemptions of § 1681a(d)(2)(A)]" for "marketing purposes," unless such use is disclosed and consumers are given an opt-out opportunity. 15 U.S.C. § 1681s-3(a)(1). The FACT Act also establishes exceptions to these opt-out requirements under certain circumstances, see id. § 1681s-3(a)(4), such as when the consumer and the affiliate have a "pre-existing business relationship," id. § 1681s-3(a)(4)(A). Finally, the FACT Act expands the scope of the affiliate-sharing preemption clause as follows:

Requirements with respect to the use by a person of information received from another person related to it by common ownership or affiliated by corporate control, such as the requirements of this section, constitute requirements with respect to the exchange of information among persons affiliated by common ownership or common corporate control, within the meaning of section 1681t(b)(2) of this title.

Id. § 1681s-3(c) (emphasis added).

In 2003, California enacted the California Financial Information Privacy Act, commonly called SB1. SB1 regulates the disclosure of personal information about California consumers by financial institutions doing business in the state. Cal. Fin.Code §§ 4050-4060. In relevant part, it provides:

A financial institution shall not disclose to, or share a consumer's nonpublic personal information with, an affiliate unless the financial institution ... notifie[s] the consumer annually in writing... that the nonpublic personal information may be disclosed to an affiliate of the financial institution and the customer has not directed that the nonpublic personal information not be disclosed.

Id. § 4053(b)(1).1 Following the annual notification required by § 4053(b)(1), a consumer "shall be provided a reasonable opportunity prior to disclosure of nonpublic personal information to direct that nonpublic personal information not be disclosed." Id. § 4053(d)(3). SB1 exempts certain closely affiliated institutions from these requirements, provided the disclosing and receiving institutions use the same brand, operate within the "same line of business" (limited to "banking," "insurance," and "securities") and are regulated by the same agency. Id. § 4053(c)(1)-(3).

In 2004, the American Bankers Association, the Financial Services Roundtable, and the Consumer Bankers Association (collectively "the Associations") brought suit in federal district court, seeking declaratory and injunctive relief against California Attorney General Bill Lockyer and the other state officials responsible for the enforcement of SB1 (collectively "the Attorney General"). The Associations contend that SB1's opt-out provisions for affiliate information sharing are preempted by the FCRA, and allege that they would suffer irreparable injury if SB1 were enforced against them. The Associations and the Attorney General cross-moved for summary judgment. Relying in part on the federal Gramm-Leach-Bliley Act ("GLBA"), the district court granted summary judgment to the Attorney General. The Associations appealed.

We review the district court's grant of summary judgment de novo. Universal Health Servs., Inc. v. Thompson, 363 F.3d 1013, 1019 (9th Cir.2004). We must determine, viewing the evidence in the light most favorable to the nonmoving party, whether there are any genuine issues of material fact and whether the district court correctly applied the relevant substantive law. Olsen v. Idaho State Bd. of Med., 363 F.3d 916, 922 (9th Cir.2004).

A. Scope of the FCRA's Affiliate-Sharing Preemption Clause

In interpreting a preemption clause, "[w]e must give effect to [its] plain language unless there is good reason to believe Congress intended the language to have some more restrictive meaning." (Shaw v. Delta Air Lines, Inc., 463 U.S. 85, 97, 103 S. Ct. 2890, 77 L. Ed. 2d 490 (1983)). In interpreting the scope of a preemption clause, we generally presume that Congress has not intended to preempt state law, starting "with the assumption that the historic police powers of the States [are] not to be superseded by [federal legislation] unless that is the clear and manifest purpose of Congress." Cipollone v. Liggett Group, Inc., 505 U.S. 504, 516, 112 S. Ct. 2608, 120 L. Ed. 2d 407 (1992) (internal brackets, citation, and quotation marks omitted); see also Oxygenated Fuels Ass'n Inc. v. Davis, 331 F.3d 665, 668 (9th Cir.2003) ("[T]here is a general presumption against preemption in areas traditionally regulated by states."). "Congressional purpose is the ultimate touchstone of preemption analysis." Id. (internal quotation marks omitted).

In construing the affiliate-sharing preemption clause of the FCRA, § 1681t(b)(2), we start with the premise that "the words of a statute must be read in their context and with a view to their place in the overall statutory scheme." Food & Drug Admin. v. Brown & Williamson Tobacco Corp., 529 U.S. 120, 133, 120 S. Ct. 1291, 146 L. Ed. 2d 121 (2000) (internal citation and quotation marks omitted). Our goal in interpreting a statute is to understand the statute "as a symmetrical and coherent regulatory scheme" and to "fit, if possible, all parts into a ... harmonious whole." Id. (internal citations and quotation marks omitted).

We construe the affiliate-sharing preemption clause to preempt all state "requirement[s]" and "prohibition[s]" on the communication of "information" between affiliated parties. See 15 U.S.C. § 1681t(b)(2). However, as used in the affiliate-sharing preemption clause and elsewhere in the FCRA, "information" has a restricted meaning. It does not include all information. Rather, it includes only the sort of information described in the definition of "consumer report" in § 1681a(d)(1):

information ... bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living which is used or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing the consumer's eligibility for —

(A) credit or insurance to be used primarily for personal, family, or household purposes;

(B) employment purposes; or

(C) any other purpose authorized under section 1681b of this title.

Id. § 1681a(d)(1).

As we read the FCRA, the term "information" is used in the restricted sense of § 1681a(d)(1) in other provisions of the statute. For example, § 1681a(d)(2), the subsection immediately following, uses "information" in the same way. For the subset of "information" known as "experience information," communication of such information between affiliates is excluded from the definition of a "consumer report." See § 1681a(d)(2)(A)(ii). Similarly, for the subset known as "non-experience information," communication of such information between affiliates is excluded from the definition of "consumer report" provided that there has been adequate opt-out notice to the consumer. See § 1681a(d)(2)(A)(iii).

The affiliate-sharing preemption clause of the FCRA was added to the statute as part of the same 1996 package of amendments as § 1681a(d)(2).2 We believe it reasonable to construe the term "information," as it is used in the preemption clause, to have the same meaning as "information" in the FCRA's other provisions relating to information and information sharing between affiliates. See id. §§ 1681a(d)(1), (2)(A)(ii)-(iii), § 1681s-3(a)(1). That is, the word "information" in the affiliate-sharing preemption clause refers to the information described in the definition of a "consumer report" contained in § 1681a(d)(1).

This interpretation of "information" is supported by the 2003 FACT Act provisions limiting the use of information shared among affiliates to facilitate marketing solicitations. These requirements apply only to "communication of information that would be a consumer report, but for[subsections §§ 1681a(d)(2)(A)(i)-(iii), which exclude information shared among affiliates from the definition]." Id. § 1681s-3(a)(1). Notably, when Congress adopted the FACT Act, it also clarified that "[r]equirements with respect to the use . . . of information [shared among affiliates]" are covered by the affiliate-sharing preemption clause. Id. § 1681s-3(c) (emphasis added). That is, Congress precluded states from regulating the sharing of information among affiliates at the same time as it expanded the reach of the FCRA to regulate affiliates' sharing of such information. We find this compelling evidence that Congress saw the affiliate-sharing preemption clause as parallel and identical in scope to the FCRA's other affiliate information-sharing provisions.

We therefore hold that the affiliate-sharing preemption clause preempts SB1 insofar as it attempts to regulate the communication between affiliates of "information," as that term is used in § 1681a(d)(1). That is, SB1 is preempted to the extent that it applies to information shared between affiliates concerning consumers' "credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living" that is used, expected to be used, or collected for the purpose of establishing eligibility for "credit or insurance," employment, or other authorized purpose. See id. § 1681a(d)(1). On remand, the district court must determine whether, applying this restricted meaning of "information," any portion of the affiliate-sharing provisions of SB1 survives preemption and, if so, whether it is severable from the portion that does not. We express no opinion on either of these questions.

B. Applicability of the Gramm-Leach-Bliley Act

The Gramm-Leach-Bliley Act ("GLBA") was adopted in 1999 to eliminate barriers to affiliation among banks and other depository institutions, securities firms, and insurance companies. See Gramm-Leach-Bliley Act, Pub.L. No. 106-102, 113 Stat. 1338 (1999) (codified as amended in scattered sections of 12, 15, 16 and 18 U.S.C.). The GLBA explicitly states that none of its provisions — except for one explicit amendment not relevant here, see Pub.L. No. 106-102, § 506(a)(b) — "shall be construed to modify, limit, or supersede the operation of the Fair Credit Reporting Act." 15 U.S.C. § 6806. Thus, the preemptive scope of the FCRA is unaffected by the GLBA, and insofar as SB1 is preempted by the FCRA, we do not find the GLBA to be relevant. See Bank of Am. v. City & County of San Francisco, 309 F.3d 551, 565 (9th Cir.2002) (refusing to apply savings clause of one statute to limit the preemption clause of another).

REVERSED and REMANDED for further proceedings consistent with this opinion. Costs to Appellants.