Source: https://www.ecfr.gov/cgi-bin/retrieveECFR?gp=&mc=true&r=PART&n=pt17.4.248
Timestamp: 2020-02-28 10:21:04
Document Index: 102511366

Matched Legal Cases: ['art 248', '§248', '§248', '§248', '§248', 'art 160', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', 'art 248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248', '§248']

Authority: 15 U.S.C. 78q, 78q-1, 78o-4, 78o-5, 78w, 78mm, 80a-30, 80a-37, 80b-4, 80b-11, 1681m(e), 1681s(b), 1681s-3 and note, 1681w(a)(1), 6801-6809, and 6825; Pub. L. 111-203, secs. 1088(a)(8), (a)(10), and sec. 1088(b), 124 Stat. 1376 (2010).
Source: 65 FR 40362, June 29, 2000, unless otherwise noted.
Editorial Note: Nomenclature changes to part 248 appear at 74 FR 40431, Aug. 11, 2009.
(a) Purpose. This subpart governs the treatment of nonpublic personal information about consumers by the financial institutions listed in paragraph (b) of this section. This subpart:
(3) Provides a method for consumers to prevent a financial institution from disclosing that information to most nonaffiliated third parties by “opting out” of that disclosure, subject to the exceptions in §§248.13, 248.14, and 248.15.
(b) Scope. Except with respect to §248.30(b), this subpart applies only to nonpublic personal information about individuals who obtain financial products or services primarily for personal, family, or household purposes from the institutions listed below. This subpart does not apply to information about companies or about individuals who obtain financial products or services primarily for business, commercial, or agricultural purposes. This part applies to brokers, dealers, and investment companies, as well as to investment advisers that are registered with the Commission. It also applies to foreign (non-resident) brokers, dealers, investment companies and investment advisers that are registered with the Commission. These entities are referred to in this subpart as “you.” This subpart does not apply to foreign (non-resident) brokers, dealers, investment companies and investment advisers that are not registered with the Commission. Nothing in this subpart modifies, limits, or supersedes the standards governing individually identifiable health information promulgated by the Secretary of Health and Human Services under the authority of sections 262 and 264 of the Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. 1320d-1320d-8).
(a) Model privacy form. Use of the model privacy form in appendix A to subpart A of this part, consistent with the instructions in appendix A to subpart A, constitutes compliance with the notice content requirements of §§248.6 and 248.7 of this part, although use of the model privacy form is not required.
(b) Examples. The examples in this part provide guidance concerning the rule's application in ordinary circumstances. The facts and circumstances of each individual situation, however, will determine whether compliance with an example, to the extent practicable, constitutes compliance with this part.
(c) Substituted compliance with CFTC financial privacy rules by futures commission merchants and introducing brokers. Except with respect to §248.30(b), any futures commission merchant or introducing broker (as those terms are defined in the Commodity Exchange Act (7 U.S.C. 1, et seq.)) registered by notice with the Commission for the purpose of conducting business in security futures products pursuant to section 15(b)(11)(A) of the Securities Exchange Act of 1934 (15 U.S.C. 78o(b)(11)(A)) that is subject to and in compliance with the financial privacy rules of the Commodity Futures Trading Commission (17 CFR part 160) will be deemed to be in compliance with this part.
(a) Affiliate of a broker, dealer, or investment company, or an investment adviser registered with the Commission means any company that controls, is controlled by, or is under common control with the broker, dealer, or investment company, or investment adviser registered with the Commission. In addition, a broker, dealer, or investment company, or an investment adviser registered with the Commission will be deemed an affiliate of a company for purposes of this subpart if:
(1) That company is regulated under Title V of the GLBA by the Federal Trade Commission or by a Federal functional regulator other than the Commission; and
(2) Rules adopted by the Federal Trade Commission or another federal functional regulator under Title V of the GLBA treat the broker, dealer, or investment company, or investment adviser registered with the Commission as an affiliate of that company.
(c)(1) Clear and conspicuous means that a notice is reasonably understandable and designed to call attention to the nature and significance of the information in the notice.
(E) Use distinctive type size, style, and graphic devices, such as shading or sidebars when you combine your notice with other information.
(d) Collect means to obtain information that you organize or can retrieve by the name of an individual or by identifying number, symbol, or other identifying particular assigned to the individual, irrespective of the source of the underlying information.
(g)(1) Consumer means an individual who obtains or has obtained a financial product or service from you that is to be used primarily for personal, family, or household purposes, or that individual's legal representative.
(2) Examples. (i) An individual is your consumer if he or she provides nonpublic personal information to you in connection with obtaining or seeking to obtain brokerage services or investment advisory services, whether or not you provide brokerage services to the individual or establish a continuing relationship with the individual.
(ii) An individual is not your consumer if he or she provides you only with his or her name, address, and general areas of investment interest in connection with a request for a prospectus, an investment adviser brochure, or other information about financial products or services.
(iii) An individual is not your consumer if he or she has an account with another broker or dealer (the introducing broker-dealer) that carries securities for the individual in a special omnibus account with you (the clearing broker-dealer) in the name of the introducing broker-dealer, and when you receive only the account numbers and transaction information of the introducing broker-dealer's consumers in order to clear transactions.
(iv) If you are an investment company, an individual is not your consumer when the individual purchases an interest in shares you have issued only through a broker or dealer or investment adviser who is the record owner of those shares.
(i) Control of a company means the power to exercise a controlling influence over the management or policies of a company whether through ownership of securities, by contract, or otherwise. Any person who owns beneficially, either directly or through one or more controlled companies, more than 25 percent of the voting securities of any company is presumed to control the company. Any person who does not own more than 25 percent of the voting securities of any company will be presumed not to control the company. Any presumption regarding control may be rebutted by evidence, but, in the case of an investment company, will continue until the Commission makes a decision to the contrary according to the procedures described in section 2(a)(9) of the Investment Company Act of 1940 (15 U.S.C. 80a-2(a)(9)).
(2) Examples—(i) Continuing relationship. A consumer has a continuing relationship with you if:
(A) The consumer has a brokerage account with you, or if a consumer's account is transferred to you from another broker-dealer;
(B) The consumer has an investment advisory contract with you (whether written or oral);
(C) The consumer is the record owner of securities you have issued if you are an investment company;
(D) The consumer holds an investment product through you, such as when you act as a custodian for securities or for assets in an Individual Retirement Arrangement;
(E) The consumer purchases a variable annuity from you;
(F) The consumer has an account with an introducing broker or dealer that clears transactions with and for its customers through you on a fully disclosed basis;
(G) You hold securities or other assets as collateral for a loan made to the consumer, even if you did not make the loan or do not effect any transactions on behalf of the consumer; or
(H) You regularly effect or engage in securities transactions with or for a consumer even if you do not hold any assets of the consumer.
(ii) No continuing relationship. A consumer does not, however, have a continuing relationship with you if you open an account for the consumer solely for the purpose of liquidating or purchasing securities as an accommodation, i.e., on a one time basis, without the expectation of engaging in other transactions.
(m) Federal functional regulator means:
(5) The National Credit Union Administration Board
(6) The Securities and Exchange Commission; and
(n)(1) Financial institution means any institution the business of which is engaging in activities that are financial in nature or incidental to such financial activities as described in section 4(k) of the Bank Holding Company Act of 1956 (12 U.S.C. 1843(k)).
(i) The Federal Agricultural Mortgage Corporation or any entity chartered and operating under the Farm Credit Act of 1971 (12 U.S.C. 2001 et seq.); or
(ii) Institutions chartered by Congress specifically to engage in securitizations, secondary market sales (including sales of servicing rights), or similar transactions related to a transaction of a consumer, as long as such institutions do not sell or transfer nonpublic personal information to a nonaffiliated third party.
(o)(1) Financial product or service means any product or service that a financial holding company could offer by engaging in an activity that is financial in nature or incidental to such a financial activity under section 4(k) of the Bank Holding Company Act of 1956 (12 U.S.C. 1843(k)).
(p) GLBA means the Gramm-Leach-Bliley Act (Pub. L. No. 106-102, 113 Stat. 1338 (1999)).
(2) Nonaffiliated third party includes any company that is an affiliate solely by virtue of your or your affiliate's direct or indirect ownership or control of the company in conducting merchant banking or investment banking activities of the type described in section 4(k)(4)(H) or insurance company investment activities of the type described in section 4(k)(4)(I) of the Bank Holding Company Act (12 U.S.C. 1843(k)(4)(H) and (I)).
(ii) Any list, description, or other grouping of consumers (and publicly available information pertaining to them) that is derived using any personally identifiable financial information that is not publicly available information.
(i) Publicly available information, except as included on a list described in paragraph (t)(1)(ii) of this section or when the publicly available information is disclosed in a manner that indicates the individual is or has been your consumer; or
(ii) Any list, description, or other grouping of consumers (and publicly available information pertaining to them) that is derived without using any personally identifiable financial information that is not publicly available information.
(3) Examples of lists. (i) Nonpublic personal information includes any list of individuals' names and street addresses that is derived in whole or in part using personally identifiable financial information that is not publicly available information, such as account numbers.
(ii) Nonpublic personal information does not include any list of individuals' names and addresses that contains only publicly available information, is not derived in whole or in part using personally identifiable financial information that is not publicly available information, and is not disclosed in a manner that indicates that any of the individuals on the list is a consumer of a financial institution.
(u)(1) Personally identifiable financial information means any information:
(A) A list of names and addresses of customers of an entity that is not a financial institution; or
(v)(1) Publicly available information means any information that you reasonably believe is lawfully made available to the general public from:
(2) Examples—(i) Reasonable belief. (A) You have a reasonable belief that information about your consumer is made available to the general public if you have confirmed, or your consumer has represented to you, that the information is publicly available from a source described in paragraphs (v)(1)(i)-(iii) of this section;
(B) You have a reasonable belief that information about your consumer is made available to the general public if you have taken steps to submit the information, in accordance with your internal procedures and policies and with applicable law, to a keeper of federal, State, or local government records that is required by law to make the information publicly available.
(C) You have a reasonable belief that an individual's telephone number is lawfully made available to the general public if you have located the telephone number in the telephone book or the consumer has informed you that the telephone number is not unlisted.
(D) You do not have a reasonable belief that information about a consumer is publicly available solely because that information would normally be recorded with a keeper of federal, State, or local government records that is required by law to make the information publicly available, if the consumer has the ability in accordance with applicable law to keep that information nonpublic, such as where a consumer may record a deed in the name of a blind trust.
(ii) Government records. Publicly available information in government records includes information in government real estate records and security interest filings.
(iii) Widely distributed media. Publicly available information from widely distributed media includes information from a telephone book, a television or radio program, a newspaper, or a web site that is available to the general public on an unrestricted basis. A web site is not restricted merely because an Internet service provider or a site operator requires a fee or a password, so long as access is available to the general public.
(w) You means:
(1) Any broker or dealer;
[65 FR 40362, June 29, 2000, as amended at 66 FR 45147, Aug. 27, 2001; 74 FR 40431, Aug. 11, 2009]
(2) Consumer. A consumer, before you disclose any nonpublic personal information about the consumer to any nonaffiliated third party, if you make such a disclosure other than as authorized by §§248.14 and 248.15.
(1) You do not disclose any nonpublic personal information about the consumer to any nonaffiliated third party, other than as authorized by §§248.14 and 248.15; and
(2) Special rule for loans. You do not have a customer relationship with a consumer if you buy a loan made to the consumer but do not have the servicing rights for that loan.
(3) Examples of establishing customer relationship. You establish a customer relationship when the consumer:
(1) You may provide a revised privacy notice, under §248.8, that covers the customer's new financial product or service; or
(2) Examples of exceptions—(i) Not at customer's election. Establishing a customer relationship is not at the customer's election if the customer's account is transferred to you by a trustee selected by the Securities Investor Protection Corporation (“SIPC”) and appointed by a United States Court.
(ii) Substantial delay of customer's transaction. Providing notice not later than when you establish a customer relationship would substantially delay the customer's transaction when you and the individual agree over the telephone to enter into a customer relationship involving prompt delivery of the financial product or service.
(f) Delivery. When you are required to deliver an initial privacy notice by this section, you must deliver it according to §248.9. If you use a short-form initial notice for non-customers according to §248.6(d), you may deliver your privacy notice according to §248.6(d)(3).
(iii) You are an investment company and the individual is no longer the record owner of securities you have issued; or
(c) Special rule for loans. If you do not have a customer relationship with a consumer under the special provision for loans in §248.4(c)(2), then you need not provide an annual notice to that consumer under this section.
(d) Delivery. When you are required to deliver an annual privacy notice by this section, you must deliver it according to §248.9.
(a) General rule. The initial, annual, and revised privacy notices that you provide under §§248.4, 248.5, and 248.8 must include each of the following items of information that applies to you or to the consumers to whom you send your privacy notice, in addition to any other information you wish to provide:
(3) The categories of affiliates and nonaffiliated third parties to whom you disclose nonpublic personal information, other than those parties to whom you disclose information under §§248.14 and 248.15;
(4) The categories of nonpublic personal information about your former customers that you disclose and the categories of affiliates and nonaffiliated third parties to whom you disclose nonpublic personal information about your former customers, other than those parties to whom you disclose information under §§248.14 and 248.15;
(5) If you disclose nonpublic personal information to a nonaffiliated third party under §248.13 (and no other exception applies to that disclosure), a separate statement of the categories of information you disclose and the categories of third parties with whom you have contracted;
(6) An explanation of the consumer's right under §248.10(a) to opt out of the disclosure of nonpublic personal information to nonaffiliated third parties, including the method(s) by which the consumer may exercise that right at that time;
(b) Description of nonaffiliated third parties subject to exceptions. If you disclose nonpublic personal information to third parties as authorized under §§248.14 and 248.15, you are not required to list those exceptions in the initial or annual privacy notices required by §§248.4 and 248.5. When describing the categories with respect to those parties, it is sufficient to state that you make disclosures to other nonaffiliated companies:
(1) For your everyday business purposes such as [include all that apply] to process transactions, maintain account(s), respond to court orders and legal investigations, or report to credit bureaus; or
(iv) Information from a consumer-reporting agency.
(2) Categories of nonpublic personal information you disclose. (i) You satisfy the requirement to categorize the nonpublic personal information that you disclose if you list the categories described in paragraph (e)(1) of this section, as applicable, and a few examples to illustrate the types of information in each category.
(3) Categories of affiliates and nonaffiliated third parties to whom you disclose. You satisfy the requirement to categorize the affiliates and nonaffiliated third parties to whom you disclose nonpublic personal information if you list the following categories, as applicable, and a few examples to illustrate the types of third parties in each category:
(4) Disclosures under exception for service providers and joint marketers. If you disclose nonpublic personal information under the exception in §248.13 to a nonaffiliated third party to market products or services that you offer alone or jointly with another financial institution, you satisfy the disclosure requirement of paragraph (a)(5) of this section if you:
(B) A financial institution with which you have a joint marketing agreement.
(5) Simplified notices. If you do not disclose, and do not wish to reserve the right to disclose, nonpublic personal information to affiliates or nonaffiliated third parties except as authorized under §§248.14 and 248.15, you may simply state that fact, in addition to the information you must provide under paragraphs (a)(1), (a)(8), (a)(9), and (b) of this section.
(d) Short-form initial notice with opt out notice for non-customers. (1) You may satisfy the initial notice requirements in §§248.4(a)(2), 248.7(b), and 248.7(c) for a consumer who is not a customer by providing a short-form initial notice at the same time as you deliver an opt out notice as required in §248.7.
(iii) Explain a reasonable means by which the consumer may obtain the privacy notice.
(3) You must deliver your short-form initial notice according to §248.9. You are not required to deliver your privacy notice with your short-form initial notice. You instead may simply provide the consumer a reasonable means to obtain your privacy notice. If a consumer who receives your short-form notice requests your privacy notice, you must deliver your privacy notice according to §248.9.
(f) Model privacy form. Pursuant to §248.2(a) and appendix A to subpart A of this part, Form S-P meets the notice content requirements of this section.
(a)(1) Form of opt out notice. If you are required to provide an opt out notice under §248.10(a), you must provide a clear and conspicuous notice to each of your consumers that accurately explains the right to opt out under that section. The notice must state:
(A) Identify all of the categories of nonpublic personal information that you disclose or reserve the right to disclose, and all of the categories of nonaffiliated third parties to which you disclose the information, as described in §248.6(a)(2) and (3) and state that the consumer can opt out of the disclosure of that information; and
(b) Same form as initial notice permitted. You may provide the opt out notice together with or on the same written or electronic form as the initial notice you provide in accordance with §248.4.
(c) Initial notice required when opt out notice delivered subsequent to initial notice. If you provide the opt out notice after the initial notice in accordance with §248.4, you must also include a copy of the initial notice with the opt out notice in writing or, if the consumer agrees, electronically.
(d) Joint relationships. (1) If two or more consumers jointly obtain a financial product or service from you, you may provide a single opt out notice. Your opt out notice must explain how you will treat an opt out direction by a joint consumer.
(5) Example. If John and Mary have a joint brokerage account with you and arrange for you to send statements to John's address, you may do any of the following, but you must explain in your opt out notice which opt out policy you will follow:
(i) Send a single opt out notice to John's address, but you must accept an opt out direction from either John or Mary;
(ii) Treat an opt out direction by either John or Mary as applying to the entire account. If you do so, and John opts out, you may not require Mary to opt out as well before implementing John's opt out direction; or
(A) You must permit John and Mary to opt out for each other.
(B) If both opt out, you must permit both to notify you in a single response (such as on a form or through a telephone call).
(h) Delivery. When you are required to deliver an opt out notice by this section, you must deliver it according to §248.9.
(i) Model privacy form. Pursuant to §248.2(a) and appendix A to subpart A of this part, Form S-P meets the notice content requirements of this section.
(a) General rule. Except as otherwise authorized in this subpart, you must not, directly or through any affiliate, disclose any nonpublic personal information about a consumer to a nonaffiliated third party other than as described in the initial notice that you provided to that consumer under §248.4, unless:
(b) Examples. (1) Except as otherwise permitted by §§248.13, 248.14, and 248.15, you must provide a revised notice before you:
(c) Delivery. When you are required to deliver a revised privacy notice by this section, you must deliver it according to §248.9.
(a) How to provide notices. You must provide any privacy notices and opt out notices, including short-form initial notices that this subpart requires so that each consumer can reasonably be expected to receive actual notice in writing or, if the consumer agrees, electronically.
(c) Annual notices only. (1) You may reasonably expect that a customer will receive actual notice of your annual privacy notice if:
(2) Example of reasonable expectation of receipt of annual privacy notice. You may reasonably expect that consumers who share an address will receive actual notice of your annual privacy notice if you deliver the notice with or in a stockholder or shareholder report under the conditions in 17 CFR 270.30d-1(f) or 17 CFR 270.30d-2(b), or with or in a prospectus under the conditions in 17 CFR 230.154.
(d) Oral description of notice insufficient. You may not provide any notice required by this subpart solely by orally explaining the notice, either in person or over the telephone.
(e) Retention or accessibility of notices for customers. (1) For customers only, you must provide the initial notice required by §248.4(a)(1), the annual notice required by §248.5(a), and the revised notice required by §248.8, so that the customer can retain them or obtain them later in writing or, if the customer agrees, electronically.
(g) Joint relationships. If two or more consumers jointly obtain a financial product or service from you, you may satisfy the initial, annual, and revised notice requirements of paragraph (a) of this section by providing one notice to those consumers jointly.
(a)(1) Conditions for disclosure. Except as otherwise authorized in this subpart, you may not, directly or through any affiliate, disclose any nonpublic personal information about a consumer to a nonaffiliated third party unless:
(i) You have provided to the consumer an initial notice as required under §248.4;
(ii) You have provided to the consumer an opt out notice as required in §248.7;
(2) Opt out definition. Opt out means a direction by the consumer that you not disclose nonpublic personal information about that consumer to a nonaffiliated third party, other than as permitted by §§248.13, 248.14, and 248.15.
(i) By mail. You mail the notices required in paragraph (a)(1) of this section to the consumer and allow the consumer to opt out by mailing a form, calling a toll-free telephone number, or any other reasonable means within 30 days after the date you mailed the notices.
(iii) Isolated transaction with consumer. For an isolated transaction, such as the provision of brokerage services to a consumer as an accommodation, you provide the consumer with a reasonable opportunity to opt out if you provide the notices required in paragraph (a)(1) of this section at the time of the transaction and request that the consumer decide, as a necessary part of the transaction, whether to opt out before completing the transaction.
(a)(1) Information you receive under an exception. If you receive nonpublic personal information from a nonaffiliated financial institution under an exception in §248.14 or §248.15, your disclosure and use of that information is limited as follows:
(iii) You may disclose and use the information pursuant to an exception in §248.14 or §248.15 in the ordinary course of business to carry out the activity covered by the exception under which you received the information.
(2) Example. If you receive a customer list from a nonaffiliated financial institution in order to provide account-processing services under the exception in §248.14(a), you may disclose that information under any exception in §248.14 or §248.15 in the ordinary course of business in order to provide those services. You could also disclose that information in response to a properly authorized subpoena or in the ordinary course of business to your attorneys, accountants, and auditors. You could not disclose that information to a third party for marketing purposes or use that information for your own marketing purposes.
(b)(1) Information you receive outside of an exception. If you receive nonpublic personal information from a nonaffiliated financial institution other than under an exception in §248.14 or §248.15, you may disclose the information only:
(2) Example. If you obtain a customer list from a nonaffiliated financial institution outside of the exceptions in §§248.14 and 248.15:
(i) You may use that list for your own purposes;
(ii) You may disclose that list to another nonaffiliated third party only if the financial institution from which you purchased the list could have lawfully disclosed the list to that third party. That is, you may disclose the list in accordance with the privacy policy of the financial institution from which you received the list, as limited by the opt out direction of each consumer whose nonpublic personal information you intend to disclose, and you may disclose the list in accordance with an exception in §248.14 or §248.15, such as in the ordinary course of business to your attorneys, accountants, or auditors.
(c) Information you disclose under an exception. If you disclose nonpublic personal information to a nonaffiliated third party under an exception in §248.14 or §248.15, the third party may disclose and use that information only as follows:
(3) The third party may disclose and use the information pursuant to an exception in §248.14 or §248.15 in the ordinary course of business to carry out the activity covered by the exception under which it received the information.
(d) Information you disclose outside of an exception. If you disclose nonpublic personal information to a nonaffiliated third party other than under an exception in §248.14 or §248.15, the third party may disclose the information only:
(c) Example—Account number. An account number, or similar form of access number or access code, does not include a number or code in an encrypted form, as long as you do not provide the recipient with a means to decode the number or code.
(a) General rule. (1) The opt out requirements in §§248.7 and 248.10 do not apply when you provide nonpublic personal information to a nonaffiliated third party to perform services for you or functions on your behalf, if you:
(i) Provide the initial notice in accordance with §248.4; and
(ii) Enter into a contractual agreement with the third party that prohibits the third party from disclosing or using the information other than to carry out the purposes for which you disclosed the information, including use under an exception in §248.14 or §248.15 in the ordinary course of business to carry out those purposes.
(2) Example. If you disclose nonpublic personal information under this section to a financial institution with which you perform joint marketing, your contractual agreement with that institution meets the requirements of paragraph (a)(1)(ii) of this section if it prohibits the institution from disclosing or using the nonpublic personal information except as necessary to carry out the joint marketing or under an exception in §248.14 or §248.15 in the ordinary course of business to carry out that joint marketing.
(a) Exceptions for processing and servicing transactions at consumer's request. The requirements for initial notice in §248.4(a)(2), for the opt out in §§248.7 and 248.10, and for initial notice in §248.13 in connection with service providers and joint marketing, do not apply if you disclose nonpublic personal information as necessary to effect, administer, or enforce a transaction that a consumer requests or authorizes, or in connection with:
(1) Processing or servicing a financial product or service that a consumer requests or authorizes;
(a) Exceptions to notice and opt out requirements. The requirements for initial notice in §248.4(a)(2), for the opt out in §§248.7 and 248.10, and for initial notice in §248.13 in connection with service providers and joint marketing do not apply when you disclose nonpublic personal information:
(2) A consumer may revoke consent by subsequently exercising the right to opt out of future disclosures of nonpublic personal information as permitted under §248.7(f).
Nothing in this subpart shall be construed to modify, limit, or supersede the operation of the Fair Credit Reporting Act (15 U.S.C. 1681 et seq.), and no inference shall be drawn on the basis of the provisions of this subpart regarding whether information is transaction or experience information under section 603 of that Act.
(a) In general. This subpart shall not be construed as superseding, altering, or affecting any statute, regulation, order, or interpretation in effect in any State, except to the extent that such State statute, regulation, order, or interpretation is inconsistent with the provisions of this subpart, and then only to the extent of the inconsistency.
(b) Greater protection under State law. For purposes of this section, a State statute, regulation, order, or interpretation is not inconsistent with the provisions of this subpart if the protection such statute, regulation, order, or interpretation affords any consumer is greater than the protection provided under this subpart, as determined by the Federal Trade Commission, after consultation with the Commission, on the Federal Trade Commission's own motion, or upon the petition of any interested party.
(a) Effective date. This subpart is effective November 13, 2000. In order to provide sufficient time for you to establish policies and systems to comply with the requirements of this subpart, the compliance date for this subpart is July 1, 2001.
(b)(1) Notice requirement for consumers who are your customers on the compliance date. By July 1, 2001, you must have provided an initial notice, as required by §248.4, to consumers who are your customers on July 1, 2001.
(c) Two-year grandfathering of service agreements. Until July 1, 2002, a contract that you have entered into with a nonaffiliated third party to perform services for you or functions on your behalf satisfies the provisions of §248.13(a)(2), even if the contract does not include a requirement that the third party maintain the confidentiality of nonpublic personal information, as long as you entered into the agreement on or before July 1, 2000.
A. Any person may view and print this form at: http://www.sec.gov/about/forms/secforms.htm.
B. Use of Form S-P by brokers, dealers, and investment companies, and investment advisers registered with the Commission constitutes compliance with the notice content requirements of §§248.6 and 248.7 of this part.
(a) The model form may be used, at the option of a financial institution, including a group of financial institutions that use a common privacy notice, to meet the content requirements of the privacy notice and opt-out notice set forth in §§248.6 and 248.7 of this part.
(d) Specific disclosures and corresponding legal provisions. (1) For our everyday business purposes. This reason incorporates sharing information under §§248.14 and 248.15 and with service providers pursuant to §248.13 of this part other than the purposes specified in paragraphs C.2(d)(2) or C.2(d)(3) of these Instructions.
(2) For our marketing purposes. This reason incorporates sharing information with service providers by an institution for its own marketing pursuant to §248.13 of this part. An institution that shares for this reason may choose to provide an opt-out.
(3) For joint marketing with other financial companies. This reason incorporates sharing information under joint marketing agreements between two or more financial institutions and with any service provider used in connection with such agreements pursuant to §248.13 of this part. An institution that shares for this reason may choose to provide an opt-out.
(6) For our affiliates to market to you. This reason incorporates sharing information specified in section 624 of the FCRA. This reason may be omitted from the disclosure table when: the institution does not have affiliates (or does not disclose personal information to its affiliates); the institution's affiliates do not use personal information in a manner that requires an opt-out; or the institution provides the affiliate marketing notice separately. Institutions that include this reason must provide an opt-out of indefinite duration. An institution that is required to provide an affiliate marketing opt-out, but does not include that opt-out in the model form under this part, must comply with section 624 of the FCRA and 17 CFR part 248, subpart B, with respect to the initial notice and opt-out and any subsequent renewal notice and opt-out. An institution not required to provide an opt-out under this subparagraph may elect to include this reason in the model form.
(7) For nonaffiliates to market to you. This reason incorporates sharing described in §§248.7 and 248.10(a) of this part. An institution that shares personal information for this reason must provide an opt-out.
(4) Nonaffiliate opt-out. If the financial institution shares personal information pursuant to §248.10(a) of this part, it must include in the mail-in opt-out form the following statement: “☐ Do not share my personal information with nonaffiliates to market their products and services to me.”
(1) “Who is providing this notice?” This question may be omitted where only one financial institution provides the model form and that institution is clearly identified in the title on page one. Two or more financial institutions that jointly provide the model form must use this question to identify themselves as required by §248.9(f) of this part. Where the list of institutions exceeds four (4) lines, the institution must describe in the response to this question the general types of institutions jointly providing the notice and must separately identify those institutions, in minimum 8-point font, directly following the “Other important information” box, or, if that box is not included in the institution's form, directly following the “Definitions.” The list may appear in a multi-column format.
(1) Affiliates. As required by §248.6(a)(3) of this part, where [affiliate information] appears, the financial institution must:
(iii) If it shares with its affiliates, state, as applicable: “Our affiliates include companies with a [common corporate identity of financial institution] name; financial companies such as [insert illustrative list of companies]; nonfinancial companies, such as [insert illustrative list of companies] and others, such as [insert illustrative list].”
(2) Nonaffiliates. As required by §248.6(c)(3) of this part, where [nonaffiliate information] appears, the financial institution must:
(i) If it does not share with nonaffiliated third parties, state: “[name of financial institution] does not share with nonaffiliates so they can market to you;” or
(3) Joint Marketing. As required by §248.13 of this part, where [joint marketing] appears, the financial institution must:
(i) If it does not engage in joint marketing, state: “[name of financial institution] doesn't jointly market;” or
Source: 74 FR 40431, Aug. 11, 2009, unless otherwise noted.
(a) Purpose. The purpose of this subpart is to implement section 624 of the Fair Credit Reporting Act, 15 U.S.C. 1681, et seq. (“FCRA”). Section 624, which was added to the FCRA by section 214 of the Fair and Accurate Credit Transactions Act of 2003, Public Law 108-159, 117 Stat. 1952 (2003) (“FACT Act” or “Act”), regulates the use of consumer information received from an affiliate to make marketing solicitations.
(b) Scope. This subpart applies to any broker or dealer other than a notice-registered broker or dealer, to any investment company, and to any investment adviser or transfer agent registered with the Commission. These entities are referred to in this subpart as “you.”
The examples in this subpart are not exclusive. The examples in this subpart provide guidance concerning the rules' application in ordinary circumstances. The facts and circumstances of each individual situation, however, will determine whether compliance with an example, to the extent applicable, constitutes compliance with this subpart. Examples in a paragraph illustrate only the issue described in the paragraph and do not illustrate any other issue that may arise under this subpart. Similarly, the examples do not illustrate any issues that may arise under other laws or regulations.
(a) Affiliate of a broker, dealer, or investment company, or an investment adviser or transfer agent registered with the Commission means any person that is related by common ownership or common control with the broker, dealer, or investment company, or the investment adviser or transfer agent registered with the Commission. In addition, a broker, dealer, or investment company, or an investment adviser or transfer agent registered with the Commission will be deemed an affiliate of a company for purposes of this subpart if:
(1) That company is regulated under section 214 of the FACT Act, Public Law 108-159, 117 Stat. 1952 (2003), by a government regulator other than the Commission; and
(2) Rules adopted by the other government regulator under section 214 of the FACT Act treat the broker, dealer, or investment company, or investment adviser or transfer agent registered with the Commission as an affiliate of that company.
(b) Broker has the same meaning as in section 3(a)(4) of the Securities Exchange Act of 1934 (15 U.S.C. 78c(a)(4)). A “broker” does not include a broker registered by notice with the Commission under section 15(b)(11) of the Securities Exchange Act of 1934 (15 U.S.C. 78o(b)(11)).
(c) Clear and conspicuous means reasonably understandable and designed to call attention to the nature and significance of the information presented.
(d) Commission means the Securities and Exchange Commission.
(f) Concise—(1) In general. The term “concise” means a reasonably brief expression or statement.
(o) Marketing solicitation—(1) In general. The term “marketing solicitation” means the marketing of a product or service initiated by a person to a particular consumer that is:
(q) Pre-existing business relationship—(1) In general. The term “pre-existing business relationship” means a relationship between a person, or a person's licensed agent, and a consumer based on:
(2) Examples of pre-existing business relationships. (i) If a consumer has a brokerage account with a broker-dealer that is currently in force, the broker-dealer has a pre-existing business relationship with the consumer and can use eligibility information it receives from its affiliates to make solicitations to the consumer about its products or services.
(3) Examples where no pre-existing business relationship is created. (i) If a consumer makes a telephone call to a centralized call center for a group of affiliated companies to inquire about the consumer's existing account at a broker-dealer, the call does not constitute an inquiry to any affiliate other than the broker-dealer that holds the consumer's account and does not establish a pre-existing business relationship between the consumer and any affiliate of the account-holding broker-dealer.
(r) Transfer agent has the same meaning as in section 3(a)(25) of the Securities Exchange Act of 1934 (15 U.S.C. 78c(a)(25)).
(s) You means:
(1) Any broker or dealer other than a broker or dealer registered by notice with the Commission under section 15(b)(11) of the Securities Exchange Act of 1934 (15 U.S.C. 78o(b)(11));
(2) Any investment company;
(3) Any investment adviser registered with the Commission under the Investment Advisers Act of 1940 (15 U.S.C. 80b-1, et seq.); and
(4) Any transfer agent registered with the Commission under section 17A of the Securities Exchange Act of 1934 (15 U.S.C. 78q-1).
(a) Initial notice and opt out requirement—(1) In general. You may not use eligibility information about a consumer that you receive from an affiliate to make a marketing solicitation to the consumer, unless:
(2) Example. A consumer has a brokerage account with a broker-dealer. The broker-dealer furnishes eligibility information about the consumer to its affiliated investment adviser. Based on that eligibility information, the investment adviser wants to make a marketing solicitation to the consumer about its discretionary advisory accounts. The investment adviser does not have a pre-existing business relationship with the consumer and none of the other exceptions apply. The investment adviser is prohibited from using eligibility information received from its broker-dealer affiliate to make marketing solicitations to the consumer about its discretionary advisory accounts unless the consumer is given a notice and opportunity to opt out and the consumer does not opt out.
(b) Making marketing solicitations—(1) In general. For purposes of this subpart, you make a marketing solicitation if:
(3) Receipt or use of eligibility information by your service provider. Except as provided in paragraph (b)(5) of this section, you receive or use an affiliate's eligibility information if a service provider acting on your behalf (whether an affiliate or a nonaffiliated third party) receives or uses that information in the manner described in paragraph (b)(1)(i) or (b)(1)(ii) of this section. All relevant facts and circumstances will determine whether a person is acting as your service provider when it receives or uses an affiliate's eligibility information in connection with marketing your products and services.
(4) Use by an affiliate of its own eligibility information. Unless you have used eligibility information that you receive from an affiliate in the manner described in paragraph (b)(1)(ii) of this section, you do not make a marketing solicitation subject to this subpart if your affiliate:
(5) Use of eligibility information by a service provider—(i) In general. You do not make a marketing solicitation subject to this subpart if a service provider (including an affiliated or third-party service provider that maintains or accesses a common database that you may access) receives eligibility information from your affiliate that your affiliate obtained in connection with a pre-existing business relationship it has or had with the consumer and uses that eligibility information to market your products or services to that affiliate's consumer, so long as:
(6) Examples of making marketing solicitations. (i) A consumer has an investment advisory contract with a registered investment adviser that is affiliated with a broker-dealer. The broker-dealer receives eligibility information about the consumer from the investment adviser. The broker-dealer uses that eligibility information to identify the consumer to receive a marketing solicitation about brokerage products and services, and, as a result, the broker-dealer provides a marketing solicitation to the consumer about its brokerage services. Pursuant to paragraph (b)(1) of this section, the broker-dealer has made a marketing solicitation to the consumer.
(d) Examples of exceptions—(1) Example of the pre-existing business relationship exception. A consumer has a brokerage account with a broker-dealer. The consumer also has a deposit account with the broker-dealer's affiliated depository institution. The broker-dealer receives eligibility information about the consumer from its depository institution affiliate and uses that information to make a marketing solicitation to the consumer about the broker-dealer's college savings accounts. The broker-dealer may make this marketing solicitation even if the consumer has not been given a notice and opportunity to opt out because the broker-dealer has a pre-existing business relationship with the consumer.
(2) Examples of service provider exception. (i) A consumer has a brokerage account with a broker-dealer. The broker-dealer furnishes eligibility information about the consumer to its affiliate, a registered investment adviser. Based on that eligibility information, the investment adviser wants to make a marketing solicitation to the consumer about its advisory services. The investment adviser does not have a pre-existing business relationship with the consumer and none of the other exceptions in paragraph (c) of this section apply. The consumer has been given an opt out notice and has elected to opt out of receiving such marketing solicitations. The investment adviser asks a service provider to send the marketing solicitation to the consumer on its behalf. The service provider may not send the marketing solicitation on behalf of the investment adviser because, as a result of the consumer's opt out election, the investment adviser is not permitted to make the marketing solicitation.
(3) Examples of consumer-initiated communications. (i) A consumer who is the record owner of shares in an investment company initiates a communication with an affiliated registered investment adviser about advisory services. The affiliated investment adviser may use eligibility information about the consumer it obtains from the investment company or any other affiliate to make marketing solicitations regarding the affiliated investment adviser's services in response to the consumer-initiated communication.
(4) Examples of consumer authorization or request for marketing solicitations. (i) A consumer who has a brokerage account with a broker-dealer authorizes or requests information about life insurance offered by the broker-dealer's insurance affiliate. The authorization or request, whether given to the broker-dealer or the insurance affiliate, would permit the insurance affiliate to use eligibility information about the consumer it obtains from the broker-dealer or any other affiliate to make marketing solicitations to the consumer about life insurance.
(e) Relation to affiliate-sharing notice and opt out. Nothing in this subpart limits the responsibility of a person to comply with the notice and opt out provisions of Section 603(d)(2)(A)(iii) of the FCRA (15 U.S.C. 1681a(d)(2)(A)(iii)) where applicable.
(a) Scope of opt out—(1) In general. Except as otherwise provided in this section, the consumer's election to opt out prohibits any affiliate covered by the opt out notice from using eligibility information received from another affiliate as described in the notice to make marketing solicitations to the consumer.
(2) Continuing relationship—(i) In general. If the consumer establishes a continuing relationship with you or your affiliate, an opt out notice may apply to eligibility information obtained in connection with:
(A) A single continuing relationship or multiple continuing relationships that the consumer establishes with you or your affiliates, including continuing relationships established subsequent to delivery of the opt out notice, so long as the notice adequately describes the continuing relationships covered by the opt out; or
(A) Opens a brokerage account or enters into an advisory contract with you or your affiliate;
(C) Purchases investment company shares in his or her own name;
(D) Holds an investment through you or your affiliate; such as when you act or your affiliate acts as a custodian for securities or for assets in an individual retirement arrangement;
(3) No continuing relationship—(i) In general. If there is no continuing relationship between a consumer and you or your affiliate, and you or your affiliate obtain eligibility information about a consumer in connection with a transaction with the consumer, such as an isolated transaction or an application that is denied, an opt out notice provided to the consumer only applies to eligibility information obtained in connection with that transaction.
(B) A broker-dealer opens a brokerage account for the consumer solely for the purpose of liquidating or purchasing securities as an accommodation, i.e., on a one-time basis, without the expectation of engaging in other transactions.
(4) Menu of alternatives. A consumer may be given the opportunity to choose from a menu of alternatives when electing to prohibit solicitations, such as by electing to prohibit solicitations from certain types of affiliates covered by the opt out notice but not other types of affiliates covered by the notice, electing to prohibit marketing solicitations based on certain types of eligibility information but not other types of eligibility information, or electing to prohibit marketing solicitations by certain methods of delivery but not other methods of delivery. However, one of the alternatives must allow the consumer to prohibit all marketing solicitations from all of the affiliates that are covered by the notice.
(5) Special rule for a notice following termination of all continuing relationships—(i) In general. A consumer must be given a new opt out notice if, after all continuing relationships with you or your affiliate(s) are terminated, the consumer subsequently establishes another continuing relationship with you or your affiliate(s) and the consumer's eligibility information is to be used to make a marketing solicitation. The new opt out notice must apply, at a minimum, to eligibility information obtained in connection with the new continuing relationship. Consistent with paragraph (b) of this section, the consumer's decision not to opt out after receiving the new opt out notice would not override a prior opt out election by the consumer that applies to eligibility information obtained in connection with a terminated relationship, regardless of whether the new opt out notice applies to eligibility information obtained in connection with the terminated relationship.
(ii) Example. A consumer has an advisory contract with a company that is registered with the Commission as both a broker-dealer and an investment adviser, and that is part of an affiliated group. The consumer terminates the advisory contract. One year after terminating the advisory contract, the consumer opens a brokerage account with the same company. The consumer must be given a new notice and opportunity to opt out before the company's affiliates may make marketing solicitations to the consumer using eligibility information obtained by the company in connection with the new brokerage account relationship, regardless of whether the consumer opted out in connection with the advisory contract.
(b) Duration of opt out. The election of a consumer to opt out must be effective for a period of at least five years (the “opt out period”) beginning when the consumer's opt out election is received and implemented, unless the consumer subsequently revokes the opt out in writing or, if the consumer agrees, electronically. An opt out period of more than five years may be established, including an opt out period that does not expire unless revoked by the consumer.
(c) Time of opt out. A consumer may opt out at any time.
(a) Contents of opt out notice—(1) In general. A notice must be clear, conspicuous, and concise, and must accurately disclose:
(i) The name of the affiliate(s) providing the notice. If the notice is provided jointly by multiple affiliates and each affiliate shares a common name, such as “ABC,” then the notice may indicate that it is being provided by multiple companies with the ABC name or multiple companies in the ABC group or family of companies, for example, by stating that the notice is provided by “all of the ABC companies,” “the ABC banking, credit card, insurance, and securities companies,” or by listing the name of each affiliate providing the notice. But if the affiliates providing the joint notice do not all share a common name, then the notice must either separately identify each affiliate by name or identify each of the common names used by those affiliates, for example, by stating that the notice is provided by “all of the ABC and XYZ companies” or by “the ABC bank and securities companies and the XYZ insurance companies”;
(ii) A list of the affiliates or types of affiliates whose use of eligibility information is covered by the notice, which may include companies that become affiliates after the notice is provided to the consumer. If each affiliate covered by the notice shares a common name, such as “ABC,” then the notice may indicate that it applies to multiple companies with the ABC name or multiple companies in the ABC group or family of companies, for example, by stating that the notice is provided by “all of the ABC companies,” “the ABC banking, credit card, insurance, and securities companies,” or by listing the name of each affiliate providing the notice. But if the affiliates covered by the notice do not all share a common name, then the notice must either separately identify each covered affiliate by name or identify each of the common names used by those affiliates, for example, by stating that the notice applies to “all of the ABC and XYZ companies” or to “the ABC banking and securities companies and the XYZ insurance companies”;
(iii) A general description of the types of eligibility information that may be used to make marketing solicitations to the consumer;
(iv) That the consumer may elect to limit the use of eligibility information to make marketing solicitations to the consumer;
(vi) If the notice is provided to consumers who may have previously opted out, such as if a notice is provided to consumers annually, that the consumer who has chosen to limit marketing solicitations does not need to act again until the consumer receives a renewal notice; and
(2) Joint relationships. (i) If two or more consumers jointly obtain a product or service, a single opt out notice may be provided to the joint consumers. Any of the joint consumers may exercise the right to opt out.
(ii) The opt out notice must explain how an opt out direction by a joint consumer will be treated. An opt out direction by a joint consumer may be treated as applying to all of the associated joint consumers, or each joint consumer may be permitted to opt out separately. If each joint consumer is permitted to opt out separately, one of the joint consumers must be permitted to opt out on behalf of all of the joint consumers and the joint consumers must be permitted to exercise their separate rights to opt out in a single response.
(iii) It is impermissible to require all joint consumers to opt out before implementing any opt out direction.
(3) Alternative contents. If the consumer is afforded a broader right to opt out of receiving marketing than is required by this subpart, the requirements of this section may be satisfied by providing the consumer with a clear, conspicuous, and concise notice that accurately discloses the consumer's opt out rights.
(4) Model notices. Model notices are provided in the Appendix to this subpart.
(b) Coordinated and consolidated notices. A notice required by this subpart may be coordinated and consolidated with any other notice or disclosure required to be issued under any other provision of law by the entity providing the notice, including but not limited to the notice described in section 603(d)(2)(A)(iii) of the FCRA (15 U.S.C. 1681a(d)(2)(A)(iii)) and the GLBA privacy notice.
(a) In general. You must not use eligibility information that you receive from an affiliate to make marketing solicitations to a consumer about your products or services unless the consumer is provided a reasonable opportunity to opt out, as required by §248.121(a)(1)(ii).
(1) By mail. The opt out notice is mailed to the consumer. The consumer is given 30 days from the date the notice is mailed to elect to opt out by any reasonable means.
(2) By electronic means. (i) The opt out notice is provided electronically to the consumer, such as by posting the notice at an Internet Web site at which the consumer has obtained a product or service. The consumer acknowledges receipt of the electronic notice. The consumer is given 30 days after the date the consumer acknowledges receipt to elect to opt out by any reasonable means.
(ii) The opt out notice is provided to the consumer by e-mail where the consumer has agreed to receive disclosures by e-mail from the person sending the notice. The consumer is given 30 days after the e-mail is sent to elect to opt out by any reasonable means.
(3) At the time of an electronic transaction. The opt out notice is provided to the consumer at the time of an electronic transaction, such as a transaction conducted on an Internet Web site. The consumer is required to decide, as a necessary part of proceeding with the transaction, whether to opt out before completing the transaction. There is a simple process that the consumer may use to opt out at that time using the same mechanism through which the transaction is conducted.
(4) At the time of an in-person transaction. The opt out notice is provided to the consumer in writing at the time of an in-person transaction. The consumer is required to decide, as a necessary part of proceeding with the transaction, whether to opt out before completing the transaction, and is not permitted to complete the transaction without making a choice. There is a simple process that the consumer may use during the course of the in-person transaction to opt out, such as completing a form that requires consumers to write a “yes” or “no” to indicate their opt out preference or that requires the consumer to check one of two blank check boxes—one that allows consumers to indicate that they want to opt out and one that allows consumers to indicate that they do not want to opt out.
(5) By including in a privacy notice. The opt out notice is included in a GLBA privacy notice. The consumer is allowed to exercise the opt out within a reasonable period of time and in the same manner as the opt out under that privacy notice.
(a) In general. You must not use eligibility information about a consumer that you receive from an affiliate to make a marketing solicitation to the consumer about your products or services, unless the consumer is provided a reasonable and simple method to opt out, as required by §248.121(a)(1)(ii).
(b) Examples—(1) Reasonable and simple opt out methods. Reasonable and simple methods for exercising the opt out right include:
(i) Designating a check-off box in a prominent position on the opt out form;
(ii) Including a reply form and a self-addressed envelope together with the opt out notice;
(v) Allowing consumers to exercise all of their opt out rights described in a consolidated opt out notice that includes the GLBA privacy, FCRA affiliate sharing, and FCRA affiliate marketing opt outs, by a single method, such as by calling a single toll-free telephone number.
(2) Opt out methods that are not reasonable and simple. Reasonable and simple methods for exercising an opt out right do not include:
(ii) Requiring the consumer to call or write to obtain a form for opting out, rather than including the form with the opt out notice; or
(iii) Requiring the consumer who receives the opt out notice in electronic form only, such as through posting at an Internet Web site, to opt out solely by paper mail or by visiting a different Web site without providing a link to that site.
(c) Specific opt out means. Each consumer may be required to opt out through a specific means, as long as that means is reasonable and simple for that consumer.
(a) In general. The opt out notice must be provided so that each consumer can reasonably be expected to receive actual notice. For opt out notices provided electronically, the notice may be provided in compliance with either the electronic disclosure provisions in this subpart or the provisions in section 101 of the Electronic Signatures in Global and National Commerce Act, 15 U.S.C. 7001, et seq.
(3) Provides a notice by e-mail to a consumer who has agreed to receive electronic disclosures by e-mail from the affiliate providing the notice; or
(4) Posts the notice on the Internet Web site at which the consumer obtained a product or service electronically and requires the consumer to acknowledge receipt of the notice.
(2) Sends the notice by e-mail to a consumer who has not agreed to receive electronic disclosures by e-mail from the affiliate providing the notice; or
(3) Posts the notice on an Internet Web site without requiring the consumer to acknowledge receipt of the notice.
(a) Renewal notice and opt out requirement—(1) In general. After the opt out period expires, you may not make marketing solicitations to a consumer who previously opted out, unless:
(i) The consumer has been given a renewal notice that complies with the requirements of this section and §§248.124 through 248.126, and a reasonable opportunity and a reasonable and simple method to renew the opt out, and the consumer does not renew the opt out; or
(ii) An exception in §248.121(c) applies.
(2) Renewal period. Each opt out renewal must be effective for a period of at least five years as provided in §248.122(b).
(i) By the affiliate that provided the previous opt out notice, or its successor; or
(ii) As part of a joint renewal notice from two or more members of an affiliated group of companies, or their successors, that jointly provided the previous opt out notice.
(d) No effect on opt out period. An opt out period may not be shortened by sending a renewal notice to the consumer before expiration of the opt out period, even if the consumer does not renew the opt out.
(a) Effective date. This subpart is effective September 10, 2009.
(b) Mandatory compliance date. Compliance with this subpart is required not later than January 1, 2010.
(c) Prospective application. The provisions of this subpart do not prohibit you from using eligibility information that you receive from an affiliate to make a marketing solicitation to a consumer if you receive such information prior to January 1, 2010. For purposes of this section, you are deemed to receive eligibility information when such information is placed into a common database and is accessible by you.
10. Adding disclosures regarding the treatment of opt-outs by joint consumers to comply with §248.123(a)(2), if applicable.
Source: 78 FR 23663, Apr. 17, 2013, unless otherwise noted.
(a) Scope. This section applies to a financial institution or creditor, as defined in the Fair Credit Reporting Act (15 U.S.C. 1681), that is:
(1) A broker, dealer or any other person that is registered or required to be registered under the Securities Exchange Act of 1934;
(2) An investment company that is registered or required to be registered under the Investment Company Act of 1940, that has elected to be regulated as a business development company under that Act, or that operates as an employees' securities company under that Act; or
(3) An investment adviser that is registered or required to be registered under the Investment Advisers Act of 1940.
(b) Definitions. For purposes of this subpart, and Appendix A of this subpart, the following definitions apply:
(1) Account means a continuing relationship established by a person with a financial institution or creditor to obtain a product or service for personal, family, household or business purposes. Account includes a brokerage account, a mutual fund account (i.e., an account with an open-end investment company), and an investment advisory account.
(i) In the case of a branch or agency of a foreign financial institution or creditor, the managing official of that branch or agency; and
(ii) In the case of a financial institution or creditor that does not have a board of directors, a designated employee at the level of senior management.
(i) An account that a financial institution or creditor offers or maintains, primarily for personal, family, or household purposes, that involves or is designed to permit multiple payments or transactions, such as a brokerage account with a broker-dealer or an account maintained by a mutual fund (or its agent) that permits wire transfers or other payments to third parties; and
(8) Identifying information means any name or number that may be used, alone or in conjunction with any other information, to identify a specific person, including any—
(iv) Telecommunication identifying information or access device (as defined in 18 U.S.C. 1029(e)).
(9) Identity theft means a fraud committed or attempted using the identifying information of another person without authority.
(12) Other definitions.
(i) Broker has the same meaning as in section 3(a)(4) of the Securities Exchange Act of 1934 (15 U.S.C. 78c(a)(4)).
(ii) Commission means the Securities and Exchange Commission.
(iii) Dealer has the same meaning as in section 3(a)(5) of the Securities Exchange Act of 1934 (15 U.S.C. 78c(a)(5)).
(iv) Investment adviser has the same meaning as in section 202(a)(11) of the Investment Advisers Act of 1940 (15 U.S.C. 80b-2(a)(11)).
(v) Investment company has the same meaning as in section 3 of the Investment Company Act of 1940 (15 U.S.C. 80a-3), and includes a separate series of the investment company.
(vi) Other terms not defined in this subpart have the same meaning as in the Fair Credit Reporting Act (15 U.S.C. 1681 et seq.).
(1) Program requirement. Each financial institution or creditor that offers or maintains one or more covered accounts must develop and implement a written Identity Theft Prevention Program (Program) that is designed to detect, prevent, and mitigate identity theft in connection with the opening of a covered account or any existing covered account. The Program must be appropriate to the size and complexity of the financial institution or creditor and the nature and scope of its activities.
(f) Guidelines. Each financial institution or creditor that is required to implement a Program must consider the guidelines in Appendix A to this subpart and include in its Program those guidelines that are appropriate.
(a) Scope. This section applies to a person described in §248.201(a) that issues a credit or debit card (card issuer).
(1) Cardholder means a consumer who has been issued a credit card or debit card as defined in 15 U.S.C. 1681a(r).
(3) Other terms not defined in this subpart have the same meaning as in the Fair Credit Reporting Act (15 U.S.C. 1681 et seq.).
(c) Address validation requirements. A card issuer must establish and implement reasonable written policies and procedures to assess the validity of a change of address if it receives notification of a change of address for a consumer's debit or credit card account and, within a short period of time afterwards (during at least the first 30 days after it receives such notification), the card issuer receives a request for an additional or replacement card for the same account. Under these circumstances, the card issuer may not issue an additional or replacement card, until, in accordance with its reasonable policies and procedures and for the purpose of assessing the validity of the change of address, the card issuer:
(2) Otherwise assesses the validity of the change of address in accordance with the policies and procedures the card issuer has established pursuant to §248.201.
(e) Form of notice. Any written or electronic notice that the card issuer provides under this paragraph must be clear and conspicuous and be provided separately from its regular correspondence with the cardholder.
Section 248.201 requires each financial institution and creditor that offers or maintains one or more covered accounts, as defined in §248.201(b)(3), to develop and provide for the continued administration of a written Program to detect, prevent, and mitigate identity theft in connection with the opening of a covered account or any existing covered account. These guidelines are intended to assist financial institutions and creditors in the formulation and maintenance of a Program that satisfies the requirements of §248.201.
(3) Applicable regulatory guidance.
(a) Obtaining identifying information about, and verifying the identity of, a person opening a covered account, for example, using the policies and procedures regarding identification and verification set forth in the Customer Identification Program rules implementing 31 U.S.C. 5318(l) (31 CFR 1023.220 (broker-dealers) and 1024.220 (mutual funds)); and
The Program's policies and procedures should provide for appropriate responses to the Red Flags the financial institution or creditor has detected that are commensurate with the degree of risk posed. In determining an appropriate response, a financial institution or creditor should consider aggravating factors that may heighten the risk of identity theft, such as a data security incident that results in unauthorized access to a customer's account records held by the financial institution, creditor, or third party, or notice that a customer has provided information related to a covered account held by the financial institution or creditor to someone fraudulently claiming to represent the financial institution or creditor or to a fraudulent Web site. Appropriate responses may include the following:
(2) Reviewing reports prepared by staff regarding compliance by the financial institution or creditor with §248.201; and
(b) Reports. (1) In general. Staff of the financial institution or creditor responsible for development, implementation, and administration of its Program should report to the board of directors, an appropriate committee of the board, or a designated employee at the level of senior management, at least annually, on compliance by the financial institution or creditor with §248.201.
3. A consumer reporting agency provides a notice of address discrepancy, as referenced in Sec. 605(h) of the Fair Credit Reporting Act (15 U.S.C. 1681c(h)).
19. Shortly following the notice of a change of address for a covered account, the institution or creditor receives a request for a new, additional, or replacement means of accessing the account or for the addition of an authorized user on the account.
20. A covered account is used in a manner that is not consistent with established patterns of activity on the account. There is, for example:
c. A material change in purchasing or spending patterns; or
d. A material change in electronic fund transfer patterns in connection with a deposit account.
21. A covered account that has been inactive for a reasonably lengthy period of time is used (taking into consideration the type of account, the expected pattern of usage and other relevant factors).
22. Mail sent to the customer is returned repeatedly as undeliverable although transactions continue to be conducted in connection with the customer's covered account.
23. The financial institution or creditor is notified that the customer is not receiving paper account statements.
24. The financial institution or creditor is notified of unauthorized charges or transactions in connection with a customer's covered account.
25. The financial institution or creditor is notified by a customer, a victim of identity theft, a law enforcement authority, or any other person that it has opened a fraudulent account for a person engaged in identity theft.