Lost in the Fine Print: Readability of Financial Privacy Notices (Hochhauser)

By Mark Hochhauser, Ph.D.
Readability Consultant
Copyright 2001 by Mark Hochhauser

Note: This document replaces "Lost in the Fine Print" I and II, which were posted on the PRC web site in April 2001 and May 2001.

Summary:

Readability analyses of 60 financial privacy notices found that they are written at a 3rd-4th year college reading level, instead of the junior high school level that is recommended for materials written for the general public. Consumers will have a hard time understanding the notices because the writing style uses too many complicated sentences and too many uncommon words.

Beginning this year, banks and other financial institutions have begun to inform their customers about their privacy rights. The federal Financial Services Modernization Act, also known as Gramm-Leach-Bliley (GLB), requires customers to be given the choice to opt-out of their bank's sharing of personal information with third parties. "Privacy notices" are being mailed to consumers in their bank statements, credit card statements, investment reports, mortgage statements, insurance mailings and so on.

How readable are the "Privacy Notices?"

I reviewed 60 privacy notices using several software programs including Prose, WStyle 1.6, Grammatik 6.0, Reader 1.2, and Correct Grammar 2.0. These programs calculated the Flesch Reading Ease Score, writing style, sentence and vocabulary complexity and word commonness.

Instead of being written in plain English, the 60 privacy policies average a 3rd-4th year college (grade 15.6) reading level, making them "difficult" to read on the Flesch Reading Ease Score. Note that readability software programs don't score higher than grade 17--first year graduate school. It's possible that some of the policies written at a graduate school reading level may be more complicated than a grade 17. In short, average readers will find these notices hard to understand, especially the elderly and those whose primary language is not English.

Recent Census data shows that about 85% of adults have a high school degree. About 25% have one or more college degrees. Despite these levels of educational attainment, research shows that many people read three-to-five grades lower than their highest level of educational attainment. Thus, it's not unusual for someone with a high school diploma to be reading at a 7th to 9th grade reading level. Because of that gap, literacy experts recommend that materials written for the "general public" be at about a junior high reading level.

One of the factors involved in readability is the number of words per sentence. Research suggests that to be easily understood, documents should average about 15-20 words per sentence. When sentences get too long (over 40 words), readers may forget the beginning of the sentence by the time they get to the end.

The following table shows the results of my readability analyses of 60 GLB privacy policies. These policies are ranked from "best" to "worst" in terms of Reading Ease. None of the notices, however, scored any better than "difficult," since the scores ranged from 24 to 47. Rudolf Flesch calculated Reading Ease based on the following scoring system:

Flesch Reading Ease Score

How do the Notices compare to state readability requirements?

Many states have readability requirements for insurance policies sold within the state. For example, Arkansas, Indiana, Kentucky and Ohio require a minimum score of 40 on the Flesch Reading Ease. Only 10 of the 60 notices reviewed would have met that requirement. Connecticut and Florida require a minimum of 45 on the Flesch; three of the notices met those state requirements. Maine requires a 50; none of the notices met that requirement.

Why elderly consumers will have a hard time understanding the Notice.

Across all age groups, people 65 and older have the lowest literacy scores, with an average educational attainment between 11th and 12th grade. Seventy year-old bank customers (born in 1931) with an average 11th - 12th grade education completed their education in the late 1940s. The following table shows the education levels of the populace versus individuals age 65 and over.

How "Clear and conspicuous" are the privacy notices?

According to the law, these new financial privacy notices are supposed to be written in a "clear and conspicuous" style. This means that the language used should be "reasonably understandable," a term which is not defined. But based on the readability statistics, none of these 60 notices was even close to meeting that criterion. WStyle, which analyzes writing style, classified 10 notices as having a "weak" writing style; 48 have a "poor" writing style, and 2 have a "very poor" writing style.

The GLB regulations offer six strategies for ensuring that the notice is written in a "clear and conspicuous" manner.

1) Presenting information in a clear and concise way. The readability analysis shows that the notices were not written in a clear and concise writing style. Being concise isn't the same as being clear.

Most notices say that "We maintain physical, electronic and procedural safeguards to protect customer information." (12 words) That's concise, but what does it mean?

The longer version (27 words) doesn't help much: "We also take other steps to safeguard customer information by maintaining physical, electronic, and procedural safeguards that comply with federal standards to guard your non-public personal information."

And the really long version (63 words) only confuses things more: "As further described below, we maintain administrative, technical and physical safeguards designed to (1) insure the security and confidentiality of customer records and information, (2) protect against anticipated threats or hazards to the security or integrity of such information and records, and (3) protect against unauthorized access to or use of such records or information which could result in substantial harm or inconvenience to our customers."

2) Using short explanatory sentences or bullet lists. Although all of the notices used bullet lists to some extent, some of the notices included too many bullet points with too much information. A bullet point doesn't help much if it's followed by two paragraphs of text (150 words). By the time you finish reading the bullet point you've forgotten what the bullet point is supposed to summarize. The 60 notices averaged about 48 sentences per notice: Grammatik software estimated that about 17% of those sentences were "short."

Grammatik 6.0 also measures "Sentence Complexity," based on the number of words and clauses in the notice--with a maximum "very complex" score of 100. The 60 privacy notices averaged 70, with a range of 38 to 92.

3) Using concrete everyday words. One way to measure this is to analyze word "commonness" of the privacy notices. Based on Reader software, a normal score is 1,450: a lower score means that the notice has many common words, and a higher score means that the notice has many uncommon words. The average score for the 60 notices was 1,993, which means that most notices are full of uncommon words. Nineteen of the notices scored below 1,450; forty-one scored above 1,450 -- with a range from 1,075 to 4,217.

Grammatik 6.0 measures "vocabulary complexity" based on the number of syllables in a document and a comparison to words in a list of unusual or difficult words -- with a maximum "very complex" score of 100. These 60 privacy notices averaged a vocabulary complexity score of 62, with a range of 42 to 75.

4) Using the active voice. WStyle Writing Style Analyzer software recommends that about 60% of sentences should be in the active voice. These notices averaged about 65% in the active voice, with a range of 43% to 83%. For example, a passive voice sentence is: "Every product or service we offer is designed to reflect the ways our customers actually use their accounts." The active voice version is: "We design every product or service to reflect the ways our customers actually use their accounts."

5) Avoiding multiple negatives. Most people have a hard time understanding sentences that have double negatives in them. On the one hand, federal guidelines state one way to make notices reasonably understandable is to avoid multiple negatives. On the other hand, those same guidelines offer a sample clause that will meet the opt-out requirements:

"If you prefer that we not disclose nonpublic personal information about you to nonaffiliated third parties, you may opt out of those disclosures, that is, you may direct us not to make those disclosures (other than disclosures permitted by law.)"

Here are a few other examples:

• "If you choose not to receive such solicitations from unaffiliated third parties, you may instruct Cal Fed not to disclose your non-public personal information (see below)." (California Federal Bank)
• "If you choose not to exercise your opt-out of sharing, no action is required." (Webster Bank)
• "We do not provide nonpublic information about you to any non-Fleet company whose products and services are being marketed unless you authorize us to do so." (Fleet Boston Financial)
• "We have opted out all of our customers from sharing with non-affiliated parties, meaning you do not have to formally notify us not to disclose your nonpublic personal information to non-affiliated parties." (Provident)
• "If you prefer that we not disclose nonpublic personal information about you to nonaffiliated third parties, you may opt out of those disclosures, that is, you may direct us not to make those disclosures (other than disclosures permitted by law.)" (Advanta) This is the approved clause in the federal regulations.

6) Avoiding imprecise explanations that may be interpreted differently.

Some examples of sentences open to interpretation:

• "We share your non-public personal public information only with contractual safeguards to protect the confidentiality of your information." (UniTrust)
• "An affiliate is a company we own or control, a company that owns or controls us, or a company that is owned or controlled by the same company that owns or controls us. Ownership does not mean complete ownership, but means owning enough to have control." (Seattle Savings Bank)
• "If you tell us not to share information with companies outside of MBNA that wish to offer you their products and services, as described above, please understand that we will continue to share information in these additional circumstances." (MBNA)
• "In the opt-out election, you will have the option of including or excluding the Credit Union from your opt-out election." (UniTrust)

And here's one of the more complicated sentences (77 words) from Honeywell Credit Union:

• "Except for this identification, transactional, and experiential information, when you request to be excluded from affiliate sharing of information in accordance with the procedures set out in this Use of Information section, we cannot share information about you and your products and services with us from your applications or agreements, from credit reporting agencies, or from other sources when the communication of this information would be classified as a "consumer report" under the Fair Credit Reporting Act."

Notices are also expected to be designed so they highlight the nature and importance of the information they contain. These require:

1) Using plain-language headings to call attention to the notice. Titles ranged from a simple "Privacy Policy" or "A Privacy Message" to "Consumer Privacy: Our Pledge to You." Only one of the notices (Anchor Bank) used the word "rights" in the title. These notices don't clearly tell consumers that the document is about their consumer rights--only that it's about company policy.

2) Using a typeface and type size that are easy to read. The two basic kinds of typefaces are "serif", which has little picks at the edges of each character and "sans serif" which does not have these little picks. This document is in a "serif" type face. A sans serif type face (in which this sentence is written) does not have the little picks, and is somewhat harder to read. The privacy notices were about equally divided between a serif typeface and a sans serif typeface. The notices would probably be more readable in serif.

Type size was a problem. The best line length is about 40 characters and spaces, with a maximum of 60-70. Consumers with middle-aged or older eyes may have a hard time reading very small print. Most of the brochures used columns that were about 3 inches wide, and had about 60-70 characters and spaces per line, or about 20 characters per inch. But the legibility of type can also be affected by margins and spacing.

3) Having wide margins and enough line spacing. Because of the way they were designed, some of the notices had fairly small margins. That's not surprising when there's a lot of information to be crammed into five or six columns of text. The combination of small margins with small text size makes for difficult reading. Plus, some of the notices had little or no spacing between paragraphs, creating a large block of text that can be hard to read. It's easy to lose your place in the paragraph when you're reading a 25-line paragraph with a justified (flush) right margin.

4) Using boldface or italics for key words. While all of the notices used boldface and italics for headings and subheadings, those headings varied from "Collecting Information" and "Information we collect" (which doesn't explain very much) to "How we obtain personal customer information" (which is more descriptive).

Conclusion:

Consumers will have difficulty reading and understanding the privacy notices they receive from their banks. The notices were supposed to written in a "clear and conspicuous" style so they would be "reasonably understandable." Instead, the notices I reviewed were poorly written with too many long sentences and too many uncommon words. Several notices will be illegible for some consumers, because of basic layout and design problems. They include too many words per line and not enough spacing between lines. If consumers are unable to easily see, read, and understand these privacy notices, how can they make informed decisions regarding a bank's use of their personal information?