Source: https://www.fdic.gov/regulations/laws/rules/2000-5550.html
Timestamp: 2019-04-22 12:03:17+00:00

Document:
332.2 Model privacy form and examples.
332.4 Initial privacy notice to consumers required.
332.5 Annual privacy notice to customers required.
332.6 Information to be included in privacy notices.
332.7 Form of opt out notice to consumers; opt out methods.
332.9 Delivering privacy and opt out notices.
332.10 Limits on disclosure of non-public personal information to nonaffiliated third parties.
332.11 Limits on redisclosure and reuse of information.
332.12 Limits on sharing account number information for marketing purposes.
332.13 Exception to opt out requirements for service providers and joint marketing.
332.14 Exceptions to notice and opt out requirements for processing and servicing transactions.
332.15 Other exceptions to notice and opt out requirements.
332.16 Protection of Fair Credit Reporting Act.
332.17 Relation to state laws.
332.18 Effective date; transition rule.
Authority: 12 U.S.C. 1819 (Seventh and Tenth); 15 U.S.C. 6801 et seq.
SOURCE: The provisions of this part 332 appear at 65 FR 35162, June 1, 2000, except as otherwise noted.
§ 332.1 Purpose and scope.
(3) Provides a method for consumers to prevent a financial institution from disclosing that information to most nonaffiliated third parties by "opting out" of that disclosure, subject to the exceptions in §§ 332.13, 332.14, and 332.15.
(b) Scope. (1) This part applies only to nonpublic personal information about individuals who obtain financial products or services primarily for personal, family, or household purposes from the institutions listed below. This part does not apply to information about companies or about individuals who obtain financial products or services for business, commercial, or agricultural purposes. This part applies to the United States offices of entities for which the Federal Deposit Insurance Corporation (FDIC) has primary federal supervisory authority. They are referred to in this part as "you." These are: banks insured by the FDIC (other than members of the Federal Reserve System), insured state branches of foreign banks, and certain subsidiaries of such entities.
(2) Nothing in this part modifies, limits, or supersedes the standards governing individually identifiable health information promulgated by the Secretary of Health and Human Services under the authority of sections 262 and 264 of the Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. 1320d--1320d--8).
(a) Model privacy form. Use of the model privacy form in Appendix A of this part, consistent with the instructions in Appendix A, constitutes compliance with the notice content requirements of §§ 332.6 and 332.7 of this part, although use of the model privacy form is not required.
(a) Affiliate means any company that controls, is controlled by, or is under common control with another company.
(2) Examples--(i) An individual who applies to you for credit for personal, family, or household purposes is a consumer of a financial service, regardless of whether the credit is extended.
(h) Customer means a consumer who has a customer relationship with you.
(i)(1) Customer relationship means a continuing relationship between a consumer and you under which you provide one or more financial products or services to the consumer that are to be used primarily for personal, family, or household purposes.
(k)(1) Financial institution means any institution the business of which is engaging in activities that are financial in nature or incidental to such financial activities as described in section 4(k) of the Bank Holding Company Act of 1956 (12 U.S.C. 1843(k)).
(l)(1) Financial product or service means any product or service that a financial holding company could offer by engaging in an activity that is financial in nature or incidental to such a financial activity under section 4(k) of the Bank Holding Company Act of 1956 (12 U.S.C. 1843(k)).
(2) Financial service includes your evaluation or brokerage of information that you collect in connection with a request or an application from a consumer for a financial product or service.
(2) Nonaffiliated third party includes any company that is an affiliate solely by virtue of your or your affiliate's direct or indirect ownership or control of the company in conducting merchant banking or investment banking activities of the type described in section 4(k)(4)(H) or insurance company investment activities of the type described in section 4(k)(4)(I) of the Bank Holding Company Act of 1956 (12 U.S.C. 1843(k)(4)(H) and (I)).
(3) Examples of lists--(i) Nonpublic personal information includes any list of individuals' names and street addresses that is derived in whole or in part using personally identifiable financial information that is not publicly available, such as account numbers.
(3) Examples--(i) Government records. Publicly available information in government records includes information in government real estate records and security interest filings.
(iii) Reasonable basis--(A) You have a reasonable basis to believe that mortgage information is lawfully made available to the general public if you have determined that the information is of the type included on the public record in the jurisdiction where the mortgage would be recorded.
§ 332.4 Initial privacy notice to consumers required.
(2) Consumer. A consumer, before you disclose any nonpublic personal information about the consumer to any nonaffiliated third party, if you make such a disclosure other than as authorized by §§ 332.14 and 332.15.
(c) When you establish a customer relationship--(1) General rule. You establish a customer relationship when you and the consumer enter into a continuing relationship.
(2) Special rule for loans.--You establish a customer relationship with a consumer when you originate a loan to the consumer for personal, family, or household purposes. If you subsequently transfer the servicing rights to that loan to another financial institution, the customer relationship transfers with the servicing rights.
(2) Examples of exceptions--(i) Not at customer's election. Establishing a customer relationship is not at the customer's election if you acquire a customer's deposit liability or the servicing rights to a customer's loan from another financial institution and the customer does not have a choice about your acquisition.
(f) Delivery. When you are required to deliver an initial privacy notice by this section, you must deliver it according to § 332.9. If you use a short-form initial notice for non-customers according to § 332.6(d), you may deliver your privacy notice according to § 332.6(d)(3).
§ 332.5 Annual privacy notice to customers required.
(c) Special rule for loans. If you do not have a customer relationship with a consumer under the special rule for loans in § 332.4(c)(2), then you need not provide an annual notice to that consumer under this section.
(d) Delivery. When you are required to deliver an annual privacy notice by this section, you must deliver it according to § 332.9.
§ 332.6 Information to be included in privacy notices.
(2) Categories of nonpublic personal information you disclose--(i) You satisfy the requirement to categorize the nonpublic personal information that you disclose if you list the categories described in paragraph (c)(1) of this section, as applicable, and a few examples to illustrate the types of information in each category.
(B) A financial institution with whom you have a joint-marketing agreement.
(5) Simplified notices. If you do not disclose, and do not wish to reserve the right to disclose, nonpublic personal information about customers or former customers to affiliates or nonaffiliated third parties except as authorized under §§ 332.14 and 332.15, you may simply state that fact, in addition to the information you must provide under paragraphs (a)(1), (a)(8), (a)(9), and (b) of this section.
(d) Short-form initial notice with opt out notice for non-customers--(1) You may satisfy the initial notice requirements in §§ 332.4(a)(2), 332.7(b), and 332.7(c) for a consumer who is not a customer by providing a short-form initial notice at the same time as you deliver an opt out notice as required in § 332.7.
(3) You must deliver your short-form initial notice according to § 332.9. You are not required to deliver your privacy notice with your short-form initial notice. You instead may simply provide the consumer a reasonable means to obtain your privacy notice. If a consumer who receives your short-form notice requests your privacy notice, you must deliver your privacy notice according to § 332.9.
(f) Model privacy form. Pursuant to § 332.2(a) of this part, a model privacy form that meets the notice content requirements of this section is included in Appendix A of this part.
§ 332.7 Form of opt out notice to consumers; opt out methods.
(B) The only means of opting out as described in any notice subsequent to the initial notice is to use a check-off box that you provide with the initial notice but did not include with the subsequent notice.
(b) Same form as initial notice permitted. You may provide the opt out notice together with or on the same written or electronic form as the initial notice you provide in accordance with § 332.4.
(c) Initial notice required when opt out notice delivered subsequent to initial notice. If you provide the opt out notice later than required for the initial notice in accordance with § 332.4, you must also include a copy of the initial notice with the opt out notice in writing or, if the consumer agrees, electronically.
(d) Joint relationships--(1) If two or more consumers jointly obtain a financial product or service from you, you may provide a single opt out notice. Your opt out notice must explain how you will treat an opt out direction by a joint consumer (as explained in paragraph (d)(5) of this section).
(e) Time to comply with opt out. You must comply with a consumer's opt out direction as soon as reasonably practicable after you receive it.
(f) Continuing right to opt out. A consumer may exercise the right to opt out at any time.
(g) Duration of consumer's opt out direction--(1) A consumer's direction to opt out under this section is effective until the consumer revokes it in writing or, if the consumer agrees, electronically.
(h) Delivery. When you are required to deliver an opt out notice by this section, you must deliver it according to § 332.9.
(i) Model privacy form. Pursuant to § 332.2(a) of this part, a model privacy form that meets the notice content requirements of this section is included in Appendix A of this part.
§ 332.8 Revised privacy notices.
(c) Delivery. When you are required to deliver a revised privacy notice by this section, you must deliver it according to § 332.9.
§ 332.9 Delivering privacy and opt out notices.
(2) The customer has requested that you refrain from sending any information regarding the customer relationship, and your current privacy notice remains available to the customer upon request.
(e) Retention or accessibility of notices for customers--(1) For customers only, you must provide the initial notice required by § 332.4(a)(1), the annual notice required by § 332.5(a), and the revised notice required by § 332.8 so that the customer can retain them or obtain them later in writing or, if the customer agrees, electronically.
(f) Joint notice with other financial institutions. You may provide a joint notice from you and one or more of your affiliates or other financial institutions, as identified in the notice, as long as the notice is accurate with respect to you and the other institutions.
(g) Joint relationships. If two or more consumers jointly obtain a financial product or service from you, you may satisfy the initial, annual, and revised notice requirements of §§ 332.4(a), 332.5(a), and 332.8(a), respectively, by providing one notice to those consumers jointly.
(2) Opt out definition. Opt out means a direction by the consumer that you not disclose nonpublic personal information about that consumer to a nonaffiliated third party, other than as permitted by §§ 332.13, 332.14, and 332.15.
(ii) By electronic means. A customer opens an on-line account with you and agrees to receive the notices required in paragraph (a)(1) of this section electronically, and you allow the customer to opt out by any reasonable means within 30 days after the date that the customer acknowledges receipt of the notices in conjunction with opening the account.
(b) Application of opt out to all consumers and all nonpublic personal information--(1) You must comply with this section, regardless of whether you and the consumer have established a customer relationship.
(iii) You may disclose and use the information pursuant to an exception in § 332.14 or 332.15 in the ordinary course of business to carry out the activity covered by the exception under which you received the information.
(2) Example. If you receive a customer list from a nonaffiliated financial institution in order to provide account-processing services under the exception in § 332.14(a), you may disclose that information under any exception in § 332.14 or 332.15 in the ordinary course of business in order to provide those services. For example, you could disclose the information in response to a properly authorized subpoena or to your attorneys, accountants, and auditors. You could not disclose that information to a third party for marketing purposes or use that information for your own marketing purposes.
(3) The third party may disclose and use the information pursuant to an exception in § 332.14 or 332.15 in the ordinary course of business to carry out the activity covered by the exception under which it received the information.
(a) General prohibition on disclosure of account numbers. You must not, directly or through an affiliate, disclose, other than to a consumer reporting agency, an account number or similar form of access number or access code for a consumer's credit card account, deposit account, or transaction account to any nonaffiliated third party for use in telemarketing, direct mail marketing, or other marketing through electronic mail to the consumer.
(c) Examples--(1) Account number. An account number, or similar form of access number or access code, does not include a number or code in an encrypted form, as long as you do not provide the recipient with a means to decode the number or code.
(2) Transaction account. A transaction account is an account other than a deposit account or a credit card account. A transaction account does not include an account to which third parties cannot initiate charges.
(ii) Enter into a contractual agreement with the third party that prohibits the third party from disclosing or using the information other than to carry out the purposes for which you disclosed the information, including use under an exception in § 332.14 or 332.15 in the ordinary course of business to carry out those purposes.
(2) Example. If you disclose nonpublic personal information under this section to a financial institution with which you perform joint marketing, your contractual agreement with that institution meets the requirements of paragraph (a)(1)(ii) of this section if it prohibits the institution from disclosing or using the nonpublic personal information except as necessary to carry out the joint marketing or under an exception in § 332.14 or 332.15 in the ordinary course of business to carry out that joint marketing.
(2) A consumer may revoke consent by subsequently exercising the right to opt out of future disclosures of nonpublic personal information as permitted under § 332.7(f).
§ 332.16 Protection of Fair Credit Reporting Act.
§ 332.17 Relation to State laws.
(b) Greater protection under state law. For purposes of this section, a state statute, regulation, order, or interpretation is not inconsistent with the provisions of this part if the protection such statute, regulation, order, or interpretation affords any consumer is greater than the protection provided under this part, as determined by the Federal Trade Commission, after consultation with the FDIC, on the Federal Trade Commission's own motion, or upon the petition of any interested party.
§ 332.18 Effective date; transition rule.
(a) Effective date. This part is effective November 13, 2000. In order to provide sufficient time for you to establish policies and systems to comply with the requirements of this part, the FDIC has extended the time for compliance with this part until July 1, 2001.
(b)(1) Notice requirement for consumers who are your customers on the compliance date. By July 1, 2001, you must have provided an initial notice, as required by § 332.4, to consumers who are your customers on July 1, 2001.
(2) Example. You provide an initial notice to consumers who are your customers on July 1, 2001, if, by that date, you have established a system for providing an initial notice to all new customers and have mailed the initial notice to all your existing customers.
(c) Two-year grandfathering of service agreements. Until July 1, 2002, a contract that you have entered into with a nonaffiliated third party to perform services for you or functions on your behalf satisfies the provisions of § 332.13(a)(1)(ii) of this part, even if the contract does not include a requirement that the third party maintain the confidentiality of nonpublic personal information, as long as you entered into the contract on or before July 1, 2000.

References: § 332

§ 332
 § 332
 § 332
 § 332

§ 332
 § 332
 § 332

§ 332
 § 332
 § 332
 § 332
 § 332

§ 332
 § 332
 § 332
 § 332
 § 332

§ 332
 § 332

§ 332
 § 332
 § 332
 § 332
 § 332
 § 332
 § 332
 § 332
 § 332
 § 332
 § 332

§ 332

§ 332

§ 332
 § 332
 § 332