National Western Life Insurance Company and United American Insurance Company ("the petitioners"), defendants in an action pending in the Jefferson Circuit Court, petition for a writ of mandamus directing the Jefferson Circuit Court to vacate its order compelling the petitioners to disclose to the plaintiff in the action certain personal information regarding their customers and to enter a protective order regarding that information. The petitioners contend that the disclosure of the information is barred by 15 U.S.C. § 6802, a part of the Gramm-Leach-Bliley Act,15 U.S.C. § 6801 et seq. ("the GLBA"). We disagree, and we deny the petitions.
I. Facts These mandamus petitions involve a pure question of statutory construction, and the facts relevant to that question are not disputed.
Terrill W. Sanders, as administrator of the estate of John W. Guthrie, deceased ("the respondent"), filed an action based upon an alleged negligent issuance of a life-insurance policy,1 naming as defendants the petitioners, among others. In pursuing this claim, the respondent sought discovery from the petitioners of insurance policies and any other insurance documents of several individuals who are not parties to, and who have no interest in, this action. The petitioners objected to the respondent's request, asserting that the documents, which contain medical histories, Social Security numbers, marital status, occupation, height, weight, date and location of birth, address, day and evening telephone numbers, and insurance choices, premiums, and benefits, are confidential and private.
The respondent then filed a motion to compel, seeking the production, without limitation, of all the requested documents. The petitioners filed motions for protective orders and motions in opposition to the respondent's motion to compel. The trial court granted the petitioners' motions for protective orders. However, upon the respondent's motion to reconsider, the court ordered the petitioners to produce the documents.
The petitioners filed motions to reconsider, restating all of their previous arguments and adding a new one: that the privacy provision of the GLBA, 15 U.S.C. § 6802, barred the petitioners from disclosing the requested information. The trial court denied the petitioners' motions to reconsider, and these now-consolidated petitions for the writ of mandamus followed.
II. Standard of Review Normally, in reviewing a petition for a writ of mandamus directed to a trial court's ruling on a discovery matter, this Court must decide whether the trial court exceeded its discretion. Ex parte Clarke, *Page 221 582 So.2d 1064, 1067 (Ala. 1991). However, when the trial court's discovery order is predicated upon a pure question of statutory construction, as it is in this case, we review this, as we review all questions of statutory construction, de novo, giving no deference to the trial court's conclusions. Pitts v. Gangi,896 So.2d 433 (Ala. 2004); Greene v. Thompson, 554 So.2d 376 (Ala. 1989).
III. Analysis Enacted in 1999, the GLBA prohibits a financial institution from "disclos[ing] to a nonaffiliated third party any nonpublic personal information" received by the institution from a consumer, unless the consumer has notice of the disclosure and has been given an opportunity to "opt out" of the disclosure, that is, "to direct that such information not be disclosed to such third party." 15 U.S.C. § 6802(b)(1)(B). Congress expressly stated its purpose behind this prohibition as follows:
15 U.S.C. § 6801. The GLBA expressly states that it supersedes any "statute, regulation, order, or interpretation in effect in any State" to the extent that any "such statute, regulation, order, or interpretation is inconsistent with the provisions of this subchapter." 15 U.S.C. § 6807(a)."(a) Privacy obligation policy. It is the policy of the Congress that each financial institution has an affirmative and continuing obligation to respect the privacy of its customers and to protect the security and confidentiality of those customers' nonpublic personal information.
"(b) Financial institutions safeguards. In furtherance of the policy in subsection (a) of this section, each agency or authority described in section 6805(a) of this title shall establish appropriate standards for the financial institutions subject to their jurisdiction relating to administrative, technical, and physical safeguards —
"(1) to insure the security and confidentiality of customer records and information;
"(2) to protect against any anticipated threats or hazards to the security or integrity of such records; and
"(3) to protect against unauthorized access to or use of such records or information which could result in substantial harm or inconvenience to any customer."
The general prohibition in the GLBA on disclosure of nonpublic personal information is subject to certain exceptions, which, in light of the express purposes behind the GLBA, have been properly held to be "limited in scope and purpose." Individual ReferenceServs. Group, Inc. v. FTC, 145 F.Supp.2d 6, 36 (D.D.C. 2001) (stating that the "legislative history and structure [of the GLBA] indicate that Congress intended the exceptions [in the GLBA] to be limited in scope and purpose"). One of those exceptions is § 6802(e)(8), which provides:
"(e) General exceptions. Subsections (a) and (b) of this section shall not prohibit the disclosure of nonpublic personal information —
". . . .
"(8) to comply with Federal, State, or local laws, rules, and other applicable legal requirements; to comply with a properly authorized civil, criminal, or regulatory investigation or subpoena or summons by Federal, State, or local authorities; or to respond to judicial process or government regulatory authorities having jurisdiction over the financial institution for examination, compliance, or other purposes as authorized by law."
In this case, there is no dispute that the petitioners are bound by the *Page 222 GLBA, that the information sought by the respondent is "nonpublic personal information," and that the respondent is a "nonaffiliated third party." The sole issue, therefore, is whether 15 U.S.C. § 6802(e)(8) allows the petitioners to disclose the requested information to the respondent.
No Alabama appellate court has interpreted § 6802(e)(8). The handful of courts in other jurisdictions that have interpreted the provision have arrived at conflicting opinions as to whether15 U.S.C. § 6802(e)(8) allows disclosure of nonpublic personal information by a financial institution to a private plaintiff in a civil action, and, if it does, under which part of the provision disclosure is allowed. In Marks v. Global MortgageGroup Inc., 218 F.R.D. 492 (S.D.W.Va. 2003), the United States District Court for the Southern District of West Virginia reviewed a federal magistrate judge's ruling that § 6802(e)(8) allowed the disclosure by a financial institution of "nonpublic personal information" to a plaintiff in a civil action who was undisputedly a "nonaffiliated third party." The federal magistrate judge did not rule that the disclosure was allowed under the "judicial process" language of § 6802(e)(8), but rather that it was allowed under the language permitting disclosure "to comply with Federal, State, or local laws, rules, and other applicable legal requirements." Marks, 218 F.R.D. at 495. The federal district court disagreed with this interpretation, but affirmed the magistrate's ruling by holding that the disclosure was allowed under the "judicial process" language:
218 F.R.D. at 495-96."The court agrees that § 6802(e)(8) of the GLBA permits the defendant to disclose the information sought by the plaintiffs, but for reasons different from those of the Magistrate Judge. The language in § 6802(e)(8) permitting disclosure `to comply with Federal, State, or local laws, rules, and other applicable legal requirements' refers to the numerous federal and state statutes, rules, and legal requirements that regulate the financial industry. The purpose of this exception is to allow financial institutions to comply with these various laws and requirements without fear of violating the GLBA. The language does not create an exception for the disclosure of information in the course of civil discovery.
"However, section 6802(e)(8) also allows disclosures made `to respond to judicial process or government regulatory authorities having jurisdiction over the financial institution for examination, compliance, or other purposes as authorized by law.' 15 U.S.C. § 6802(e)(8) (emphasis added). The plaintiffs contend that this language creates an independent `judicial process' exception to the opt-out provision that applies to civil discovery. The defendant asserts that the only `judicial process' exception envisioned by Congress is one relating to `examination, compliance or other purposes as authorized by law' by those entities having jurisdiction over financial institutions. See id.
"The court finds that 15 U.S.C. § 6802(e)(8) permits a financial institution to disclose the non-public personal financial information of its customers to comply with a discovery request. The phrase `to respond to judicial process' is syntactically separate and distinct from the phrase `to respond to . . . government regulatory authorities having jurisdiction over the financial institution for examination, compliance, or other purposes as authorized by law.' See § 6802(e)(8). Thus, the `judicial process' exception is independent from, and in addition to, the exception permitting disclosure to comply with a government regulatory investigation. Furthermore, *Page 223 the legislative history indicates that the House Bill, which added the privacy protections to the GLBA, envisaged an independent judicial process exception. See H.R. 74, 106th Cong. 93, 108-09, 124 (1999) (discussing a judicial process exception without reference to `government regulatory authorities having jurisdiction over the financial institution for examination, compliance, or other purposes as authorized by law'). When a party must disclose information pursuant to a discovery request, the party is responding to judicial process. Thus, under the judicial process exception, the defendant may disclose its customers' nonpublic personal information in response to the plaintiffs' discovery request."
Soon after Marks was decided, the Supreme Court of West Virginia adopted the reasoning in Marks. See Martino v.Barnett, 215 W.Va. 123, 595 S.E.2d 65 (2004). In doing so, the court held that there was "no basis for limiting the effect of the exception to discovery as no such limitation to application of the term `judicial process' appears in the GLBA exception."Martino, 215 W.Va. at 130, 595 S.E.2d at 72.
We turn now, for the first time, to our own examination of § 6802(e)(8). As an initial matter, we dismiss the respondent's argument that disclosure is appropriate as being in compliance "with a properly authorized civil, criminal, or regulatory investigation or subpoena or summons by Federal, State, or local authorities." 15 U.S.C. § 6802(e)(8). It seems clear that in the clause quoted above, the phrase "by Federal, State, or local authorities" modifies "properly authorized civil, criminal, or regulatory investigation or subpoena or summons," so that a subpoena or other request made by a private plaintiff in a civil action would not fall within the scope of this language. The "judicial process" language, however, is less clear and is the primary focus of the arguments before us.
In DeKalb County LP Gas Co. v. Suburban Gas, Inc.,729 So.2d 270, 275-76 (Ala. 1998), we explained the process of statutory construction:
"In determining the meaning of a statute, this Court looks to the plain meaning of the words as written by the legislature. As we have said:
"`"Words used in a statute must be given their natural, plain, ordinary, and commonly understood meaning, and where plain language is used a court is bound to interpret that language to mean exactly what it says. If the language of the statute is unambiguous, then there is no room for judicial construction and the clearly expressed intent of the legislature must be given effect."'
"Blue Cross Blue Shield v. Nielsen, 714 So.2d 293, 296 (Ala. 1998) (quoting IMED Corp. v. Systems Eng'g Assocs. Corp., 602 So.2d 344, 346 (Ala. 1992)). . . . It is true that when looking at a statute we might sometimes think that the ramifications of the words are inefficient or unusual. However, it is our job to say what the law is, not to say what it should be. Therefore, only if there is no rational way to interpret the words as stated will we look beyond those words to determine legislative intent. To apply a different policy would turn this Court into a legislative body, and doing that, of course, would be utterly inconsistent with the doctrine of separation of powers. See Ex parte T.B., 698 So.2d 127, 130 (Ala. 1997)."
(Emphasis added.)
However, here the problem is not that there is no rational way to understand *Page 224 the words as they are written, but that there is more than one rational way to understand those words, i.e., there is no single "plain meaning." The phrase "judicial process" could have a very broad or a very specific meaning, as reflected in the following definition from Black's Law Dictionary 1205 (6th ed. 1990):
"Judicial process. In a wide sense, this term may include all the acts of a court from the beginning to the end of its proceedings in a given cause; but more specifically it means the writ, summons, mandate, or other process which is used to inform the defendant of the institution of proceedings against him and to compel his appearance, in either civil or criminal cases."
Additionally, the petitioners suggest a third meaning, one taken from the text of § 6802(e)(8): that the "judicial process" referred to is that process "having jurisdiction over the financial institution for examination, compliance, or other purposes as authorized by law." This ambiguity in the statutory language justifies the use of other canons of statutory construction (beyond the "plain-meaning rule") in determining which definition Congress intended. DeKalb County LP Gas Co.,729 So.2d at 277 ("We should turn to extrinsic aids to determine the meaning of a piece of legislation only if we can draw no rational [i.e., single unambiguous] conclusion from a straightforward application of the terms of the statute.");Zitterow v. Nationwide Mut. Ins. Co., 669 So.2d 109, 112 (Ala. 1995) ("`[L]anguage is ambiguous when it may be understood in more than one way or when it refers to two or more things at the same time.'" (quoting American Reliance Ins. Co. v. Mitchell,238 Va. 543, 547, 385 S.E.2d 583, 585 (1989))).
We begin our analysis with the petitioners' only concrete suggested interpretation. However, guided not only by the statutory language but also by other evidence to the contrary, we cannot accept the petitioners' argument that "judicial process" is limited to that process "having jurisdiction over the financial institution for examination, compliance, or other purposes as authorized by law."
First, as the Marks court stated, the phrase "having jurisdiction over the financial institution for examination, compliance, or other purposes as authorized by law" fits well as a modifier of "government regulatory authorities," but is a very awkward modifier of "judicial process." As the Marks court found, the most natural reading of the language is that "to respond to judicial process" is independent from the remainder of the sentence. Marks, 218 F.R.D. at 496 ("The phrase `to respond to judicial process' is syntactically separate and distinct from the phrase `to respond to . . . government regulatory authorities having jurisdiction over the financial institution for examination, compliance, or other purposes as authorized by law.'").
Additionally, the legislative history referenced by the federal district court in Marks regarding the House Bill that added the privacy protections to the GLBA does in fact appear to "envisag[e] an independent judicial process exception,"218 F.R.D. at 495-97, and provides no sufficient basis for narrowing the meaning of the phrase "judicial process":
"The subtitle provides for a number of exceptions from the disclosure, opt-out, and access provisions. Pursuant to these exceptions, the institution may divulge or make unrelated use of the information to effect or enforce the transaction or a related transaction; to protect the confidentiality or security of its records; to take precautions against liability; to respond to judicial process, to the extent permitted or required under other provisions of law and in accordance *Page 225 with the Right to Financial Privacy Act of 1974; to provide information to law enforcement agencies or for an investigation on a matter related to public safety; to provide information to a consumer reporting agency in accordance with the Consumer Credit Protection Act; or in executing a sale or exchange whereby the financial institution transfers the business unit or operation, or substantially all the assets of the business unit or operation with which the customer's transactions were effected."
H.R. 74, 106th Cong. 93, 108-09 (1999); see also id. at 93, 118-19, 202. But see id. at 109 ("The Committee intends that the definitions of the terms used in the exception provisions . . . will be applied in a manner consistent with the subtitle's goal of providing consumers with a reliable means to protect their personal financial information.").
Furthermore, the use of the unmodified phrase "to respond to judicial process" as an exception to a prohibition on disclosure of personal information was not unfamiliar to Congress when it enacted the GLBA. In 1998, one year before the enactment of the GLBA, Congress enacted the Children's Online Privacy Protection Act of 1998, 15 U.S.C. § 6501 et seq. ("COPPA"). The privacy provision in COPPA, which has a somewhat similar structure to the one in the GLBA, prohibits the disclosure by operators of Internet Web sites of personal information obtained from children unless the operators provide notice of the operator's disclosure policy and receive "verifiable parental consent" for the disclosure. 15 U.S.C. § 6502(a)(1), (b)(1)(A). Like the GLBA, COPPA provides certain exceptions to its general prohibition on disclosure, allowing disclosure without parental consent under certain circumstances:
"The regulations shall provide that verifiable parental consent under paragraph (1)(A)(ii) is not required in the case of —
". . . .
"(E) the collection, use, or dissemination of such information by the operator of such a website or online service necessary —"(i) to protect the security or integrity of its website;
"(ii) to take precautions against liability;
"(iii) to respond to judicial process; or
"(iv) to the extent permitted under other provisions of law, to provide information to law enforcement agencies or for an investigation on a matter related to public safety."
(Emphasis added.)
We conclude that the phrase "to respond to judicial process" is not modified by anything in the text of § 6802(e)(8). Additionally, regarding the only other alternative before us — that "judicial process" means that initial process "which is used to inform the defendant of the institution of proceedings against him and to compel his appearance," Black's Law Dictionary, supra, — there is simply no evidence from any source indicating that Congress intended such a meaning in § 6802(e)(8).2 *Page 226
Simply put, we find no sufficient basis to justify a "narrowing" of the "judicial process" exception. The petitioners and amici curiae3 have presented persuasive arguments that the "judicial process" exception, if it is interpreted in its broad, but plainest sense — as we today interpret it — is seemingly out of proportion with the more narrow exceptions listed in § 6802(e), and possibly with the generalized policies stated in § 6801. However, the petitioners have not presented to this Court any justifiable way of reading the "judicial process" language, or any specific evidence of a Congressional intent to read that language, more narrowly than what the phrase "judicial process" most plainly means.4 A perceived lack of proportionality in a statute, like a perceived lack of wisdom in a statute, does not empower this Court to rewrite the statute, even if we *Page 227 wanted to do so.
We hold that the phrase "judicial process" in § 6802(e)(8) encompasses a court order. See Ex parte Mutual Sav. Life Ins.Co., 899 So.2d 986, 991 (Ala. 2004) (also holding that a court order compelling discovery constitutes judicial process under the GLBA). However, as we note in Ex parte Mutual Savings, released today:
"[A] court, when exercising its broad discovery discretion by ordering the discovery of customers' nonpublic personal information, should also issue a comprehensive protective order to guard the customers' privacy."899 So.2d at 993 (footnote omitted).
Because the trial court's order compelling the production of the information here is certainly "judicial process" under § 6802(e)(8), the petitioners are not prohibited by the GLBA from "respond[ing] to [that] judicial process" and disclosing the requested information.
IV. Conclusion Based on the above, we hold that the trial court did not exceed its discretion in denying the petitioners' motions to reconsider to the extent that those motions relied upon the GLBA. The petitioners are not entitled to a writ of mandamus directing the Jefferson Circuit Court to vacate its order compelling them to disclose, as part of discovery, certain information regarding their customers.
PETITIONS DENIED.
NABERS, C.J., and SEE, LYONS, JOHNSTONE, HARWOOD, WOODALL, and STUART, JJ., concur.