Product: Credit reporting or other personal consumer reports

Privacy Act of 1974 No agency shall disclose any record which is contained in a system of records by any means of communication to any person, or to another agency, except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains [ subject to 12 exceptions ]. 5 U.S.C. 552a ( b ).

PART 1016- PRIVACY OF CONSUMER FINACIAL INFORMATION ( REGULATION P ) 12 CFR 1016.1 - Purpose and scope.

1016.1 Purpose and scope.

( a ) Purpose. This part governs the treatment of nonpublic personal information about consumers by the financial institutions listed in paragraph ( b ) of this section. This part : ( 1 ) Requires a financial institution to provide notice to customers about its privacy policies and practices ; ( 2 ) Describes the conditions under which a financial institution may disclose nonpublic personal information about consumers to nonaffiliated third parties ; and ( 3 ) Provides a method for consumers to prevent a financial institution from disclosing that information to most nonaffiliated third parties by opting out of that disclosure, subject to the exceptions in 1016.13, 1016.14, and 1016.15.

12 CFR 1016.4 - Initial privacy notice to consumers required.

1016.4 Initial privacy notice to consumers required.

( a ) Initial notice requirement. You must provide a clear and conspicuous notice that accurately reflects your privacy policies and practices to : ( 1 ) Customer. An individual who becomes your customer, not later than when you establish a customer relationship, except as provided in paragraph ( e ) of this section; and ( 2 ) Consumer. A consumer, before you disclose any nonpublic personal information about the consumer to any nonaffiliated third party 12 CFR 1016.7 Form of opt out notice to consumers ; opt out methods.

( a ) ( 1 ) Form of opt out notice. If you are required to provide an opt out notice under 1016.10 ( a ), you must provide a clear and conspicuous notice to each of your consumers that accurately explains the right to opt out under that section. The notice must state : ( i ) That you disclose or reserve the right to disclose nonpublic personal information about your consumer to a nonaffiliated third party ; ( ii ) That the consumer has the right to opt out of that disclosure; and ( iii ) A reasonable means by which the consumer may exercise the opt out right.

( 2 ) Examples ( i ) Adequate opt out notice. You provide adequate notice that the consumer can opt out of the disclosure of nonpublic personal information to a nonaffiliated third party if you : ( A ) Identify all of the categories of nonpublic personal information that you disclose or reserve the right to disclose, and all of the categories of nonaffiliated third parties to which you disclose the information, as described in 1016.6 ( a ) ( 2 ) and ( 3 ) of this part, and state that the consumer can opt out of the disclosure of that information; and ( B ) Identify the financial products or services that the consumer obtains from you, either singly or jointly, to which the opt out direction would apply.

( ii ) Reasonable opt out means. You provide a reasonable means to exercise an opt out right if you : ( A ) Designate check-off boxes in a prominent position on the relevant forms with the opt out notice ; ( B ) Include a reply form together with the opt out notice that, in the case of financial institutions described in 1016.3 ( l ) ( 3 ) of this part, includes the address to which the form should be mailed ; ( C ) Provide an electronic means to opt out, such as a form that can be sent via electronic mail or a process at your Web site, if the consumer agrees to the electronic delivery of information ; or ( D ) Provide a toll-free telephone number that consumers may call to opt out.

( iii ) Unreasonable opt out means. You do not provide a reasonable means of opting out if : ( A ) The only means of opting out is for the consumer to write his or her own letter to exercise that opt out right; or ( B ) The only means of opting out as described in any notice subsequent to the initial notice is to use a check-off box that you provided with the initial notice but did not include with the subsequent notice.

( g ) Time to comply with opt out. You must comply with a consumer 's opt out direction as soon as reasonably practicable after you receive it.

( h ) Continuing right to opt out. A consumer may exercise the right to opt out at any time.

( i ) Duration of consumer 's opt out direction.

( 1 ) A consumer 's direction to opt out under this section is effective until the consumer revokes it in writing or, if the consumer agrees, electronically.

15 U.S. Code 1681s2 - Responsibilities of furnishers of information to consumer reporting agencies ( a ) Duty of furnishers of information to provide accurate information ( 1 ) Prohibition ( A ) Reporting information with actual knowledge of errors A person shall not furnish any information relating to a consumer to any consumer reporting agency if the person knows or has reasonable cause to believe that the information is inaccurate.

( B ) Reporting information after notice and confirmation of errors A person shall not furnish information relating to a consumer to any consumer reporting agency if ( i ) the person has been notified by the consumer, at the address specified by the person for such notices, that specific information is inaccurate ; and ( ii ) the information is, in fact, inaccurate 15 U.S. Code 6801 - Protection of nonpublic personal information ( a ) Privacy obligation policy It is the policy of the Congress that each financial institution has an affirmative and continuing obligation to respect the privacy of its customers and to protect the security and confidentiality of those customers nonpublic personal information.

( b ) Financial institutions safeguards In furtherance of the policy in subsection ( a ), each agency or authority described in section 6805 ( a ) of this title, other than the Bureau of Consumer Financial Protection, shall establish appropriate standards for the financial institutions subject to their jurisdiction relating to administrative, technical, and physical safeguards ( 1 ) to insure the security and confidentiality of customer records and information ; ( 2 ) to protect against any anticipated threats or hazards to the security or integrity of such records ; and ( 3 ) to protect against unauthorized access to or use of such records or information which could result in substantial harm or inconvenience to any customer.

15 U.S. Code 6802 - Obligations with respect to disclosures of personal information ( a ) Notice requirements Except as otherwise provided in this subchapter, a financial institution may not, directly or through any affiliate, disclose to a nonaffiliated third party any nonpublic personal information, unless such financial institution provides or has provided to the consumer a notice that complies with section 6803 of this title.

( b ) Opt out ( 1 ) In general A financial institution may not disclose nonpublic personal information to a nonaffiliated third party unless ( A ) such financial institution clearly and conspicuously discloses to the consumer, in writing or in electronic form or other form permitted by the regulations prescribed under section 6804 of this title, that such information may be disclosed to such third party ; ( B ) the consumer is given the opportunity, before the time that such information is initially disclosed, to direct that such information not be disclosed to such third party ; and ( C ) the consumer is given an explanation of how the consumer can exercise that nondisclosure option.

15 U.S. Code 6803 - Disclosure of institution privacy policy ( a ) Disclosure required At the time of establishing a customer relationship with a consumer and not less than annually during the continuation of such relationship, a financial institution shall provide a clear and conspicuous disclosure to such consumer, in writing or in electronic form or other form permitted by the regulations prescribed under section 6804 of this title, of such financial institutions policies and practices with respect to ( 1 ) disclosing nonpublic personal information to affiliates and nonaffiliated third parties, consistent with section 6802 of this title, including the categories of information that may be disclosed ; ( 2 ) disclosing nonpublic personal information of persons who have ceased to be customers of the financial institution; and ( 3 ) protecting the nonpublic personal information of consumers.

( b ) Regulations Disclosures required by subsection ( a ) shall be made in accordance with the regulations prescribed under section 6804 of this title.

( c ) Information to be included The disclosure required by subsection ( a ) shall include ( 1 ) the policies and practices of the institution with respect to disclosing nonpublic personal information to nonaffiliated third parties, other than agents of the institution, consistent with section 6802 of this title, and including ( A ) the categories of persons to whom the information is or may be disclosed, other than the persons to whom the information may be provided pursuant to section 6802 ( e ) of this title ; and ( B ) the policies and practices of the institution with respect to disclosing of nonpublic personal information of persons who have ceased to be customers of the financial institution ; ( 2 ) the categories of nonpublic personal information that are collected by the financial institution ; ( 3 ) the policies that the institution maintains to protect the confidentiality and security of nonpublic personal information in accordance with section 6801 of this title ; and ( 4 ) the disclosures required, if any, under section 1681a ( d ) ( 2 ) ( A ) ( iii ) of this title.

( d ) Exemption for certified public accountants ( 1 ) In general The disclosure requirements of subsection ( a ) do not apply to any person, to the extent that the person is ( A ) a certified public accountant ; ( B ) certified or licensed for such purpose by a State ; and ( C ) subject to any provision of law, rule, or regulation issued by a legislative or regulatory body of the State, including rules of professional conduct or ethics, that prohibits disclosure of nonpublic personal information without the knowing and expressed consent of the consumer.

( 2 ) Limitation Nothing in this subsection shall be construed to exempt or otherwise exclude any financial institution that is affiliated or becomes affiliated with a certified public accountant described in paragraph ( 1 ) from any provision of this section.

( 3 ) Definitions For purposes of this subsection, the term StXXXX means any State or territory of the United States, XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX 
( e ) Model forms ( 1 ) In general The agencies referred to in section 6804 ( a ) ( 1 ) of this title shall jointly develop a model form which may be used, at the option of the financial institution, for the provision of disclosures under this section.

( 2 ) Format A model form developed under paragraph ( 1 ) shall ( A ) be comprehensible to consumers, with a clear format and design ; ( B ) provide for clear and conspicuous disclosures ; ( C ) enable consumers easily to identify the sharing practices of a financial institution and to compare privacy practices among financial institutions ; and ( D ) be succinct, and use an easily readable type font.

( 3 ) Timing A model form required to be developed by this subsection shall be issued in proposed form for public comment not later than 180 days after XX/XX/XXXX. 
( 4 ) Safe harbor Any financial institution that elects to provide the model form developed by the agencies under this subsection shall be deemed to be in compliance with the disclosures required under this section.

( f ) Exception to annual notice requirement A financial institution that ( 1 ) provides nonpublic personal information only in accordance with the provisions of subsection ( b ) ( 2 ) or ( e ) of section 6802 of this title or regulations prescribed under section 6804 ( b ) of this title, and ( 2 ) has not changed its policies and practices with regard to disclosing nonpublic personal information from the policies and practices that were disclosed in the most recent disclosure sent to consumers in accordance with this section, shall not be required to provide an annual disclosure under this section until such time as the financial institution fails to comply with any criteria described in paragraph ( 1 ) or ( 2 ).

15 U.S. Code 6804 - Rulemaking ( a ) Regulatory authority ( 1 ) Rulemaking ( A ) In general Except as provided in subparagraph ( C ), the Bureau of Consumer Financial Protection and the Securities and Exchange Commission shall have authority to prescribe such regulations as may be necessary to carry out the purposes of this subchapter with respect to financial institutions and other persons subject to their respective jurisdiction under section 6805 of this title ( and notwithstanding subtitle B of the Consumer Financial Protection Act of 2010 [ 12 U.S.C. 5511 et seq. ] ), except that the Bureau of Consumer Financial Protection shall not have authority to prescribe regulations with respect to the standards under section 6801 of this title.

( B ) CFTC The Commodity Futures Trading Commission shall have authority to prescribe such regulations as may be necessary to carry out the purposes of this subchapter with respect to financial institutions and other persons subject to the jurisdiction of the Commodity Futures Trading Commission under section 7b2 of title 7.

( C ) Federal Trade Commission authority Notwithstanding the authority of the Bureau of Consumer Financial Protection under subparagraph ( A ), the Federal Trade Commission shall have authority to prescribe such regulations as may be necessary to carry out the purposes of this subchapter with respect to any financial institution that is a person described in section 1029 ( a ) of the Consumer Financial Protection Act of 2010 [ 12 U.S.C. 5519 ( a ) ].

( D ) Rule of construction Nothing in this paragraph shall be construed to alter, affect, or otherwise limit the authority of a State insurance authority to adopt regulations to carry out this subchapter.

( 2 ) Coordination, consistency, and comparability Each of the agencies authorized under paragraph ( 1 ) to prescribe regulations shall consult and coordinate with the other such agencies and, as appropriate, and with [ 1 ] representatives of State insurance authorities designated by the National Association of Insurance Commissioners, for the purpose of assuring, to the extent possible, that the regulations prescribed by each such agency are consistent and comparable with the regulations prescribed by the other such agencies.

( 3 ) Procedures and deadline Such regulations shall be prescribed in accordance with applicable requirements of title 5.

( b ) Authority to grant exceptions The regulations prescribed under subsection ( a ) may include such additional exceptions to subsections ( a ) through ( d ) of section 6802 of this title as are deemed consistent with the purposes of this subchapter.

15 U.S. Code 6805 - Enforcement ( a ) In general Subject to subtitle B of the Consumer Financial Protection Act of 2010 [ 12 U.S.C. 5511 et seq. ], this subchapter and the regulations prescribed thereunder shall be enforced by the Bureau of Consumer Financial Protection, the Federal functional regulators, the State insurance authorities, and the Federal Trade Commission with respect to financial institutions and other persons subject to their jurisdiction under applicable law ( b ) Enforcement of section 6801 ( 1 ) In general Except as provided in paragraph ( 2 ), the agencies and authorities described in subsection ( a ), other than the Bureau of Consumer Financial Protection, shall implement the standards prescribed under section 6801 ( b ) of this title in the same manner, to the extent practicable, as standards prescribed pursuant to section 1831p1 ( a ) of title 12 are implemented pursuant to such section.

( 2 ) Exception The agencies and authorities described in paragraphs ( 3 ), ( 4 ), ( 5 ), ( 6 ), and ( 7 ) of subsection ( a ) shall implement the standards prescribed under section 6801 ( b ) of this title by rule with respect to the financial institutions and other persons subject to their respective jurisdictions under subsection ( a ).

( c ) Absence of State action If a State insurance authority fails to adopt regulations to carry out this subchapter, such State shall not be eligible to override, pursuant to section 1831x ( g ) ( 2 ) ( B ) ( iii ) of title 12, the insurance customer protection regulations prescribed by a Federal banking agency under section 1831x ( a ) of title 12.

( d ) Definitions The terms used in subsection ( a ) ( 1 ) that are not defined in this subchapter or otherwise defined in section 1813 ( s ) of title 12 shall have the same meaning as given in section 3101 of title 12.

Per 12 CFR 1022.3 - Definitions.