A financial institution is required to disclose to consumers its policies and practices concerning information sharing with both affiliates and nonaffiliated third parties. They must give new customers accurate, clear, and conspicuous initial notices about their privacy policies, describing the conditions under which they may disclose nonpublic personal information to nonaffiliated third parties and affiliates. “Customers” are consumers with whom the institution has a continuing relationship in which it provides financial products or services for personal, family, or household purposes. Initial notices must also be given to a consumer who is not a customer if the institution shares nonpublic personal information about the consumer with nonaffiliated third parties. Institutions must also give their current customers accurate, clear, and conspicuous annual notices of their privacy policies. When information-sharing practices change, institutions may have to provide a revised notice, as outlined in section 1016.8.

A consumer must be given a reasonable method for opting out of information sharing, such as a reply form or toll-free telephone number. Consumers may exercise their opt-out option at any time. An institution must comply with a consumer’s opt-out direction as soon as reasonably practicable and until the consumer revokes that direction in writing.

Exceptions allow transfers of nonpublic personal information to unaffiliated parties to process and service a consumer’s transaction and to facilitate other normal business transactions. For example, consumers cannot opt out when nonpublic personal information is shared with a nonaffiliated third party to—

To qualify for an opt-out exception, an institution may have to satisfy disclosure and other requirements. For example, the joint-marketing exception requires that any contractual agreement between two nonaffiliated financial institutions—

The institution must also include in the privacy notice a separate statement disclosing the joint-marketing agreement.