Financial institutions must give consumers notice of their information practices and, in defined circumstances, an opportunity to opt out of sharing.
Initial and annual notices. An initial notice at the establishment of a customer relationship and, subject to an exception where practices have not changed and no opt-out sharing occurs, an annual notice. The model form provides a safe harbour and should be used.
Opt-out rights apply to sharing non-public personal information with non-affiliated third parties, with exceptions for service providers and joint marketing under contract, processing transactions, and legal compliance.
Affiliate sharing. Sharing consumer report information among affiliates for marketing purposes triggers a separate opt-out with its own notice requirements.
Reuse and redisclosure limits constrain what recipients may do with information received under an exception.
State law. Comprehensive state privacy statutes generally exempt information governed by the federal financial privacy framework, but the exemption is entity-level in some states and data-level in others — a difference that determines whether the institution’s non-customer data is covered.
Practical compliance. Maintain a data inventory mapping what is shared with whom under which exception, and reconcile it against the notice annually. Notices that describe practices the institution no longer follows are the most common finding, and are entirely avoidable.