(a) General rule. The
initial, annual, and revised privacy notices that you provide under
sections 1016.4, 1016.5, and 1016.8 of this part must include each
of the following items of information, in addition to any other information
you wish to provide, that applies to you and to the consumers to whom
you send your privacy notice:
(1) The categories of nonpublic personal information that you collect;
(2) The categories of nonpublic personal
information that you disclose;
(3)
The categories of affiliates and nonaffiliated third parties to whom
you disclose nonpublic personal information, other than those parties
to whom you disclose information under sections 1016.14 and 1016.15
of this part;
(4) The categories
of nonpublic personal information about your former customers that
you disclose and the categories of affiliates and nonaffiliated third
parties to whom you disclose nonpublic personal information about
your former customers, other than those parties to whom you disclose
information under sections 1016.14 and 1016.15;
(5) If you disclose nonpublic personal
information to a nonaffiliated third party under section 1016.13 (and
no other exception in section 1016.14 or section 1016.15 applies to
that disclosure), a separate statement of the categories of information
you disclose and the categories of third parties with whom you have
contracted;
(6) An explanation of
the consumer’s right under section 1016.10(a) of this part to opt-out
of the disclosure of nonpublic personal information to nonaffiliated
third parties, including the method(s) by which the consumer may exercise
that right at that time;
(7) Any
disclosures that you make under section 603(d)(2)(A)(iii) of the Fair
Credit Reporting Act (15 U.S.C. 1681a(d)(2)(A)(iii)) (that is, notices
regarding the ability to opt-out of disclosures of information among
affiliates);
(8) Your policies and
practices with respect to protecting the confidentiality and security
of nonpublic personal information; and
(9) Any disclosure that you make under paragraph (b) of this section.
(b) Description of nonaffiliated
third parties subject to exceptions. If you disclose nonpublic
personal information to third parties as authorized under sections
1016.14 and 1016.15, you are not required to list those exceptions
in the initial or annual privacy notices required by sections 1016.4
and 1016.5. When describing the categories with respect to those parties,
it is sufficient to state that you make disclosures to other nonaffiliated
companies:
(1) For your
everyday business purposes, such as [include all that apply] to process
transactions, maintain account(s), respond to court orders and legal
investigations, or report to credit bureaus; or
(2) As permitted by law.
6-7279
(c) Examples.
(1) Categories
of nonpublic personal information that you collect. You satisfy
the requirement to categorize the nonpublic personal information that
you collect if you list the following categories, as applicable:
(i) Information from
the consumer;
(ii) Information
about the consumer’s transactions with you or your affiliates;
(iii) Information about the consumer’s
transactions with nonaffiliated third parties; and
(iv) Information from a consumer reporting
agency.
(2) Categories of nonpublic personal information
you disclose.
(i) You satisfy the requirement to categorize the nonpublic personal
information that you disclose if you list the categories described
in paragraph (c)(1) of this section, as applicable, and a few examples
to illustrate the types of information in each category.
(ii) If you reserve the right to disclose
all of the nonpublic personal information about consumers that you
collect, you may simply state that fact without describing the categories
or examples of the nonpublic personal information you disclose.
(3) Categories of affiliates and nonaffiliated third parties to whom
you disclose. You satisfy the requirement to categorize the affiliates
and nonaffiliated third parties to whom you disclose nonpublic personal
information if you list the following categories, as applicable, and
a few examples to illustrate the types of third parties in each category.
(i) Financial service
providers, followed by illustrative examples such as mortgage bankers,
securities broker-dealers, and insurance agents;
(ii) Non-financial companies, followed
by illustrative examples such as retailers, magazine publishers, airlines,
and direct marketers; and
(iii)
Others, followed by examples such as nonprofit organizations.
6-7280
(4) Disclosures
under exception for service providers and joint marketers. If
you disclose nonpublic personal information under the exception in
section 1016.13 of this part to a nonaffiliated third party to market
products or services that you offer alone or jointly with another
financial institution, you satisfy the disclosure requirement of paragraph
(a)(5) of this section if you:
(i) List the categories of nonpublic
personal information you disclose, using the same categories and examples
you used to meet the requirements of paragraph (a)(2) of this section,
as applicable; and
(ii) State
whether the third party is:
(A) A service provider that performs marketing services on your behalf
or on behalf of you and another financial institution; or
(B) A financial institution with whom you
have a joint marketing agreement.
(5) Simplified
notices. If you do not disclose, and do not wish to reserve the
right to disclose, nonpublic personal information about customers
or former customers to affiliates or nonaffiliated third parties except
as authorized under sections 1016.14 and 1016.15, you may simply state
that fact, in addition to the information you must provide under paragraphs
(a)(1), (a)(8), (a)(9), and (b) of this section.
(6) Confidentiality
and security. You describe your policies and practices with respect
to protecting the confidentiality and security of nonpublic personal
information if you do both of the following:
(i) Describe in general terms who is
authorized to have access to the information; and
(ii) State whether you have security
practices and procedures in place to ensure the confidentiality of
the information in accordance with your policy. You are not required
to describe technical information about the safeguards you use.
6-7281
(d) Short-form initial
notice with opt-out notice for non-customers.
(1) You may satisfy the initial notice
requirements in sections 1016.4(a)(2), 1016.7(b), and 1016.7(c) of
this part for a consumer who is not a customer by providing a short-form
initial notice at the same time as you deliver an opt-out notice as
required in section 1016.7.
(2)
A short-form initial notice must:
(i) Be clear and conspicuous;
(ii) State that your privacy notice
is available upon request; and
(iii) Explain a reasonable means by which the consumer may obtain
that notice.
(3) You
must deliver your short-form initial notice according to section 1016.9.
You are not required to deliver your privacy notice with your short-form
initial notice. You instead may simply provide the consumer a reasonable
means to obtain your privacy notice. If a consumer who receives your
short-form notice requests your privacy notice, you must deliver your
privacy notice according to section 1016.9.
(4) Examples
of obtaining privacy notice. You provide a reasonable means by
which a consumer may obtain a copy of your privacy notice if you:
(i) Provide a toll-free
telephone number that the consumer may call to request the notice;
or
(ii) For a consumer who conducts
business in person at your office, maintain copies of the notice on
hand that you provide to the consumer immediately upon request.
6-7282
(e) Future disclosures. Your notice may include:
(1) Categories of nonpublic personal information
that you reserve the right to disclose in the future, but do not currently
disclose; and
(2) Categories of
affiliates or nonaffiliated third parties to whom you reserve the
right in the future to disclose, but to whom you do not currently
disclose, nonpublic personal information.
(f) Model privacy form. Pursuant to section
1016.2(a) of this part, a model privacy form that meets the notice
content requirements of this section is included in the appendix to
this part.
