Consumer complaint received 2024-02-04
Product: Credit reporting or other personal consumer reports — Credit reporting
Issue: Improper use of your report — Reporting company used your report improperly
Company: Experian Information Solutions Inc. (OH)

5 USC 552a ( b ) Conditions of Disclosure.No agency shall disclose any record which is contained in a system of records by any means of communication to any person, or to another agency, except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains, unless disclosure of the record would be I did not give written or verbal consent to disclose my non public private information to these credit reporting agencies. Disclosing my XXXX XXXX  Account starting with XXXX, XXXX XXXX Account starting with XXXX, XXXX  Account starting with XXXX. These credit reporting agencies are also in violation of the privacy act of 1974 Conditions of Disclosure to Third Parties The general rule under the Privacy Act is that an agency can not disclose a record contained in a system of records unless the individual to whom the record pertains gives prior written consent to the disclosure. There are twelve exceptions to this general rule. 

A. The No Disclosure without Consent Rule No agency shall disclose any record which is contained in a system of records by any means of communication to any person, or to another agency, except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains [ subject to 12 exceptions ]. 5 U.S.C. 552a ( b ). 

Comment : Under the Privacy Acts disclosure provision, agencies generally are prohibited from disclosing records by any means of communication written, oral, electronic, or mechanical without the written consent of the individual, subject to twelve exceptions. 

Federal officials handling personal information are bound by the Privacy Act not to disclose any personal information and to take certain precautions to keep personal information confidential. XXXX XXXX XXXX XXXXXXXX XXXX XXXX XXXX XXXX  XXXX XXXX XXXX XXXX, XXXX XXXX XXXX, XXXX ( XXXX XXXX XXXX ) ; see also, e.g., XXXX, XXXX XXXX, XXXX XXXX XXXX XXXX XXXX XXXXXXXX XXXX XXXX XXXXXXXX, XXXX XXXX XXXX, XXXX ( XXXXXXXX XXXX XXXXXXXX ) ( noting that Privacy Act generally prohibits the federal government from disclosing personal information about an individual without the individuals consent ). 

A disclosure can be by any means of communication written, oral, electronic, or mechanical. See XXXX XXXX XXXXXXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXXXXXX XXXX XXXX, XXXX ( XXXX XXXX. XXXX ) ( concluding that an absolute policy of limiting the Acts coverage to information physically retrieved from a record would make little sense in terms of its underlying purpose and that Privacy Act forbids nonconsensual disclosure of records by any means of communication ) ; see also, e.g., XXXXXXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX  XXXX, XXXX XXXX XXXX, XXXX XXXX ( XXXXXXXX XXXX XXXXXXXX ) ( Numerous courts have held that the Privacy Act protects against improper oral disclosures. ) ; XXXX XXXX XXXX XXXX XXXX XXXX, XXXX XXXX XXXX, XXXX ( XXXX Cir. XXXX ) ( rejecting argument that the [ Privacy Act ] only protects against the disclosure of a physical document that is contained in a system of records, and holding that damaging information... taken from a protected record and inserted into a new document, which was then disclosed without the plaintiffs consent, violated subsection ( b ) because the new document is also a protected record ) ; XXXXXXXX XXXX XXXX XXXX XXXX XXXX, XXXX ( XXXXXXXX XXXX XXXX ) ( The Privacy Act prohibits more than dissemination of records themselves, but also nonconsensual disclosure of any information that has been retrieved from a protected record ( quoting XXXX XXXX XXXX, XXXX XXXX at XXXX ) ) ; XXXX XXXX XXXX XXXX XXXX XXXX XXXXXXXX XXXX. XXXX XXXX, XXXX ( XXXX XXXX XXXXXXXX ) ( [ XXXX ] hile the term disclosure is not defined by the statute, it has been interpreted broadly ) ; XXXX XXXX XXXX XXXX XXXX XXXX. XXXX. XXXX, XXXX ( XXXX XXXX ) ( citing XXXX, XXXX XXXX at XXXX ) ; XXXX XXXX XXXX XXXX XXXX XXXX XXXX. XXXX XXXX, XXXX XXXX ( XXXX XXXXXXXX ) ( citing XXXX, XXXX XXXX at XXXX ). 

OMB guidelines, and some, but not all, courts have advised that disclosures can occur by either transferring a record or simply granting access to a record. 

Further, a disclosure under the Privacy Act may be either the transfer of a record or the granting of access to a record. XXXX XXXX XXXXXXXX XXXX XXXX XXXXXXXX. at XXXX ( XX/XX/XXXX ), see also XXXX XXXX XXXX, XXXX XXXX XXXX, XXXX ( XXXXXXXX XXXX XXXXXXXX ) ( interpreting disclosure under the Privacy Act liberally to include not only the physical disclosure of the records, but also the accessing of private records ). Regarding actionability, however, the United States Court of Appeals for the District of Columbia Circuit has required that a record actually be retrieved. XXXXXXXX XXXX XXXX XXXXXXXX XXXX XXXX, XXXX ( XXXX XXXX. XXXX ) ( quoting XXXX, XXXX XXXX at XXXX, and holding that, to be actionable, a disclosure generally must be the result of someone having actually retrieved the record from that system of records ; the disclosure of information is not ordinarily a violation merely because the information happens to be contained in the records ) ; XXXXXXXX XXXX XXXX XXXX XXXX XXXX XXXXXXXX, XXXX XXXX XXXX, at XXXX ( XXXX. XXXX XXXX XXXX, XXXX ). But see XXXX XXXX XXXX, XXXX. XXXX, XXXX XXXX XXXX, at XXXX ( XXXX XXXX XXXX XXXXXX/XX/XXXX ) ( holding unauthorized access not actionable under Privacy Act, even though plaintiffs declaration provided support for conclusion that defendants employees individually improperly accessed plaintiffs private medical data ) ; XXXXXXXX XXXX XXXXXXXX, XXXX. XXXX ( XXXX ), XXXX XXXX XXXX, at XXXX ( XXXX XXXX  XXXX, XXXX ) ( [ A ] plaintiff can not establish a prima facie claim under the Privacy Act simply by showing that the agency official who disclosed a protected record should never have accessed the record in the first place. ) ; XXXXXXXX XXXX XXXX XXXX XXXXXXXX, XXXX XXXX XXXX ( XXXX. XXXX XXXX XXXX, XXXX ) ( dismissing claim of improper disclosure under subsection ( b ) in spite of evidence suggesting agencys employee had unauthorized access to plaintiffs personnel file, because agency had complied with all safeguards of Privacy Act, and had not acted intentionally or willfully to disclose, defined as to open up, to expose to view, or to make known,... especially to reveal in words ( citations omitted ) ). 

A disclosure of information from a non-record source does not violate the Privacy Acts disclosure provision. 

The disclosure of information acquired from non-record sources such as observation, office emails, discussions with co-workers and the rumor mill does not violate the Privacy Act... even if the information disclosed is also contained in agency records. XXXXXXXX XXXX XXXX XXXX XXXX XXXX ( quoting XXXX XXXX XXXX XXXX XXXX. XXXX. at XXXX ) ; XXXX v. XXXX, XXXX. XXXX, XXXX XXXX XXXX, at XXXX ( XXXX XXXX XXXX XXXX XXXX XXXX ) ( For a disclosure to be covered by section XXXX ( b ), there must have initially been a retrieval from the system of records which was at some point a source of the information. ( citations omitted ) ) ; XXXX XXXX XXXX, XXXX. XXXX, XXXX XXXX XXXX, at XXXX ( XXXX XXXX XXXX XXXX, XXXX ) ( [ T ] he Privacy Act does not prohibit disclosure of information or knowledge obtained from other sources other than records ... .In particular, it does not prevent federal employees or officials from talking even gossiping about anything of which they have non-record-based knowledge. ( citations omitted ) ). 

For further discussion of the meaning of disclosure of records, see the Definitions, Systems of Records and Disclosures under Subsection ( b ) section above. 

In one case in which a plaintiff sought relief for alleged wrongful disclosure of items seized during the execution of a search warrant, the court found, Appellant has failed to show that evidence seized during a search conducted in a criminal investigation constitutes records that are contained in a system of records under the Privacy Act. Matter of XXXX of XXXX XXXX XXXX. XXXX XXXXXXXX XXXX XXXX XXXXXXXX, XXXX XXXX XXXX, at XXXX ( XXXX. XXXX XXXX XXXX, XXXX ), affd sub nom. XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX 

Plaintiffs maintain the burden of demonstrating that a disclosure by an agency occurred. 

A plaintiff has the burden of demonstrating that a disclosure by the agency has occurred. See, e.g., XXXXXXXX XXXX XXXX XXXX XXXX XXXX  XXXX, XXXX ( XXXX Cir. XXXX ) ; XXXX XXXX XXXX, XXXX XXXX XXXX, XXXX ( XXXX XXXX. XXXX ) ; XXXX v. United States, XXXX XXXX XXXX. XXXX XXXX, XXXX ( XXXX XXXX XXXXXXXX ) ; cf. XXXX XXXX XXXX, XXXX XXXX XXXX XXXX, XXXX ( XXXX Cir. XXXX ) ( holding that disclosure is not actionable because it identified [ plaintiff ] only by his first name and neither recipient knew who XXXX was ) ; XXXX XXXX XXXX, XXXX XXXX XXXX, XXXX ( XXXX Cir. XXXX ) ( rejecting appellants contentions that mere transmission of the documents to a fax machine at which unauthorized persons might have viewed the documents constitutes a prohibited disclosure and that the possibility that a record might be revealed to unauthorized readers by negligent or reckless transmission is sufficient to constitute a prohibited disclosure under the Act ) ; XXXX XXXX XXXX XXXX XXXX, XXXX XXXX XXXX XXXX, XXXX ( XXXX XXXX. XXXX ) ( [ T ] he fact that [ a company ] somehow came into possession of documents that might have been included in plaintiffs personnel file... gives rise only to a metaphysical doubt as to the existence of a genuine issue of material fact. ) ; XXXX XXXX XXXX XXXX XXXX XXXX XXXX, XXXX ( XXXX XXXX XXXXXXXX ) ( ruling that district court grant of summary judgment was proper where no evidence was found that record was disclosed, and stating that burden is on the plaintiff at the summary judgment stage to come forward with specific evidence ) ; XXXX XXXX XXXX, XXXX XXXX XXXX, XXXX ( XXXX Cir. XXXX ) ( where agency employee testified that, despite memorandum indicating otherwise, she had disclosed information only within agency, and where plaintiff responded that whether his file was reviewed by other individuals is question of fact he want [ ed ] decided by a fact finder, not an affidavit, finding such arguments misapprehend [ plaintiffs ] burden at the summary judgment stage ) ; XXXX XXXX XXXX, XXXX. XXXX, XXXX XXXX XXXX, at XXXX ( XXXX XXXX. XXXX. XXXX, XXXX ) ( holding that plaintiff can not prove disclosure violation where the only agency involved, the Postal Service, received rather than disclosed the information in question ) ; XXXXXXXX XXXX XXXX XXXX. XXXX, XXXX XXXX XXXX, at XXXX ( XXXX XXXX XXXX, XXXX ) ( dismissing claim and stating that plaintiffs conclusory allegations of unlawful disclosure, without identifying or describing who acted against XXXX or what the person did, is insufficient ) ; XXXXXXXX XXXX XXXX XXXX. XXXX, XXXX XXXX XXXX, at XXXX ( XXXX XXXX XXXX, XXXX ) ( concluding that plaintiffs fail [ XXXX ] to allege sufficient facts supporting that the FBI, as opposed to some other law enforcement body, disclosed [ one plaintiffs ] rap sheet on the Internet, where plaintiffs base [ d ] their allegation on... the mere fact that [ a particular Internet ] posting contained some expunged information ), reconsideration denied, No. XXXX, XXXX XXXX XXXX ( XXXX. XXXX XXXX, XXXX ) ; XXXX XXXX XXXX, XXXX. XXXX, XXXX XXXX XXXX, at XXXX ( XXXX  XXXX XXXX, XXXX ) ( concluding that plaintiff failed to make out XXXX XXXX case under subsection ( b ) of Privacy Act because plaintiff alleged merely that records were accessible to other individuals in office, rather than that they were actually disclosed ); XXXX XXXX XXXX XXXX XXXX, XXXX XXXX XXXX. XXXX XXXX, XXXX ( XXXX. XXXX ) ( finding that plaintiffs failed to prove, by a preponderance of the evidence, that XXXX disclosed protected information where plaintiffs did not have personal knowledge that [ the memorandum was disclosed ] and witnesses at trial denied disclosing or receiving memorandum ) ; XXXXXXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX  ( XXXXXXXX XXXX XXXXXXXX XXXX, XXXX ) ( finding lack of evidence that disclosure occurred where plaintiff alleged that, among other things, file had been left in unsecured file cabinet ), affd per curiam, No. XXXX, XXXX XXXX XXXX, at XXXX ( XXXX Cir. XXXX XXXX, XXXX ). But XXXX. XXXX, XXXX XXXX at XXXX ( finding plaintiffs complaint sufficient to survive summary judgment because he need not prove his case on the pleadings but rather must merely provide enough factual material to raise a reasonable inference, and thus a plausible claim, that the [ XXXX. for XXXX XXXX XXXX XXXX ] was the source of the disclosures ) ; XXXX v. XXXX, XXXX XXXX XXXX. XXXX XXXX, XXXX ( XXXX  XXXX ) ( concluding that plaintiffs allegation of XXXX disclosure to unidentified government officials, who were unrelated to handling of plaintiffs case, was not unacceptably vague and need not include identities of alleged recipients for XXXX to understand Plaintiffs charge ) ; XXXX XXXX XXXX, XXXX XXXX XXXX. XXXX XXXX, XXXX ( XXXX XXXXXXXX ) ( ruling that plaintiff had stated claim for relief under Privacy Act where plaintiff pled that a member of [ agency ] management placed records referring and relating to her XXXX on a server accessible by other federal employees and members of the public ). 

Direct evidence that an agency disclosed a record is generally not required, but plaintiffs must produce more than mere speculation or conjecture. 

Circumstantial evidence may be sufficient to prove an unauthorized disclosure occurred, although courts generally require corroborating evidence, rather than mere speculation or conjecture. Because plaintiffs can rarely produce direct evidence that the government has disclosed confidential information obtained from their private records, requiring such evidence would eviscerate the protections of the Privacy Act. XXXXXXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX  ( XXXX XXXX XXXX XXXX XXXX, XXXX ) ( citing Doe v. XXXX, XXXX XXXX XXXX, XXXX ( XXXX XXXX. XXXX ) ; XXXX XXXX XXXX, No. XXXX, XXXX XXXX XXXX ( XXXX XXXX XXXX XXXX XXXX, XXXX ). 

At least one court has held that there will be an adverse inference against an agency that destroys evidence in order to undermine the plaintiffs ability to prove that a disclosure occurred.

One district court has concluded that when an agency destroys evidence in order to undermine the plaintiffs ability to prove that a disclosure occurred, there will be an adverse inference against the agency. See XXXX XXXX XXXX XXXX XXXX XXXX  XXXX XXXX, at XXXX ( XXXX. XXXX XXXX. XXXX, XXXX ) ( concluding that whether by use of the adverse inference or by a preponderance of the evidence standard, officials who inspected the folder found evidence that an inmate had tampered with it, and finding that disclosure occurred in violation of Privacy Act ), affd in part, revd in part & remanded, on other grounds, XXXX XXXX XXXX ( XXXX XXXX XXXXXXXX ). 

Many, but not all, courts have held that a disclosure does not occur if the disclosure is to a person who was already aware of the information. 

Many, but not all, courts have held that a disclosure under the Privacy Act does not occur if the communication is to a person who is already aware of the information. See, e.g., XXXX XXXX XXXX, XXXX XXXX XXXX, XXXX ( XXXXXXXX XXXX XXXXXXXX ) ( finding no Privacy Act violation where agency disclosed same information in letter to journalist that plaintiff himself had previously provided to journalist ; plaintiff waiv [ ed ], in effect, his protection under the Privacy Act ) ; XXXX XXXX XXXX, XXXX XXXX XXXX, XXXX ( XXXX XXXX. XXXX ) ( XXXX  ) ; XXXXXXXX XXXX XXXX XXXX XXXX XXXX XXXXXXXX ( XXXXXXXX XXXX XXXXXXXX ) ; XXXX XXXX XXXX, XXXX XXXX XXXX, XXXX ( XXXX XXXX. XXXX ) ; XXXX v. XXXX, XXXX XXXX XXXX, XXXX XXXX ( XXXX XXXX XXXXXXXX ) ; XXXX XXXX XXXX XXXX XXXX, XXXX XXXX XXXX, XXXX ( XXXXXXXX XXXX XXXXXXXX ) ; XXXX XXXX XXXX XXXX XXXX XXXXXXXX, XXXX ( XXXXXXXX XXXX XXXXXXXX ) ; XXXX XXXX XXXX  XXXX XXXX XXXX, XXXX ( XXXX Cir. XXXX ) ; XXXXXXXX XXXX XXXX XXXX XXXXXXXX XXXX XXXX, XXXX ( XXXXXXXX XXXX XXXXXXXX ) ; XXXXXXXX XXXX XXXX, XXXX. XXXX, XXXX XXXX XXXX, at XXXX ( XXXX. XXXX XXXX XXXX, XXXX ) ( finding no disclosure because by time agency posted statement on its web site, plaintiff had been quoted in newspaper saying he received letter of admonishment, another newspaper article had referred to letter, and plaintiff had testified before Congress regarding letter ; also finding no disclosure of report because at time agency provided link to report on its web site, the entire [ report ] had been the subject of a press release and news conference by a separate and independent agency... and had been released to the media by the same ) ; XXXXXXXX XXXX XXXX XXXX XXXX XXXXXXXX, XXXX ( XXXX. XXXX XXXX ) ( defin [ ing ] the term disclose to mean the placing into the view of another information which was previously unknown ) ; XXXX XXXX XXXX, XXXX XXXX XXXX. XXXX XXXX, XXXX ( XXXX XXXXXXXX ) ; XXXXXXXX XXXX XXXX XXXXXXXX XXXX XXXX. XXXX, XXXX ( XXXX XXXXXXXX ) ; XXXX XXXX XXXX. XXXX. XXXX XXXX, XXXX XXXX XXXX. XXXX, XXXX ( XXXX XXXX XXXX ) ( commenting that policy underlying Privacy Act protecting confidential information from disclosure not implicated by release of information health care provider had already received through patients California XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX. XXXX, XXXX ( XXXX XXXX XXXX ), affd, XXXX XXXX XXXX ( XXXXXXXX XXXX XXXX ) ( unpublished table decision ) ; XXXXXXXX XXXX XXXX XXXX XXXX XXXXXXXX. XXXX, XXXX ( XXXX XXXX XXXX ), XXXX XXXX XXXX XXXX XXXXXXXX ( XXXXXXXX XXXX XXXX XXXX, XXXX ) ; XXXX XXXX XXXX XXXX  XXXX XXXX. XXXX, XXXX ( XXXX XXXXXXXX ) ; XXXXXXXX XXXX XXXX XXXXXXXX XXXX XXXX. XXXX, XXXX ( XXXX. XXXX XXXXXXXX ), affd, XXXX XXXX XXXX ( XXXX Cir. XXXX ) ( unpublished table decision ) ; XXXX v. XXXX, XXXX. XXXXXXXX XXXX XXXX XXXX XXXXXXXX ( XXXX XXXX XXXX XXXX XXXX, XXXX ) ( mailing of agency decision affirming employees removal to his former attorney held not disclosure because attorney was familiar with facts of [ employees ] claim and no new information was disclosed to him ) ; XXXXXXXX XXXX XXXX XXXX XXXXXXXX XXXX XXXX. XXXX, at XXXX ( XXXX XXXX  XX/XX/XXXX ) ; XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXXXXXX ( XXXX XXXXXXXX ) ; XXXXXXXX XXXX XXXX XXXX XXXX XXXX XXXX. XXXX, XXXX ( XXXX XXXXXXXX ) ; XXXX XXXX XXXX XXXXXXXX, XXXX XXXX XXXX, XXXX ( XXXX XXXX XXXXXXXX ) ( finding no evidence that disclosure could possibly have had an adverse effect on plaintiff where recipient had been privy to every event described in [ plaintiffs ] records at the time the event occurred ) ; XXXX XXXX XXXX, XXXX XXXX XXXX. XXXX XXXX, XXXX ( XXXX XXXXXXXX ) ( citing XXXX and expressing doubt as to whether disclosure at issue has presented any new information to those in the intelligence community ) ; XXXX XXXX XXXX, XXXX XXXX XXXX. XXXX XXXX, XXXX ( XXXX XXXX XXXX XXXX ) ( although finding disclosure to credit reporting service valid under routine use exception, concluding information disclosed was already in possession of recipient and other courts had held that Privacy Act is not violated in such cases ), affd, XXXX XXXX XXXX ( XXXX XXXX XXXXXXXX ) ( unpublished table decision ). 

However, the Court of Appeals for the District of Columbia Circuit clarified that some disseminations of protected records to individuals with prior knowledge of their existence or contents are disclosures under the Privacy Act. XXXXXXXX XXXX XXXX XXXX XXXX XXXX, XXXX ( XXXX XXXX. XXXX ). In XXXX, the XXXX. XXXX held that the Justice Departments transmission of a Privacy Act-protected record to a former employee of the agency constituted a disclosure under the Privacy Act, even though the recipient had come into contact with the [ record ] in the course of his duties while an employee. Id. The courts review of the Privacy Acts purposes, legislative history, and integrated structure convince [ d it ] that Congress intended the term disclose to apply in virtually all instances to an agencys unauthorized transmission of a protected record, regardless of the recipients prior familiarity with it. Id. at XXXX. 

In an earlier case, XXXXXXXX XXXX XXXX  XXXX XXXX XXXX ( XXXX XXXX. XXXX ), the XXXX. XXXX had held that the release of a summary of individual child-support payments previously deducted from plaintiffs salary and sent directly to his ex-wife, who had requested it for use in pending litigation, was not an unlawful disclosure under the Privacy Act as she already knew what had been remitted to her. Id. at XXXX. In XXXX, the D.C. Circuit reconciled its opinion in XXXX by declin [ XXXX ] to extend XXXX beyond the limited factual circumstances that gave rise to it, 73 F.3d at 1112, 1124 15 U.S. Code 1681b - Permissible purposes of consumer reports U.S. Code ( a ) In general Subject to subsection ( c ), any consumer reporting agency may furnish a consumer report under the following circumstances and no other : ( 1 ) In response to the order of a court having jurisdiction to issue such an order, a subpoena issued in connection with proceedings before a Federal grand jury, or a subpoena issued in accordance with section 5318 of title 31 or section 3486 of title 18. 
( 2 ) In accordance with the written instructions of the consumer to whom it relates.

15 U.S. Code 6802 - Obligations with respect to disclosures of personal information U.S. Code Notes ( a ) Notice requirements Except as otherwise provided in this subchapter, a financial institution may not, directly or through any affiliate, disclose to a nonaffiliated third party any nonpublic personal information, unless such financial institution provides or has provided to the consumer a notice that complies with section 6803 of this title.

( b ) Opt out ( 1 ) In general A financial institution may not disclose nonpublic personal information to a nonaffiliated third party unless ( A ) such financial institution clearly and conspicuously discloses to the consumer, in writing or in electronic form or other form permitted by the regulations prescribed under section 6804 of this title, that such information may be disclosed to such third party ; ( B ) the consumer is given the opportunity, before the time that such information is initially disclosed, to direct that such information not be disclosed to such third party ; and ( C ) the consumer is given an explanation of how the consumer can exercise that nondisclosure option.

( 2 ) Exception This subsection shall not prevent a financial institution from providing nonpublic personal information to a nonaffiliated third party to perform services for or functions on behalf of the financial institution, including marketing of the financial institutions own products or services, or financial products or services offered pursuant to joint agreements between two or more financial institutions that comply with the requirements imposed by the regulations prescribed under section 6804 of this title, if the financial institution fully discloses the providing of such information and enters into a contractual agreement with the third party that requires the third party to maintain the confidentiality of such information.

( c ) Limits on reuse of information Except as otherwise provided in this subchapter, a nonaffiliated third party that receives from a financial institution nonpublic personal information under this section shall not, directly or through an affiliate of such receiving third party, disclose such information to any other person that is a nonaffiliated third party of both the financial institution and such receiving third party, unless such disclosure would be lawful if made directly to such other person by the financial institution.

( d ) Limitations on the sharing of account number information for marketing purposes A financial institution shall not disclose, other than to a consumer reporting agency, an account number or similar form of access number or access code for a credit card account, deposit account, or transaction account of a consumer to any nonaffiliated third party for use in telemarketing, direct mail marketing, or other marketing through electronic mail to the consumer.

( e ) General exceptions Subsections ( a ) and ( b ) shall not prohibit the disclosure of nonpublic personal information ( 1 ) as necessary to effect, administer, or enforce a transaction requested or authorized by the consumer, or in connection with ( A ) servicing or processing a financial product or service requested or authorized by the consumer ; ( B ) maintaining or servicing the consumers account with the financial institution, or with another entity as part of a private label credit card program or other extension of credit on behalf of such entity ; or ( C ) a proposed or actual securitization, secondary market sale ( including sales of servicing rights ), or similar transaction related to a transaction of the consumer ; ( 2 ) with the consent or at the direction of the consumer ; ( 3 ) ( A ) to protect the confidentiality or security of the financial institutions records pertaining to the consumer, the service or product, or the transaction therein ; ( B ) to protect against or prevent actual or potential fraud, unauthorized transactions, claims, or other liability ; ( C ) for required institutional risk control, or for resolving customer disputes or inquiries ; ( D ) to persons holding a legal or beneficial interest relating to the consumer ; or ( E ) to persons acting in a fiduciary or representative capacity on behalf of the consumer ; ( 4 ) to provide information to insurance rate advisory organizations, guaranty funds or agencies, applicable rating agencies of the financial institution, persons assessing the institutions compliance with industry standards, and the institutions attorneys, accountants, and auditors ; ( 5 ) to the extent specifically permitted or required under other provisions of law and in accordance with the Right to Financial Privacy Act of 1978 [ 12 U.S.C. 3401 et seq. ], to law enforcement agencies ( including the Bureau of Consumer Financial Protection [ 1 ] a Federal functional regulator, the Secretary of the Treasury with respect to subchapter II of chapter 53 of title 31, and chapter 2 of title I of Public Law 91508 ( 12 U.S.C. 19511959 ), a State insurance authority, or the Federal Trade Commission ), self-regulatory organizations, or for an investigation on a matter related to public safety ; ( 6 ) ( A ) to a consumer reporting agency in accordance with the Fair Credit Reporting Act [ 15 U.S.C. 1681 et seq. ], or ( B ) from a consumer report reported by a consumer reporting agency ; ( 7 ) in connection with a proposed or actual sale, merger, transfer, or exchange of all or a portion of a business or operating unit if the disclosure of nonpublic personal information concerns solely consumers of such business or unit; or ( 8 ) to comply with Federal, State, or local laws, rules, and other applicable legal requirements ; to comply with a properly authorized civil, criminal, or regulatory investigation or subpoena or summons by Federal, State, or local authorities ; or to respond to judicial process or government regulatory authorities having jurisdiction over the financial institution for examination, compliance, or other purposes as authorized by law. 
( XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX. ) 15 U.S. Code 6804 - Rulemaking U.S. Code ( a ) Regulatory authority ( 1 ) Rulemaking ( A ) In general Except as provided in subparagraph ( C ), the Bureau of Consumer Financial Protection and the Securities and Exchange Commission shall have authority to prescribe such regulations as may be necessary to carry out the purposes of this subchapter with respect to financial institutions and other persons subject to their respective jurisdiction under section 6805 of this title ( and notwithstanding subtitle B of the Consumer Financial Protection Act of 2010 [ 12 U.S.C. 5511 et seq. ] ), except that the Bureau of Consumer Financial Protection shall not have authority to prescribe regulations with respect to the standards under section 6801 of this title.

( B ) CFTC The Commodity Futures Trading Commission shall have authority to prescribe such regulations as may be necessary to carry out the purposes of this subchapter with respect to financial institutions and other persons subject to the jurisdiction of the Commodity Futures Trading Commission under section 7b2 of title 7.

( C ) Federal Trade Commission authority Notwithstanding the authority of the Bureau of Consumer Financial Protection under subparagraph ( A ), the Federal Trade Commission shall have authority to prescribe such regulations as may be necessary to carry out the purposes of this subchapter with respect to any financial institution that is a person described in section 1029 ( a ) of the Consumer Financial Protection Act of 2010 [ 12 U.S.C. 5519 ( a ) ].

( D ) Rule of construction Nothing in this paragraph shall be construed to alter, affect, or otherwise limit the authority of a State insurance authority to adopt regulations to carry out this subchapter. 

( 2 ) Coordination, consistency, and comparability Each of the agencies authorized under paragraph ( 1 ) to prescribe regulations shall consult and coordinate with the other such agencies and, as appropriate, and with [ 1 ] representatives of State insurance authorities designated by the XXXX XXXX XXXX XXXX XXXX, for the purpose of assuring, to the extent possible, that the regulations prescribed by each such agency are consistent and comparable with the regulations prescribed by the other such agencies. 

( 3 ) Procedures and deadline Such regulations shall be prescribed in accordance with applicable requirements of title 5. 

( b ) Authority to grant exceptions The regulations prescribed under subsection ( a ) may include such additional exceptions to subsections ( a ) through ( d ) of section 6802 of this title as are deemed consistent with the purposes of this subchapter. 

( XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX. ) 15 U.S. Code 6805 - Enforcement U.S. Code ( a ) In general Subject to subtitle B of the Consumer Financial Protection Act of 2010 [ 12 U.S.C. 5511 et seq. ], this subchapter and the regulations prescribed thereunder shall be enforced by the Bureau of Consumer Financial Protection, the Federal functional regulators, the State insurance authorities, and the Federal Trade Commission with respect to financial institutions and other persons subject to their jurisdiction under applicable law, as follows : ( 1 ) Under section 1818 of title 12, by the appropriate Federal banking agency, as defined in section 1813 ( q ) of title 12, in the case of ( A ) national banks, Federal branches and Federal agencies of foreign banks, and any subsidiaries of such entities ( except brokers, dealers, persons providing insurance, investment companies, and investment advisers ) ; ( B ) member banks of the Federal Reserve System ( other than national banks ), branches and agencies of foreign banks ( other than Federal branches, Federal agencies, and insured State branches of foreign banks ), commercial lending companies owned or controlled by foreign banks, organizations operating under section 25 or 25A of the Federal Reserve Act [ 12 U.S.C. 601 et seq., 611 et seq. ], and bank holding companies and their nonbank subsidiaries or affiliates ( except brokers, dealers, persons providing insurance, investment companies, and investment advisers ) ; ( C ) banks insured by the Federal Deposit Insurance Corporation ( other than members of the Federal Reserve System ), insured State branches of foreign banks, and any subsidiaries of such entities ( except brokers, dealers, persons providing insurance, investment companies, and investment advisers ) ; and I've opted out of those accounts listed above and they are still disclosing my nonpublic personal inforrmation. 16 CFR 313.7