I. INTRODUCTION
Privacy provisions contained in the Gramm-Leach-Bliley Financial Modernization Act (P.L. 106-102, Title V, Subtitle A, 15 U.S.C. § 6801 et seq., hereinafter referred to as the “Act”) allow consumers to exercise an affirmative “opt-out” in order to prevent a financial institution from disclosing nonpublic personal information to third parties that are not affiliated with the financial institution. The Act also requires financial institutions to provide notice to customers about their privacy policies and practices. There is no restriction for a financial institution to disclose nonpublic personal information of consumers among affiliated companies or information about businesses and corporations.
The Act applies to any financial institution that is engaged in a financial activity, including banks, insurance companies, broker-dealers and finance companies. Federal banking regulators issued joint regulations to implement the privacy provisions. These regulations were effective November 13, 2000; however, compliance was voluntary until July 1, 2001, at which time all financial institutions must have provided initial privacy notices to all existing customers. The Federal Reserve Board assigned the rules implementing the Act to Regulation P (Part 230).
II. EXECUTIVE SUMMARY OF REQUIREMENTS
There are three principal requirements regarding the privacy of consumer financial information in the Act. These are:
III. DEFINITIONS
There are a number of key definitions that are important to refer to in order to fully understand the concepts of this law and regulation.
Affiliate – any company that controls, is controlled by, or is under common control with another company.
Clear and conspicuous –a notice that is reasonably understandable and designed to call attention to the nature and significance of the information in the notice.
A financial institution makes its notice reasonably understandable if it:
A financial institution designs its notice to call attention to the nature and significance of the information in it if the financial institution:
If a financial institution provides a notice on a web page, the financial institution designs its notice to call attention to the nature and significance of the information in it if the financial institution uses text or visual cues to encourage scrolling down the page if necessary to view the entire notice and ensure that other elements on the web site (such as text, graphics, hyperlinks or sound) do not distract attention from the notice and the financial institution either:
Collect – obtain information that a financial institution organizes or is able to retrieve by the name of an individual or by identifying number, symbol or other identifying particular assigned to the individual, irrespective of the source of the underlying information.
Consumer – an individual who obtains financial products or services for personal, family or household purposes. The term “financial services” includes a financial institution’s evaluation of a credit application. So even if an application is denied or withdrawn, the applicant is still considered a consumer. Note that the terms “consumers” and “customers” are separately defined.
If a financial institution intends to share nonpublic personal information about a consumer with nonaffiliated third parties, the financial institution must comply with the privacy regulations.
Examples
Consumer reporting agency – the same as defined in § 603(f) of the Fair Credit Reporting Act [15 U.S.C. § 1681a(f)].
Customer – a consumer who has a customer relationship with the financial institution. Note that the terms “consumers” and “customers” are separately defined.
Customer relationship – a continuing relationship in which a financial institution provides a financial product or service that is to be used by a consumer primarily for personal, family or household purposes. E.g., a customer relationship is created when a deposit account is opened, a loan is originated or when the servicing rights of a mortgage are purchased.
Before establishing a relationship with a “customer,” the financial institution must disclose its privacy and information sharing policies. In addition, the financial institution must provide an annual privacy policy disclosure to all its “customers.”
Continuing relationship – A consumer has a continuing relationship with a financial institution if the consumer:
No continuing relationship – A consumer does not, however, have a continuing relationship with the financial institution if:
Question: When one financial institution sells a loan’s servicing right to another financial institution, do they both have a customer relationship with the borrower?
No. To avoid the situation where the borrower would be the customer of multiple financial institutions for a single product, the rule provides that the borrower is a customer of the loan servicer and not the originating lender. The borrower is considered however, a consumer by the originating lender.
Question: A trust maintains a checking account at the financial institution. Is the beneficiary of a trust a customer, who must receive disclosures?
No. The trust itself is the actual financial institution customer. Because the trust is not an individual, the privacy rules do not apply.
Question: Is a signed contract necessary to create a customer relationship?
No. Although a contract indicates that a customer relationship has been established, a contract is not necessary. For instance, a customer relationship is also created when a consumer receives financial advice from a financial institution, because an ongoing relationship is contemplated.
Financial institution – any institution, the business of which is engaging in activities that are financial in nature or incidental to such financial activities as described in § 4(k) of the Bank Holding Company Act of 1956 (12 U.S.C. § 1843(k)). The term “financial institution” does not include:
Financial Product or Service – any product or service that a financial holding company could offer by engaging in an activity that is financial in nature or incidental to such a financial activity under section 4(k) of the Bank Holding Company Act of 1956 (12 U.S.C. § 1843(k)).
Financial Service – includes a financial institution’s evaluation or brokerage of information that a financial institution collects in connection with a request or an application from a consumer for a financial product or service.
Nonaffiliated Third Party – any person, except:
A nonaffiliated third party includes any company that is an affiliate solely by virtue of a financial institution’s (or its affiliate’s) direct or indirect ownership or control of the company in conducting merchant banking or investment banking activities of the type described in § 4(k)(4)(H) or insurance company investment activities of the type described in § 4(k)(4)(l) of the Bank Holding Company Act of 1956 (12 U.S.C. § 1943(k)(4)(H) and (l).)
Nonpublic personal information – personally identifiable financial information; and any list, description, or other grouping of consumers (and publicly available information pertaining to them) that is derived using any personally identifiable financial information that is not publicly available. Nonpublic personal information does not include publicly available information, except as included on a list as described above; or any list, description or other grouping of consumers (and publicly available information pertaining to them) that is derived without using any personally identifiable financial information that is not publicly available.
Examples of lists:
Personally Identifiable Financial Information – any information that a consumer provides to a financial institution to obtain a financial product or service from the financial institution;
Personally identifiable financial information includes:
Publicly Available Information – any information that a financial institution has a reasonable basis to believe is lawfully made available to the general public from:
The financial institution has a reasonable basis to believe that information is lawfully made available to the general public if the financial institution has taken steps to determine:
Examples:
A financial institution has a reasonable basis to believe that mortgage information is lawfully made available to the general public if the financial institution has determined that the information is of the type included on the public record in the jurisdiction where the mortgage would be recorded.
In addition, a financial institution has a reasonable basis to believe that an individual’s telephone number is lawfully made available to the general public if the financial institution has located the telephone number in the telephone book or the consumer has informed the financial institution that the telephone number is not unlisted.
Nonpublic Personal Information – the Act (See, § 509) requires protection of personally identifiable financial information as nonpublic personal information if the information is not publicly available information. Information is considered to be “publicly available” and excluded from the definition of “nonpublic personal information” if a financial institution has a “reasonable basis to believe that the information is lawfully made available to the general public.” A financial institution has a “reasonable basis” for believing that such information is lawfully made available “if the bank has taken steps to determine that the information is of the type that is available to the general public and, if an individual could direct that the information not be made available to the general public, whether the individual has done so.”
Regulation P gives examples of protected information:
IV. COVERED AND EXEMPT INFORMATION
Regulation P applies only to nonpublic personal information about individuals who obtain financial products or services primarily for personal, family or household purposes. The privacy provisions do not apply to information about companies or about individuals who obtain financial products or services for business, commercial or agricultural purposes.
Since the scope of the regulation is similar to that of the Truth in Lending Act and its implementing Regulation Z, a financial institution might refer to Regulation Z for guidance on covered transactions. A loan exempt from Regulation Z, because it is primarily a business, commercial or agricultural purpose loan, is also exempt from Regulation P.
A. Business, Commercial and Agricultural Purposes
Regulation Z does not apply to an extension of credit primarily for a business or commercial purpose.
Q. If a partnership applies for a loan to buy a car for one of the partners, does the financial institution need to disclose its privacy policy?
A. No, a business entity is not considered a consumer regardless of the loan purpose.
Q. If an individual wished to open a checking account for a farm operation, are disclosures necessary?
A. No, disclosures are not necessary. The individual is not considered a “consumer” because the individual is not establishing the account primarily for personal, family or household purposes.
B. Business Credit
In determining whether credit is primarily for business or commercial purposes, the following factors are considered: (1) relationship of the borrower’s primary occupation to the business; (2) degree to which the borrower personally manages the business; (3) ratio of income from the business to total income of the borrower; (4) size of the transaction; and (5) borrower’s statement of purpose for the loan.
C. Business Credit – Rental Property
Regulation Z applies to rental property credit as follows:
Non-owner-occupied property
(Occupied for 14 or fewer days per year)
Purpose
Result
Acquire, improve or maintain
Business purpose
Other
Outcome based on purpose
Owner-occupied property
(Occupied for more than 14 or days per year)
Number of Units
Results
Acquire
1 or 2
Consumer credit
More than 2
Business credit
Improve or maintain
1 to 4
More than 4
D. Agricultural Credit Exemption
Regulation Z does not apply to an extension of credit primarily for an agricultural purpose. Agricultural purpose includes the planting, nurturing, harvesting, catching, storing, exhibiting, marketing, transporting, processing or manufacturing of food, beverages (including alcoholic beverages), flowers, trees, livestock, poultry, bees, wildlife, fish or shellfish by a natural person engaged in farming, fishing or growing crops, flowers, trees, livestock, poultry, bees or wildlife.
V. REQUIRED DISCLOSURES
A. Initial Disclosures
Initial privacy disclosures must be clear and conspicuous and accurately reflect the financial institution’s privacy policy and practices. Consumers who are not customers must receive the privacy notice prior to disclosure of nonpublic personal information about the consumer to any nonaffiliated third party.
NOTE: If the financial institution shares information as authorized by § 332.14 (processing transactions at consumer’s request) and § 332.15 (consumer consent and other miscellaneous exceptions), then no notice is required.
Initial privacy disclosures must be provided to customers at a time a customer relationship is established. There are two exceptions to this rule: (1) notice may be provided after the customer relationship is established if it would otherwise substantially delay the consumer’s transaction and the consumer agrees to receive the notice at a later time; and (2) if the establishment of the consumer relationship is not the consumer’s choice, then the initial notice may be provided after the fact.
Question: Must a privacy notice be given each time an existing customer opens a new type of account?
A: No, as long as the privacy information the customer received previously is still accurate.
Question: What if two or more people open an account jointly, do they each need to receive a privacy notice?
A: No. Only one notice is required to be sent in connection with a joint account.
B. Annual Privacy Notice
Except as provided at paragraph B, I, below, financial institutions must send annual notices to financial institution “customers” at least once during any period of twelve consecutive months during which a customer relationship exists. The notice must be clear and conspicuous and must accurately reflect the privacy practices currently in effect. Annual notices may be provided on an institution’s web site if the customer conducts electronic transactions and agrees to such disclosures. A financial institution may define the twelve-consecutive-month period, but the financial institution must apply it to the customer on a consistent basis.
Question: Is the financial institution required to give an annual disclosure to a depositor whose account is dormant, or to a borrower who has paid off a loan?
No. A financial institution is not required to give an annual disclosure when a customer relationship has terminated. A deposit account relationship is considered terminated when a deposit account becomes inactive under the financial institution’s policies. A closed-end loan relationship is considered terminated when a customer pays off a loan, when the loan is charged off, or when the loan is sold without retaining servicing rights. An open-end loan relationship is considered terminated when the financial institution no longer provides statements or notices to the customer concerning the account. A customer also becomes a former customer when the financial institution has not communicated with the customer about the relationship for a period of twelve consecutive months, other than to provide annual privacy notices or promotional material.
Question: If a customer opens an account on July 2, 2001, may the annual notice requirement be satisfied by providing notice to the customer by December 31 of 2002?
Yes, if the financial institution defines the twelve-consecutive-month period as a calendar year and provides the annual notice to the customer once in each calendar year following the calendar year in which the financial institution provided the initial notice.
1. FAST Act
a. Introduction
The FAST Act passed by Congress in 2015, eliminated the annual privacy notice requirements for a financial institution that (i) only shares consumer information within the Graham-Leach-Bliley Act (GLBA) listed exemptions (meaning the company does not give an opt-out right) and (ii) has not changed its information sharing practices from the most recent privacy notice.
A financial institution that meets the requirements for the annual notice exception will not be required to provide annual notices “until such time” as the financial institution fails to comply with the criteria set forth above. A financial institution will no longer meet the requirements for the exception either by beginning to share nonpublic personal information in ways that trigger rights to opt-out notices under the GLBA and Regulation P, or by otherwise changing its policies and practices with regard to disclosing nonpublic personal information from the policies and practices that were disclosed to the customer in the most recent privacy notice the financial institution provided.
Financial institutions that no longer meet the conditions for the exception must provide customers with annual privacy notices.
b. Delivery of Annual Privacy Notice After Financial Institution No Longer Meets Requirements For Exceptions
(1) Changes preceded by a revised privacy notice: If a financial institution no longer meets the conditions for the exception because it changed its policies or practices in such a way that it is required to provide a revised privacy notice, the financial institution is required to resume delivery of its subsequent regular annual privacy notices pursuant to the existing timing requirements governing delivery of annual notices generally.
Under the final rule, if a financial institution provides a revised notice on any day of year one in advance of changing its policies or practices such that it loses the exception, that revised notice would be treated as an analogous to an initial notice. Assuming that the financial institution defines the 12-month period as the calendar year, the financial institution would have to provide the first annual notice after losing the exception by December 31 of year two.
(2). Changes Not Preceded By a Revised Privacy Notice.
If a financial institution no longer meets the conditions for the exception because it changed its policies or practices in such a way that it is not required to provide a revised privacy notice, the financial institution must provide an annual privacy notice within 100 days of the change in its policies or practices that caused it to no longer meet the conditions for the exception.
If a financial institution changes its policies and practices in such a way that it no longer meets the conditions for the exception effective April 1, assuming the financial institution defines the 12-consecutive-month period as a calendar year, if the financial institution was not required to provide a revised privacy notice, it must provide an annual privacy notice by July 9 (100 days after April 1).
(3). Discontinuance of Annual Privacy Notice
If, subsequent to providing an annual notice to customers after a financial institution no longer meets the conditions for the exception, the financial institution once again is eligible for the exception to the annual notice requirement, no additional annual notices must be sent to customers until such time as the financial institution no longer meets the requirements for the exception.
2. Alternative Delivery Method For Privacy Notices In 2014, the CFPB issued an amendment to the regulations that allowed a financial institution to post its privacy disclosure notice on its website provided a series of conditions were satisfied. The alternative delivery mechanism is still in place from the provisions adopted by Congress under the FAST Act. However, no notice at all must be delivered to customers if a financial institution’s (a) privacy policies and practices with respect to disclosing nonpublic personal information have not changed from the policies and practices disclosed in the most recent privacy notice; and (b) the financial institution only shares nonpublic personal information with nonaffiliated third parties in a manner that does not require an opt-out right to be provided to customers. As a result, the FAST Act has made the CFPBs alternative delivery mechanism no longer necessary.
C. Required Information
Both the initial and annual privacy notices must contain the following items of information, in addition to any other information the financial institution wishes to provide, that applies to the financial institution and to the consumers to whom the financial institution sends its privacy notice:
See, sample clauses included in Regulation P, Appendix A that illustrate some of the notice content requirements.
Question: May a consumer receive a short-form initial notice and opt-out form if a customer relationship is never formed with the consumer?
Yes. The short-form notice must clearly and conspicuously state that the full privacy disclosure is available upon request.
Question: What must a financial institution do if the financial institution wants to change its privacy policy?
Before disclosing nonpublic personal information about a customer in a way not accurately described in its existing policy, the financial institution must send the customer an accurate privacy disclosure and an opt out notice, and the financial institution must give the customer a reasonable opportunity to opt out.
1. Description of Nonaffiliated Third Parties Subject to Exceptions
If a financial institution discloses nonpublic personal information to third parties as authorized under § 332.14 and § 332.15, the financial institution is not required to list those exceptions in the initial or annual privacy notices. When describing the categories with respect to those parties, the financial institution is required to state only that it makes disclosures to other nonaffiliated third parties as permitted by law.
2. Categories of Nonpublic Personal Information That the Financial Institution Collects
A financial institution satisfies the requirement to categorize the nonpublic personal information that the financial institution collects if the financial institution lists the following categories, as applicable:
a. Information from the consumer;
b. Information about the consumer’s transactions with the financial institution or its affiliates;
c. Information about the consumer’s transactions with nonaffiliated third parties; and
d. Information from a consumer reporting agency.
3. Categories of Nonpublic Personal Information a Financial Institution Discloses
A financial institution satisfies the requirement to categorize the nonpublic personal information that the financial institution discloses if the financial institution lists the categories described in paragraph (c)(1) of this section and a few examples to illustrate the types of information in each category.
If a financial institution reserves the right to disclose all of the nonpublic personal information about consumers that it collects, the financial institution may simply state that fact without describing the categories or examples of the nonpublic personal information the financial institution discloses.
4. Categories of Affiliates and Nonaffiliated Third Parties to Whom a Financial Institution Discloses
A financial institution satisfies the requirement to categorize the affiliates and nonaffiliated third parties to whom a financial institution discloses nonpublic personal information if the financial institution lists the following categories, as applicable, and a few examples to illustrate the types of third parties in each category.
a. Financial service providers;
b. Non-financial companies; and
c. Others.
5. Disclosures Under Exception for Service Providers and Joint Marketers
If a financial institution discloses nonpublic personal information under the exception in § 332.14 to a nonaffiliated third party to market products or services that the financial institution offers alone or jointly with another financial institution, the financial institution satisfies the disclosure requirement of paragraph (a) (5) of this section if it:
a. Lists the categories of nonpublic personal information it discloses, using the same categories and examples the financial institution used to meet the requirements of paragraph (a) (2) of this section, as applicable; and
b. State whether the third party is:
(1) A service provider that performs marketing services on its behalf or on behalf of the financial institution and another financial institution; or
(2) A financial institution with whom the financial institution has a joint marketing agreement.
6. Simplified Notices
If a financial institution does not disclose, and does not wish to reserve the right to disclose, nonpublic personal information about customers or former customers to affiliates or nonaffiliated third parties except as authorized under §§ 332.14 and 332.15, the financial institution may simply state that fact, in addition to the information it must provide under paragraphs (a)(1), (a)(8), (a)(9), and (b) of this section.
7. Confidentiality and Security
A financial institution describes its policies and practices with respect to protecting the confidentiality and security of nonpublic personal information if it does both of the following:
a. Describes in general terms who is authorized to have access to the information; and
b. States whether the financial institution has security practices and procedures in place to ensure the confidentiality of the information in accordance with the financial institution’s policy. The financial institution is not required to describe technical information about the safeguards it uses.
8. Short-Form Initial Notice with Opt Out Notice for Non-Customers
a. A financial institution may satisfy the initial notice for a consumer who is not a customer by providing a short-form initial notice at the same time as the financial institution delivers an opt out notice.
b. A short-form initial notice must:
(1) Be clear and conspicuous;
(2) State that the financial institution’s privacy notice is available upon request; and
(3) Explain a reasonable means by which the consumer may obtain that notice.
c. The financial institution must deliver its short-form initial notice according to § 332.9. The financial institution is not required to deliver its privacy notice with its short-form initial notice. The financial institution instead may simply provide the consumer a reasonable means to obtain its privacy notice. If a consumer who receives a financial institution’s short-form notice requests its privacy notice, the financial institution must deliver its privacy notice according to § 332.9.
d. Examples of obtaining privacy notice. A financial institution provides a reasonable means by which a consumer may obtain a copy of its privacy notice if the financial institution:
(1) Provides a toll-free telephone number that the consumer may call to request the notice; or
(2) For a consumer who conducts business in person at the financial institution’s office, maintain copies of the notice on hand that the financial institution provides to the consumer immediately upon request.
e. Future Disclosures. The financial institution’s notice may include:
(1) Categories of nonpublic personal information that the financial institution reserves the right to disclose in the future, but do not currently disclose; and
(2) Categories of affiliates or nonaffiliated third parties to whom the financial institution reserves the right in the future to disclose, but to whom the financial institution does not currently disclose, nonpublic personal information.
VI. Opt-Out Notices
If a financial institution intends to share nonpublic personal information about a consumer, the financial institution must provide the consumer an initial privacy disclosure and an opt-out notice. The opt-out notice must clearly and conspicuously explain the consumer’s right to opt-out and must give the consumer a reasonable means of exercising the opt-out right.
A financial institution provides adequate notice that the consumer can opt-out of the disclosure of nonpublic personal information to a nonaffiliated third party if the financial institution:
A financial institution provides a reasonable means to exercise an opt-out right if it:
C. Unreasonable Opt-Out Means
A financial institution does not provide a reasonable means of opting out if:
A financial institution may require each consumer to opt out through a specific means, as long as that means is reasonable for that consumer.
A financial institution may provide the opt-out notice together with or on the same written or electronic form as the initial notice.
F. Initial Notice Required When Opt-Out Notice Delivered Subsequent to Initial Notice
If a financial institution provides the opt-out notice later than required for the initial notice, the financial institution must also include a copy of the initial notice with the opt-out notice in writing or, if the consumer agrees, electronically.
If two or more consumers jointly obtain a financial product or service from a financial institution, the financial institution may provide a single opt-out notice. The financial institution’s opt-out notice must explain how the financial institution will treat an opt-out direction by a joint consumer.
EXAMPLE: If John and Mary have a joint checking account with a financial institution and arrange for the financial institution to send statements to John’s address, the financial institution may do any of the following, but the financial institution must explain in its opt-out notice which opt-out policy the financial institution will follow:
Any of the joint consumers may exercise the right to opt out. The financial institution may either:
NOTE: If a financial institution permits each joint consumer to opt-out separately, the financial institution must permit one of the joint consumers to opt out on behalf of all of the joint consumers.
NOTE: A financial institution may not require all joint consumers to opt-out before it implements any opt-out direction.
A financial institution must comply with a consumer’s opt-out direction as soon as reasonably practicable after the financial institution receives it.
A consumer may exercise the right to opt-out at any time.
A consumer’s direction to opt-out under this section is effective until the consumer revokes it in writing or, if the consumer agrees, electronically.
When a customer relationship terminates, the customer’s opt-out direction continues to apply to the nonpublic personal information that the financial institution collected during or related to that relationship. If the individual subsequently establishes a new customer relationship with the financial institution, the opt-out direction that applied to the former relationship does not apply to the new relationship.
Except as otherwise authorized in the privacy provisions, a financial institution must not, directly or through any affiliate, disclose any nonpublic personal information about a consumer to a nonaffiliated third party other than as described in the initial notice, unless:
EXAMPLES: Except as otherwise permitted by §§ 332.13, 332.14 and 332.15, a financial institution must provide a revised notice before it:
NOTE: A revised notice is not required if the financial institution discloses nonpublic personal information to a new nonaffiliated third party that the financial institution adequately described in its prior notice.
Initial privacy notices and opt-out notices must be provided so that each consumer can be reasonably expected to receive the notice in writing, or if the consumer agrees, electronically. Some examples of reasonable means of delivery include hand-delivery, mail, and for consumers who conduct electronic transactions, the notice may be posted on the web site if it requires the consumer to acknowledge receipt of the notice. For isolated transactions with consumers, such as ATM transactions, the notice may appear on the ATM screen and require the consumer to acknowledge the notice.
A financial institution may not, however, reasonably expect that the consumer will receive actual notice of it privacy policies and practices if it: (1) only posts a sign in its branch or office or generally publishes advertisements of its privacy policies and practices or (2) sends the notice via electronic mail to a consumer who does not obtain a financial product or service from the financial institution electronically.
A financial institution may reasonably expect that a customer will receive actual notice of the financial institution’s annual privacy notice if:
O. Oral Description of Notice Insufficient
A financial institution may not provide any notice required by the privacy provisions solely by orally explaining the notice, either in person or over the telephone.
For customers only, a financial institution must provide the initial notice, the annual notice, and the revised notice so that the customer can retain them or obtain them later in writing or, if the customer agrees, electronically.
EXAMPLES - Retention or Accessibility. A financial institution provides a privacy notice to the customer so that the customer can retain it or obtain it later if the financial institution:
A financial institution may provide a joint notice from it and one or more of its affiliates or other financial institutions, as identified in the notice, as long as the notice is accurate with respect to the financial institution and the other institutions.
VII. Limits on Disclosures
Except as otherwise authorized in the privacy provisions, a financial institution may not, directly or through any affiliate, disclose any nonpublic personal information about a consumer to a nonaffiliated third party unless:
Opt out means a direction by the consumer that the financial institution not disclose nonpublic personal information about that consumer to a nonaffiliated third party, other than as permitted by §§ 332.13, 332.14 and 332.15.
A financial institution provides a consumer with a reasonable opportunity to opt-out if:
1. By Mail
The financial institution mails the initial and opt-out notices to the consumer and allows the consumer to opt-out by mailing a form, calling a toll-free telephone number, or any other reasonable means within 30 days from the date the financial institution mailed the notices.
2. By Electronic Means
A customer opens an on-line account with a financial institution and agrees to receive the initial and opt-out notices electronically, and the financial institution allows the customer to opt-out by any reasonable means within 30 days after the date that the customer acknowledges receipt of the notices in conjunction with opening the account.
3. Isolated Transaction with Consumer
For an isolated transaction, such as the purchase of a cashier’s check by a consumer, a financial institution provides the consumer with a reasonable opportunity to opt-out if the financial institution provides the initial and opt-out notices at the time of the transaction and requests that the consumer decide, as a necessary part of the transaction, whether to opt-out before completing the transaction.
D. Application of Opt-Out to All Consumers and All Nonpublic Personal Information
A financial institution must comply with this section, regardless of whether the financial institution and the consumer have established a customer relationship.
NOTE: Unless a financial institution complies with this section, the financial institution may not, directly or through any affiliate, disclose any nonpublic personal information about a consumer that the financial institution has collected, regardless of whether the financial institution collected it before or after receiving the direction to opt-out from the consumer.
A financial institution may allow a consumer to select certain nonpublic personal information or certain nonaffiliated third parties with respect to which the consumer wishes to opt-out.
The regulation includes rules limiting the reuse of information. Third parties that receive information from a financial institution or its affiliate must comply with the same disclosure and use restrictions applicable to the financial institution. A third party that receives information from a financial institution can redisclose that information to the financial and its affiliates. Affiliates can disclose and reuse the information to the same extent permissible for the third party.
EXAMPLE: If a financial institution receives a customer list from a nonaffiliated financial institution in order to provide account processing services under the exception in § 332.14(a), the financial institution may disclose that information under any exception in §§ 332.14 or 332.15 in the ordinary course of business in order to provide those services. For example, the financial institution could disclose the information in response to a properly authorized subpoena or to its attorneys, accountants, and auditors. The financial institution could not disclose that information to a third party for marketing purposes or use that information for its own marketing purposes.
If a financial institution receives nonpublic personal information from a nonaffiliated financial institution other than under an exception in §§ 332.14 or 332.15 of the privacy provisions, the financial institution may disclose the information only:
EXAMPLE: If a financial institution obtains a customer list from a nonaffiliated financial institution outside of the exceptions in §§ 332.14 and 332.15:
If a financial institution discloses nonpublic personal information to a nonaffiliated third party under an exception in §§ 332.14 or 332.15 of the privacy provisions, the third party may disclose and use that information only as follows:
If a financial institution discloses nonpublic personal information to a nonaffiliated third party other than under an exception in §§ 332.14 or 332.15 of the privacy provisions, the third party may disclose the information only:
VIII. Limits on Sharing Account Number Information for Marketing Purposes
The final rule prohibits financial institutions from sharing account numbers or similar forms of access numbers or access codes for a consumer’s credit card account, deposit account, or transaction account to any nonaffiliated third party telemarketers unless the information consists of encrypted account numbers where the recipient does not have the key. A transfer of account numbers to third-party marketers who handle the financial institution’s own products are exempted and are accounts numbers in affinity or private-label credit card programs.
EXAMPLES:
Account Number. An account number or similar form of access number or access code, does not include a number or code in an encrypted form, as long as the financial institution does not provide the recipient with a means to decode the number or code.
Transaction Account. A transaction account is an account other than a deposit account or a credit card account. A transaction account does not include an account to which third parties cannot initiate charges.
IX. MODEL PRIVACY NOTICE FORM
A. Introduction
The joint federal agencies have released a final model privacy notice form that is designed to make it easier for consumers to understand how financial institutions collect and share their personal information. Under the Gramm-Leach-Bliley Act (GLBA), institutions must notify consumers of their information-sharing practices and inform consumers of the right to opt out of certain sharing practices. Financial institutions that choose to provide the model privacy form to their customers will be deemed to be in compliance with the privacy provisions of GLBA.
B. Model Privacy Form
While the model form provides a legal safe harbor, institutions may continue to use other types of notices that vary from the model form so long as these notices comply with the privacy rule. For example, an institution could continue to use a simplified notice if it does not have affiliates and does not intend to share nonpublic personal information with nonaffiliated third parties outside of the exceptions provided in sections __.14 and __.15. Likewise, while the Agencies are eliminating the Sample Clauses and related safe harbor (or, for the SEC, guidance), institutions may continue to use notices containing these clauses, so long as these notices comply with the privacy rule. To reiterate, use of the model form is voluntary; institutions are not required to use it.
The General Instructions to the Model Privacy Form require that no additional information – other than what is specifically permitted – may be included in the model form in order to obtain the benefit of the safe harbor.
Institutions may incorporate the model form into another document, but they must do so in a way that meets all the requirements of the privacy rule and the model form instructions, including that: The model form must be presented in a way that is clear and conspicuous; it must be intact so that the customer can retain the content of the model form; and it must retain the same page orientation, content, format, and order as provided for in this Rule.
The format of the final model form is standardized. It consists of two pages, and may be printed on a single piece of paper. The Agencies are not mandating a specific paper size in the final model form as long as the paper is in portrait orientation and sufficient to accommodate minimum font size, spacing, and content requirements. Financial institutions may include corporate logos in the form, so long as they do not interfere with the readability or space constraints.
The first page of the final model form has five parts: (1) a title; (2) an introductory section, which provides context to help the consumer understand the purpose of the notice; (3) a disclosure table that describes the types of sharing possible for all financial institutions, which of those types of sharing the institution providing the notice actually engages in, and whether the consumer can opt out of any of the institution’s sharing; (4) if applicable, information for the consumer on how to opt out; and (5) the institution’s customer service contact information.
The second page provides additional explanatory information that, in combination with the first page, ensures that the notice includes all the elements required by GLBA and the Agencies’ privacy rules. Supplemental information about the financial institution and what it does with personal information is found at the top of the second page, with key definitions below. Space is also provided at the bottom of the second page for financial institutions to (1) discuss state and/or international privacy laws; and/or (2) include an
acknowledgement of receipt. The instructions that accompany the form require that no additional information – other than what is specifically permitted – may be included in the model form in order to obtain the benefit of the compliance safe harbor.
The model privacy form, along with the various “opt-out” alternatives, and the general instructions for the model privacy forms can be found by going to www.fdic.gov and searching for “Appendix A to Part 1016—Model Privacy Form.”
C. Transition Rules
The Appendix to Part 332 of the FDIC’s Rules and Regulations currently contains model language (called Sample Clauses) that institutions may use in their privacy notices and, if so, they are deemed to be in compliance with the privacy provisions of GLBA. The rule removes, after a transition period, these Sample Clauses and the associated compliance safe harbor. Thus, financial institutions will not be able to rely on the safe harbor for the Sample Clauses incorporated into notices that are delivered to consumers on or after January 1, 2011. The Sample Clauses will be removed entirely from Part 332 on January 1, 2012. To obtain a compliance safe harbor after the Sample Clauses are removed, financial institutions may use the new model privacy notice form.
D. Additional Privacy Rule Amendment
The Agencies are also amending the section of their privacy rules concerning the information that financial institutions, which choose not use the model form, must include in their privacy notices. The rules currently provide that if a financial institution shares information with third party non-affiliates in a manner that does not require an opt out, the institution is only required to include a statement in its privacy notice that it engages in such sharing as permitted by law. The joint federal agencies are revising their rules to allow, as an alternative, a statement that the institution shares such information for its everyday business purposes, including a list of all applicable examples, such as to process transactions, maintain account(s), respond to court orders and legal investigations, or report to credit bureaus.
E. Effective Date
The final rule became effective on December 31, 2009, except for the provisions relating to the elimination of the safe harbor permitted for notices based on the Sample Clauses and removal of the Sample Clauses from the privacy rule, which are effective January 1, 2012.
X. MODEL CONSUMER PRIVACY NOTICE ONLINE FORM BUILDER
The federal banking regulators have released an Online Form Builder that financial institutions can download and use to develop and print customized versions of a model consumer privacy notice. The Online Form Builder, based on the model form regulation published in the Federal Register on December 1, 2009, under the Gramm-Leach-Bliley Act, is available with several options. Easy-to-follow instructions for the form builder will guide an institution to select the version of the model form that fits its practices, such as whether the institution provides an opt-out for consumers.
To obtain a legal “safe harbor” and so satisfy the law’s disclosure requirements, institutions must follow the instructions in the model form regulation when using the Online Form Builder. The Online Form Builder is available at: http://www.federalreserve.gov/bankinforeg/privacy_notice_instructions.pdf.
Partial instructions for using the online form builder are:
1. Select your form, based on (1) whether you provide an opt out and (2) whether you include affiliate marketing:
XI. Exceptions to Opt-Out Notice Requirements
A. Overview of Exceptions §§ 332.13, 332.14, 332.15
The indicated exceptions apply if the financial institution discloses nonpublic personal information:
No Initial Notice to Consumers*
No Opt Out Notice
No 3rd Party Privacy Agreement
To a nonaffiliated third party to perform marketing services for the financial institution, if the financial institution:
X
As necessary to effect, administer, or enforce a transaction that a consumer requests or authorizes, or in connection with:
With the consent or at the direction of the consumer, provided that the consumer has not revoked the consent or direction;
To protect the confidentiality or security of a financial institution’s records pertaining to the consumer, service, product, or transaction;
To protect against or prevent actual or potential fraud, unauthorized transactions, claims, or other liability;
For required institutional risk control or for resolving consumer disputes or inquires;
To persons holding a legal or beneficial interest relating to the consumer; or
To persons acting in a fiduciary or representative capacity on behalf of the consumer;
To provide information to insurance rate advisory organizations, guaranty funds or agencies, agencies that are rating a financial institution, persons that are assessing the financial institution’s compliance with industry standards, and the financial institution’s attorneys, accountants, and auditors;
* An initial disclosure is required for Customer relationships.
B. Overview of Exceptions §§ 332.13, 332.14, 332.15
To the extent specifically permitted or required under other provisions of law and in accordance with the Right to Financial Privacy Act of 1978, to law enforcement agencies, self-regulatory organizations, or for an investigation on a matter related to public safety;
To a consumer reporting agency in accordance with the Fair Credit Reporting Act or from a consumer report reported by a consumer reporting agency;
In connection with a proposed or actual sale, merger, transfer or exchange of all or a portion of a business or operating unit if the disclosure of nonpublic personal information concerns solely consumers of such business or unit; or
To comply with Federal, State, or local laws, rules and other applicable legal requirements;
To comply with a properly authorized civil, criminal, or regulatory investigation, or subpoena or summons by Federal, State, or local authorities; or
To respond to judicial process or government regulatory authorities having jurisdiction over a financial institution for examination, compliance, or other purposes as authorized by law.
C. Exception to Opt-Out Requirements for Service Provider and Joint Marketing
If a financial institution discloses nonpublic personal information under this section to a financial institution with which the financial institution performs joint marketing, the financial institution’s contractual agreement with that institution meets the requirements
of this section if it prohibits the institution from disclosing or using the nonpublic personal information except as necessary to carry out the joint marketing or under an exception in § 332.14 or § 332.15 in the ordinary course of business to carry out that joint marketing.
The services a nonaffiliated third party performs for a financial institution may include marketing of the financial institution’s own products or services or marketing of financial products or services offered pursuant to joint agreements between the financial institution and one or more financial institutions. A joint agreement means a written contract pursuant to which a financial institution and one or more financial institutions jointly offer, endorse, or sponsor a financial product or service.
Example of Consent and Revocation of Consent:
A consumer may specifically consent to a financial institution’s disclosure to a nonaffiliated insurance company of the fact that the consumer has applied to the financial institution for a mortgage so that the insurance company can offer homeowner’s insurance to the consumer.
NOTE: A consumer may revoke consent by subsequently exercising the right to opt-out of future disclosures of nonpublic personal information.
XII. EFFECTIVE DATES AND RULES OF CONSTRUCTION
The privacy regulations were effective November 13, 2000, and compliance was optional until July 1, 2001. “Guidelines for Safeguarding Customer Information” are a necessary adjunct to the privacy provisions. Assurances that an institution is in compliance with such Guidelines is a required disclosure. As a result, the safeguards on customer information must be in place prior to making the privacy disclosure, since it is not possible to implement a privacy program prior to implementing the safeguards.
By July 1, 2001, a financial institution had to provide an initial notice to consumers who were the financial institution’s customers on July 1, 2001. If a financial institution intends to share the type of information covered by the regulation after July 1, opt-out notices were sent to all of its existing customers and the customers had a reasonable period in which to opt-out of the information sharing prior to the disclosure of such information.
Until July 1, 2002, a contract that a financial institution has entered into with a nonaffiliated third party to perform services for the financial institution or functions on the financial institution’s behalf is exempted from the opt-out requirements, even if the contract does not include a requirement that the third party maintain the confidentiality of
nonpublic personal information, as long as the financial institution entered into the agreement on or before July 1, 2000.
Examples contained within the privacy provisions and the sample clauses in Appendix A of the privacy regulations are not exclusive, however, compliance with an example or use of a sample clause, to the extent applicable, constitutes compliance with the privacy provisions.
NOTE: Sample forms, policies and procedures contained within the regulatory section entitled “Implementing A Compliance Program” are not models and their use does not necessarily constitute compliance with the privacy provisions nor would they be accurate for any particular institution.
XIV. PRIVACY EXAMINATION PROCEDURES AND Guidelines for Safeguarding Customer Information
Compliance with Regulation P is monitored in compliance examinations. The guidelines for safeguarding consumer information are monitored in safety and soundness examinations. These reviews begin in July of 2001.
Section 501 of the Act requires the regulatory agencies to establish appropriate standards for supervised institutions to follow in relation to administrative, technical and physical safeguards for customer records and information. Each of the federal bank regulatory agencies, acting through the Federal Financial Institutions Examination Council (FFIEC) has developed, approved and issued (1) FFIEC Compliance Examination Procedures for the regulation on “Privacy of Consumer Financial Information and (2) standards that are referred to as the Interagency Guidelines Establishing Standards for Safeguarding Customer Information (hereinafter referred to as the “Guidelines”). The Guidelines set forth standards for developing and implementing administrative, technical and physical safeguards to protect the security, confidentiality and integrity of customer information. The Guidelines also establish rules relating to the safeguarding of customer information as well as elements in policies and procedures that a financial institution must adopt to address identifiable threats to confidentiality of such information or its unauthorized use.
XV. COMPARISONS: PRIVACY ACT AND THE FAIR CREDIT REPORTING ACT
Although the Privacy Act (the Act) and the Fair Credit Reporting Act (FCRA) each address the issue of disclosure of consumer information by financial institutions, the laws and regulations differ in scope of coverage as well as the treatment of such information. Just because a financial institution believes it is in compliance with one regulation does not equate compliance with another. The following comparisons between of the Act and the FCRA illustrate the differences between the two:
Privacy Act
FCRA
Information Covered
Applies to “nonpublic personal information” – covers any information provided to a financial institution by a consumer to obtain a financial product or service, that results from a transaction with a financial institution involving a financial product or service or that is otherwise obtained by a financial institution in connection with providing a financial product or service to a consumer. Under certain conditions, “publicly available” information may also be considered “nonpublic personal information.”
Applies to disclosure of “consumer reports” containing information on a consumer’s credit worthiness, standing or capacity, character, general reputation, personal characteristics or mode of living.
Disclosures Covered
Disclosures restricted to nonaffiliated third parties.
Disclosures restricted to affiliates and nonaffiliated third parties.
Information Disclosure Restrictions
Nonpublic personal information may not be disclosed by a financial institution to nonaffiliated third parties unless the institution has given consumers a privacy notice and an opportunity to opt-out of such information sharing.
A financial institution may become a consumer reporting agency if it (1) disclosed consumer report information to its affiliates without giving consumers notice of the disclosure with an opportunity to opt-out or (2) if it disclosed consumer reports to nonaffiliated third parties. The FCRA has no notice or opt-out provisions allowing an institution to share consumer reports with nonaffiliated third parties without becoming a consumer reporting agency.
Consumer’s Opt-Out Rights
The right to opt-out allows a consumer to limit a financial institution’s sharing of nonpublic person information with nonaffiliated third parties.
The right to opt-out allows a consumer to limit a financial institution’s sharing of information that would otherwise be a “consumer report” with affiliates.
Exceptions
There are a number of specifically listed exceptions to the consumer’s right to opt-out.
Allows a financial institution to freely share only such information that relates solely to transactions or experiences between the financial institution and the customer
Additional information regarding the scope and details of the FCRA may be found in the NBA Compliance Handbook, Volume III, Lending section, “Credit Reports: Fair Credit Reporting Act” article.
XVI. CONCLUSION
The information provided in this article, accompanied by sample policies and procedures are intended to assist you in understanding and in assessing your level of compliance with the regulations involved. The article is designed to apply to a wide range of banks. As such, certain issues or procedures described in the text may not apply to smaller or less complex institutions. You should take these factors into consideration during your review of this information. As such, the commentary should be used as a guide and a supplement to, rather than a substitute for the actual reading of the law, regulations and interpretations.