Source: https://www.ecfr.gov/cgi-bin/text-idx?mc=true&node=pt12.5.332&rgn=div5
Timestamp: 2020-08-06 14:09:02
Document Index: 677497103

Matched Legal Cases: ['art 332', 'ART 332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332', '§332']

Title 12 → Chapter III → Subchapter B → Part 332
PART 332—PRIVACY OF CONSUMER FINANCIAL INFORMATION
§332.1 Purpose and scope.
§332.2 Model privacy form and examples.
§332.3 Definitions.
§332.4 Initial privacy notice to consumers required.
§332.5 Annual privacy notice to customers required.
§332.6 Information to be included in privacy notices.
§332.7 Form of opt out notice to consumers; opt out methods.
§332.8 Revised privacy notices.
§332.9 Delivering privacy and opt out notices.
§332.10 Limits on disclosure of non-public personal information to nonaffiliated third parties.
§332.11 Limits on redisclosure and reuse of information.
§332.12 Limits on sharing account number information for marketing purposes.
§332.13 Exception to opt out requirements for service providers and joint marketing.
§332.14 Exceptions to notice and opt out requirements for processing and servicing transactions.
§332.15 Other exceptions to notice and opt out requirements.
Subpart D—Relation to Other Laws; Effective Date
§332.16 Protection of Fair Credit Reporting Act.
§332.17 Relation to State laws.
§332.18 Effective date; transition rule.
Authority: 12 U.S.C. 1819 (Seventh and Tenth); 15 U.S.C. 6801 et seq.
Source: 65 FR 35216, June 1, 2000, unless otherwise noted.
(3) Provides a method for consumers to prevent a financial institution from disclosing that information to most nonaffiliated third parties by “opting out” of that disclosure, subject to the exceptions in §§332.13, 332.14, and 332.15.
(b) Scope. (1) This part applies only to nonpublic personal information about individuals who obtain financial products or services primarily for personal, family, or household purposes from the institutions listed below. This part does not apply to information about companies or about individuals who obtain financial products or services for business, commercial, or agricultural purposes. This part applies to the United States offices of entities for which the Federal Deposit Insurance Corporation (FDIC) has primary federal supervisory authority. They are referred to in this part as “you.” These are: banks insured by the FDIC (other than members of the Federal Reserve System), insured state branches of foreign banks, and certain subsidiaries of such entities.
(2) Nothing in this part modifies, limits, or supersedes the standards governing individually identifiable health information promulgated by the Secretary of Health and Human Services under the authority of sections 262 and 264 of the Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. 1320d-1320d-8).
(a) Model privacy form. Use of the model privacy form in appendix A of this part, consistent with the instructions in appendix A, constitutes compliance with the notice content requirements of §§332.6 and 332.7 of this part, although use of the model privacy form is not required.
[74 FR 62935, Dec. 1, 2009]
(2) Examples—(i) An individual who applies to you for credit for personal, family, or household purposes is a consumer of a financial service, regardless of whether the credit is extended.
(3) The power to exercise, directly or indirectly, a controlling influence over the management or policies of the company, as the FDIC determines.
(2) Examples—(i) Continuing relationship. A consumer has a continuing relationship with you if the consumer:
(k)(1) Financial institution means any institution the business of which is engaging in activities that are financial in nature or incidental to such financial activities as described in section 4(k) of the Bank Holding Company Act of 1956 (12 U.S.C. 1843(k)).
(l)(1) Financial product or service means any product or service that a financial holding company could offer by engaging in an activity that is financial in nature or incidental to such a financial activity under section 4(k) of the Bank Holding Company Act of 1956 (12 U.S.C. 1843(k)).
(2) Nonaffiliated third party includes any company that is an affiliate solely by virtue of your or your affiliate's direct or indirect ownership or control of the company in conducting merchant banking or investment banking activities of the type described in section 4(k)(4)(H) or insurance company investment activities of the type described in section 4(k)(4)(I) of the Bank Holding Company Act of 1956 (12 U.S.C. 1843(k)(4)(H) and (I)).
(3) Examples of lists—(i) Nonpublic personal information includes any list of individuals' names and street addresses that is derived in whole or in part using personally identifiable financial information that is not publicly available, such as account numbers.
(E) Any information that a consumer provides to you or that you or your agent otherwise obtain in connection with collecting on a loan or servicing a loan;
(q) You means:
(1) A bank insured by the FDIC (other than a member of the Federal Reserve System);
(2) An insured state branch of a foreign bank; and
(3) A subsidiary of either such entity except:
(i) A broker or dealer that is registered under the Securities and Exchange Act of 1934 (15 U.S.C. 78a et seq.);
(ii) A registered investment adviser, properly registered by or on behalf of either the Securities Exchange Commission or any State, with respect to its investment advisory activities and its activities incidental to those investment advisory activities;
(iii) An investment company that is registered under the Investment Company Act of 1940 (15 U.S.C. 80a-1 et seq.); or
(iv) An insurance company, with respect to its insurance activities and its activities incidental to those insurance activities, that is subject to supervision by a State insurance regulator.
(2) Consumer. A consumer, before you disclose any nonpublic personal information about the consumer to any nonaffiliated third party, if you make such a disclosure other than as authorized by §§332.14 and 332.15.
(1) You do not disclose any nonpublic personal information about the consumer to any nonaffiliated third party, other than as authorized by §§332.14 and 332.15; and
(2) Special rule for loans. You establish a customer relationship with a consumer when you originate a loan to the consumer for personal, family, or household purposes. If you subsequently transfer the servicing rights to that loan to another financial institution, the customer relationship transfers with the servicing rights.
(3)(i) Examples of establishing customer relationship. You establish a customer relationship when the consumer:
(ii) Examples of loan rule. You establish a customer relationship with a consumer who obtains a loan for personal, family, or household purposes when you:
(1) You may provide a revised privacy notice, under §332.8, that covers the customer's new financial product or service; or
(2) Examples of exceptions—(i) Not at customer's election. Establishing a customer relationship is not at the customer's election if you acquire a customer's deposit liability or the servicing rights to a customer's loan from another financial institution and the customer does not have a choice about your acquisition.
(f) Delivery. When you are required to deliver an initial privacy notice by this section, you must deliver it according to §332.9. If you use a short-form initial notice for non-customers according to §332.6(d), you may deliver your privacy notice according to §332.6(d)(3).
(a)(1) General rule. You must provide a clear and conspicuous notice to customers that accurately reflects your privacy policies and practices not less than annually during the continuation of the customer relationship. Annually means at least once in any period of 12 consecutive months during which that relationship exists. You may define the 12-consecutive-month period, but you must apply it to the customer on a consistent basis.
(2) Examples. Your customer becomes a former customer when:
(c) Special rule for loans. If you do not have a customer relationship with a consumer under the special rule for loans in §332.4(c)(2), then you need not provide an annual notice to that consumer under this section.
(d) Delivery. When you are required to deliver an annual privacy notice by this section, you must deliver it according to §332.9.
(a) General rule. The initial, annual and revised privacy notices that you provide under §§332.4, 332.5, and 332.8 must include each of the following items of information, in addition to any other information you wish to provide, that applies to you and to the consumers to whom you send your privacy notice:
(3) The categories of affiliates and nonaffiliated third parties to whom you disclose nonpublic personal information, other than those parties to whom you disclose information under §§332.14 and 332.15;
(4) The categories of nonpublic personal information about your former customers that you disclose and the categories of affiliates and nonaffiliated third parties to whom you disclose nonpublic personal information about your former customers, other than those parties to whom you disclose information under §§332.14 and 332.15;
(5) If you disclose nonpublic personal information to a nonaffiliated third party under §332.13 (and no other exception in §332.14 or 332.15 applies to that disclosure), a separate statement of the categories of information you disclose and the categories of third parties with whom you have contracted;
(6) An explanation of the consumer's right under §332.10(a) to opt out of the disclosure of nonpublic personal information to nonaffiliated third parties, including the method(s) by which the consumer may exercise that right at that time;
(b) Description of nonaffiliated third parties subject to exceptions. If you disclose nonpublic personal information to third parties as authorized under §§332.14 and 332.15, you are not required to list those exceptions in the initial or annual privacy notices required by §§332.4 and 332.5. When describing the categories with respect to those parties, it is sufficient to state that you make disclosures to other nonaffiliated companies:
(2) Categories of nonpublic personal information you disclose—(i) You satisfy the requirement to categorize the nonpublic personal information that you disclose if you list the categories described in paragraph (c)(1) of this section, as applicable, and a few examples to illustrate the types of information in each category.
(i) Financial service providers;
(ii) Non-financial companies; and
(4) Disclosures under exception for service providers and joint marketers. If you disclose nonpublic personal information under the exception in §332.13 to a nonaffiliated third party to market products or services that you offer alone or jointly with another financial institution, you satisfy the disclosure requirement of paragraph (a)(5) of this section if you:
(5) Simplified notices. If you do not disclose, and do not wish to reserve the right to disclose, nonpublic personal information about customers or former customers to affiliates or nonaffiliated third parties except as authorized under §§332.14 and 332.15, you may simply state that fact, in addition to the information you must provide under paragraphs (a)(1), (a)(8), (a)(9), and (b) of this section.
(d) Short-form initial notice with opt out notice for non-customers—(1) You may satisfy the initial notice requirements in §§332.4(a)(2), 332.7(b), and 332.7(c) for a consumer who is not a customer by providing a short-form initial notice at the same time as you deliver an opt out notice as required in §332.7.
(3) You must deliver your short-form initial notice according to §332.9. You are not required to deliver your privacy notice with your short-form initial notice. You instead may simply provide the consumer a reasonable means to obtain your privacy notice. If a consumer who receives your short-form notice requests your privacy notice, you must deliver your privacy notice according to §332.9.
(f) Model privacy form. Pursuant to §332.2(a) of this part, a model privacy form that meets the notice content requirements of this section is included in appendix A of this part.
[65 FR 35216, June 1, 2000, as amended at 74 FR 62935, Dec. 1, 2009]
(a)(1) Form of opt out notice. If you are required to provide an opt out notice under §332.10(a), you must provide a clear and conspicuous notice to each of your consumers that accurately explains the right to opt out under that section. The notice must state:
(A) Identify all of the categories of nonpublic personal information that you disclose or reserve the right to disclose, and all of the categories of nonaffiliated third parties to which you disclose the information, as described in §332.6(a)(2) and (3), and state that the consumer can opt out of the disclosure of that information; and
(B) Include a reply form together with the opt out notice;
(B) The only means of opting out as described in any notice subsequent to the initial notice is to use a check-off box that you provide with the initial notice but did not include with the subsequent notice.
(b) Same form as initial notice permitted. You may provide the opt out notice together with or on the same written or electronic form as the initial notice you provide in accordance with §332.4.
(c) Initial notice required when opt out notice delivered subsequent to initial notice. If you provide the opt out notice later than required for the initial notice in accordance with §332.4, you must also include a copy of the initial notice with the opt out notice in writing or, if the consumer agrees, electronically.
(d) Joint relationships. (1) If two or more consumers jointly obtain a financial product or service from you, you may provide a single opt out notice. Your opt out notice must explain how you will treat an opt out direction by a joint consumer (as explained in paragraph (d)(5) of this section).
(e) Time to comply with opt out. You must comply with a consumer's opt out direction as soon as reasonably practicable after you receive it.
(g) Duration of consumer's opt out direction. (1) A consumer's direction to opt out under this section is effective until the consumer revokes it in writing or, if the consumer agrees, electronically.
(h) Delivery. When you are required to deliver an opt out notice by this section, you must deliver it according to §332.9.
(i) Model privacy form. Pursuant to §332.2(a) of this part, a model privacy form that meets the notice content requirements of this section is included in Appendix A of this part.
(a) General rule. Except as otherwise authorized in this part, you must not, directly or through any affiliate, disclose any nonpublic personal information about a consumer to a nonaffiliated third party other than as described in the initial notice that you provided to that consumer under §332.4, unless:
(b) Examples—(1) Except as otherwise permitted by §§332.13, 332.14, and 332.15, you must provide a revised notice before you:
(c) Delivery. When you are required to deliver a revised privacy notice by this section, you must deliver it according to §332.9.
(b) (1) Examples of reasonable expectation of actual notice. You may reasonably expect that a consumer will receive actual notice if you:
(iii) For the consumer who conducts transactions electronically, post the notice on the electronic site and require the consumer to acknowledge receipt of the notice as a necessary step to obtaining a particular financial product or service; or
(1) The customer uses your web site to access financial products and services electronically and agrees to receive notices at the web site, and you post your current privacy notice continuously in a clear and conspicuous manner on the web site; or
(e) Retention or accessibility of notices for customers. (1) For customers only, you must provide the initial notice required by §332.4(a)(1), the annual notice required by §332.5(a), and the revised notice required by §332.8 so that the customer can retain them or obtain them later in writing or, if the customer agrees, electronically.
(g) Joint relationships. If two or more consumers jointly obtain a financial product or service from you, you may satisfy the initial, annual, and revised notice requirements of §§332.4(a), 332.5(a), and 332.8(a), respectively, by providing one notice to those consumers jointly.
(a) (1) Conditions for disclosure. Except as otherwise authorized in this part, you may not, directly or through any affiliate, disclose any nonpublic personal information about a consumer to a nonaffiliated third party unless:
(i) You have provided to the consumer an initial notice as required under §332.4;
(ii) You have provided to the consumer an opt out notice as required in §332.7;
(2) Opt out definition. Opt out means a direction by the consumer that you not disclose nonpublic personal information about that consumer to a nonaffiliated third party, other than as permitted by §§332.13, 332.14, and 332.15.
(ii) By electronic means. A customer opens an on-line account with you and agrees to receive the notices required in paragraph (a)(1) of this section electronically, and you allow the customer to opt out by any reasonable means within 30 days after the date that the customer acknowledges receipt of the notices in conjunction with opening the account.
(a)(1) Information you receive under an exception. If you receive nonpublic personal information from a nonaffiliated financial institution under an exception in §332.14 or 332.15 of this part, your disclosure and use of that information is limited as follows:
(iii) You may disclose and use the information pursuant to an exception in §332.14 or 332.15 in the ordinary course of business to carry out the activity covered by the exception under which you received the information.
(2) Example. If you receive a customer list from a nonaffiliated financial institution in order to provide account processing services under the exception in §332.14(a), you may disclose that information under any exception in §332.14 or 332.15 in the ordinary course of business in order to provide those services. For example, you could disclose the information in response to a properly authorized subpoena or to your attorneys, accountants, and auditors. You could not disclose that information to a third party for marketing purposes or use that information for your own marketing purposes.
(b)(1) Information you receive outside of an exception. If you receive nonpublic personal information from a nonaffiliated financial institution other than under an exception in §332.14 or 332.15 of this part, you may disclose the information only:
(2) Example. If you obtain a customer list from a nonaffiliated financial institution outside of the exceptions in §332.14 and 332.15:
(ii) You may disclose that list to another nonaffiliated third party only if the financial institution from which you purchased the list could have lawfully disclosed the list to that third party. That is, you may disclose the list in accordance with the privacy policy of the financial institution from which you received the list, as limited by the opt out direction of each consumer whose nonpublic personal information you intend to disclose, and you may disclose the list in accordance with an exception in §332.14 or 332.15, such as to your attorneys or accountants.
(c) Information you disclose under an exception. If you disclose nonpublic personal information to a nonaffiliated third party under an exception in §332.14 or 332.15 of this part, the third party may disclose and use that information only as follows:
(3) The third party may disclose and use the information pursuant to an exception in §332.14 or 332.15 in the ordinary course of business to carry out the activity covered by the exception under which it received the information.
(d) Information you disclose outside of an exception. If you disclose nonpublic personal information to a nonaffiliated third party other than under an exception in §332.14 or 332.15 of this part, the third party may disclose the information only:
(a) General prohibition on disclosure of account numbers. You must not, directly or through an affiliate, disclose, other than to a consumer reporting agency, an account number or similar form of access number or access code for a consumer's credit card account, deposit account, or transaction account to any nonaffiliated third party for use in telemarketing, direct mail marketing, or other marketing through electronic mail to the consumer.
(2) Transaction account. A transaction account is an account other than a deposit account or a credit card account. A transaction account does not include an account to which third parties cannot initiate charges.
(a) General rule. (1) The opt out requirements in §§332.7 and 332.10 do not apply when you provide nonpublic personal information to a nonaffiliated third party to perform services for you or functions on your behalf, if you:
(i) Provide the initial notice in accordance with §332.4; and
(ii) Enter into a contractual agreement with the third party that prohibits the third party from disclosing or using the information other than to carry out the purposes for which you disclosed the information, including use under an exception in §332.14 or 332.15 in the ordinary course of business to carry out those purposes.
(2) Example. If you disclose nonpublic personal information under this section to a financial institution with which you perform joint marketing, your contractual agreement with that institution meets the requirements of paragraph (a)(1)(ii) of this section if it prohibits the institution from disclosing or using the nonpublic personal information except as necessary to carry out the joint marketing or under an exception in §332.14 or 332.15 in the ordinary course of business to carry out that joint marketing.
(a) Exceptions for processing transactions at consumer's request. The requirements for initial notice in §332.4(a)(2), for the opt out in §§332.7 and 332.10 and for service providers and joint marketing in §332.13 do not apply if you disclose nonpublic personal information as necessary to effect, administer, or enforce a transaction that a consumer requests or authorizes, or in connection with:
(a) Exceptions to opt out requirements. The requirements for initial notice in §332.4(a)(2), for the opt out in §§332.7 and 332.10, and for service providers and joint marketing in §332.13 do not apply when you disclose nonpublic personal information:
(2) (i) To protect the confidentiality or security of your records pertaining to the consumer, service, product, or transaction;
(4) To the extent specifically permitted or required under other provisions of law and in accordance with the Right to Financial Privacy Act of 1978 (12 U.S.C. 3401 et seq.), to law enforcement agencies (including a federal functional regulator, the Secretary of the Treasury, with respect to 31 U.S.C. Chapter 53, Subchapter II (Records and Reports on Monetary Instruments and Transactions) and 12 U.S.C. Chapter 21 (Financial Recordkeeping), a State insurance authority, with respect to any person domiciled in that insurance authority's State that is engaged in providing insurance, and the Federal Trade Commission), self-regulatory organizations, or for an investigation on a matter related to public safety;
(7) (i) To comply with Federal, State, or local laws, rules and other applicable legal requirements;
(2) A consumer may revoke consent by subsequently exercising the right to opt out of future disclosures of nonpublic personal information as permitted under §332.7(f).
(b) Greater protection under State law. For purposes of this section, a State statute, regulation, order, or interpretation is not inconsistent with the provisions of this part if the protection such statute, regulation, order, or interpretation affords any consumer is greater than the protection provided under this part, as determined by the Federal Trade Commission, after consultation with the FDIC, on the Federal Trade Commission's own motion, or upon the petition of any interested party.
(a) Effective date. This part is effective November 13, 2000. In order to provide sufficient time for you to establish policies and systems to comply with the requirements of this part, the FDIC has extended the time for compliance with this part until July 1, 2001.
(b)(1) Notice requirement for consumers who are your customers on the compliance date. By July 1, 2001, you must have provided an initial notice, as required by §332.4, to consumers who are your customers on July 1, 2001.
(c) Two-year grandfathering of service agreements. Until July 1, 2002, a contract that you have entered into with a nonaffiliated third party to perform services for you or functions on your behalf satisfies the provisions of §332.13(a)(1)(ii) of this part, even if the contract does not include a requirement that the third party maintain the confidentiality of nonpublic personal information, as long as you entered into the contract on or before July 1, 2000.
(a) The model form may be used, at the option of a financial institution, including a group of financial institutions that use a common privacy notice, to meet the content requirements of the privacy notice and opt-out notice set forth in §§332.6 and 332.7 of this part.
(b) General instructions for the “What?” box. (1) The bulleted list identifies the types of personal information that the institution collects and shares. All institutions must use the term “Social Security number” in the first bullet.
(d) Specific disclosures and corresponding legal provisions. (1) For our everyday business purposes. This reason incorporates sharing information under §§332.14 and 332.15 and with service providers pursuant to §332.13 of this part other than the purposes specified in paragraphs C.2(d)(2) or C.2(d)(3) of these Instructions.
(2) For our marketing purposes. This reason incorporates sharing information with service providers by an institution for its own marketing pursuant to §332.13 of this part. An institution that shares for this reason may choose to provide an opt-out.
(3) For joint marketing with other financial companies. This reason incorporates sharing information under joint marketing agreements between two or more financial institutions and with any service provider used in connection with such agreements pursuant to §332.13 of this part. An institution that shares for this reason may choose to provide an opt-out.
(7) For nonaffiliates to market to you. This reason incorporates sharing described in §§332.7 and 332.10(a) of this part. An institution that shares personal information for this reason must provide an opt-out.
(1) Joint accountholder. Only institutions that provide their joint accountholders the choice to opt out for only one accountholder, in accordance with paragraph C.3(a)(5) of these Instructions, must include in the far left column of the mail-in form the following statement: “If you have a joint account, your choice(s) will apply to everyone on your account unless you mark below. ☐ Apply my choice(s) only to me.” The word “choice” may be written in either the singular or plural, as appropriate. Financial institutions that provide insurance products or services, provide this option, and elect to use the model form may substitute the word “policy” for “account” in this statement. Institutions that do not provide this option may eliminate this left column from the mail-in form.
(2) FCRA Section 603(d)(2)(A)(iii) opt-out. If the institution shares personal information pursuant to section 603(d)(2)(A)(iii) of the FCRA, it must include in the mail-in opt-out form the following statement: “☐ Do not share information about my creditworthiness with your affiliates for their everyday business purposes.”
(3) FCRA Section 624 opt-out. If the institution incorporates section 624 of the FCRA in accord with paragraph C.2(d)(6) of these Instructions, it must include in the mail-in opt-out form the following statement: “☐ Do not allow your affiliates to use my personal information to market to me.”
(4) Nonaffiliate opt-out. If the financial institution shares personal information pursuant to §332.10(a) of this part, it must include in the mail-in opt-out form the following statement: “☐ Do not share my personal information with nonaffiliates to market their products and services to me.”
(5) Additional opt-outs. Financial institutions that use the disclosure table to provide opt-out options beyond those required by Federal law must provide those opt-outs in this section of the model form. A financial institution that chooses to offer an opt-out for its own marketing in the mail-in opt-out form must include one of the two following statements: “☐ Do not share my personal information to market to me.” or “☐ Do not use my personal information to market to me.” A financial institution that chooses to offer an opt-out for joint marketing must include the following statement: “☐ Do not share my personal information with other financial institutions to jointly market to me.”
(1) “Who is providing this notice?” This question may be omitted where only one financial institution provides the model form and that institution is clearly identified in the title on page one. Two or more financial institutions that jointly provide the model form must use this question to identify themselves as required by §332.9(f) of this part. Where the list of institutions exceeds four (4) lines, the institution must describe in the response to this question the general types of institutions jointly providing the notice and must separately identify those institutions, in minimum 8-point font, directly following the “Other important information” box, or, if that box is not included in the institution's form, directly following the “Definitions.” The list may appear in a multi-column format.
(1) Affiliates. As required by §332.6(a)(3) of this part, where [affiliate information] appears, the financial institution must:
(2) Nonaffiliates. As required by §332.6(c)(3) of this part, where [nonaffiliate information] appears, the financial institution must:
(3) Joint Marketing. As required by §332.13 of this part, where [joint marketing] appears, the financial institution must: