Privacy Policy
Background: The Meteor Network allows student/borrowers, financial aid professionals and guarantor, lender, and loan servicer customer service representatives to view aggregated financial aid information online. To accomplish this, the Meteor Network includes access providers and data providers. The information presented via the Meteor Network is not stored within or in any way controlled by the Meteor Network, therefore, questions related to the information must be directed to the individual Data Providers. The Meteor Network is designed to protect individual privacy and to comply with the two federal laws that control financial data and student data: the Gramm-Leach-Bliley Act (GLB Act) and the Family Education Rights and Privacy Act (FERPA). Below we describe the roles, rights and responsibilities of the various participants in the Network.
Data Providers: Data providers include financial institutions subject to the Gramm-Leach-Bliley Act, Public Law 106-102, including the implementing regulations. The GLB Act governs the disclosure of non-public personal financial information by financial institutions. The Network is designed to restrict disclosures to student/borrowers, financial aid professionals, and guarantor, lender and loan servicer customer service representatives. Data Providers have certified that they have established policies, procedures, and practices to protect against unauthorized access to, or use of, data received through its Meteor Network connection which are comparable to the policies, procedures, and practices it follows with respect to other confidential, personal information in its possession.
Access Providers: Access Providers are in effect communication intermediaries. As such Access Providers shall not capture, store, use, or reuse any data obtained through the Meteor Network and shall not use any data obtained through the Meteor Network for marketing and/or solicitation purposes. Access Providers have certified that they have established policies, procedures, and practices to protect against unauthorized access to, or use of, data received through its Meteor Network connection which are comparable to the policies, procedures, and practices it follows with respect to other confidential, personal information in its possession.
Access to the Meteor Network by Students/Borrowers: There are no impediments in the GLB Act to providing an individual with access to his or her own financial information (any such disclosure would not be a disclosure to a third party). The principal control involved is authentication (validating that the individual is who he or she claims to be). Individuals authenticate themselves with a user ID and password or other unique ID (other than a Social Security number). Also, the Data Provider has the ability to override the security procedure used by the Access Provider by requiring a different authentication protocol (i.e., the Data Provider is able to mandate that the student/borrower authenticate himself or herself with the Data Provider's password).
Access to the Meteor Network by Financial Aid Professionals: Financial aid professionals (such as college or university financial aid staff) can only access non-public personal information through the Meteor Network if they are using the information in connection with the administration of financial aid programs. Each financial aid professional who logs onto the Meteor Network certifies, as part of the login process, that he or she is a financial aid professional, that he or she has institutional authority to view the information involved, that the information relates to an applicant, a current student, or a former student of the educational institution on whose behalf they are working, and that his or her use of the information is in connection with the administration of financial aid to the individual involved. As a general matter, a financial institution may disclose non-public personal financial information to schools in order to enable the school to administer its student assistance programs. The authority to make such a disclosure is based on 16 CFR 313.14(a) (processing a transaction that the individual requests or authorizes), 313.14(b)(1) (required or appropriate to enforce rights), 313.14(b)(2) (required or appropriate to carry out the transaction or the product or service of which the transaction is a part), 313.15(a)(1) (with consent), and 313.15(a)(2)(ii) (to protect against fraud or unauthorized transactions). The disclosure path may travel through an access provider, but in all cases the end use will be as described above. Each Access Provider signs a certification under which it agrees not to capture, store, use, or reuse any information that passes through its Web site.
Access to the Meteor Network by Authorized Representatives of those Servicing Loan Accounts: Access is limited to authorized representatives of guarantors and lenders for the purpose of servicing loan accounts that are, respectively, guaranteed by the guarantor or owned by the lender. The same GLB exceptions authorizing disclosure to school officials also authorize disclosures to guarantor and lender representatives.
Finally, loan servicer customer service agents have access to Meteor screens in order to answer questions from borrowers, school officials, and lenders and guarantors who are viewing borrower information. The only information the servicer will be able to view is data that the loan servicer provides as a Meteor Data Provider. Since the data will already be in the possession of the loan servicer, no GLB disclosure issues are involved.
Family Educational Rights and Privacy Act (FERPA): FERPA is a federal law that protects the privacy of student education records. FERPA applies to educational institutions that receive funds under an applicable U.S. Department of Education program. Meteor data providers can include schools that provide data on Perkins loans or other financial aid programs. Any such disclosure of information by schools is subject to FERPA, including the implementing regulations (34 CFR Part 99). Students/borrowers (or their parents, if the student has not reached the age of 18) may access their own records maintained by a school. Thus, the disclosure of loan information by a school to its students or former students is permitted by FERPA. Schools may also disclose information to appropriate parties in connection with financial aid for which the student has applied or has received, if the information is necessary to determine eligibility for such aid or enforce the terms and conditions of the aid. See 34 CFR 99.31(a)(4)(i). Financial aid professionals and guarantor, lender, and loan servicer customer service representatives that access Meteor data are covered by this FERPA exception because their use of the information is in connection with the administration of financial aid to the individual involved. They provide a certification of this commitment each time they access data.
