According to the Gramm-Leach-Bliley Act (GLBA) and its implementing Regulation P, a financial
institution may share consumer information with non-affiliated third parties for marketing purposes
only after disclosing its information-sharing practices to customers and after giving them an
opportunity to opt out of such sharing. The GLBA defines a customer as a consumer who has a
continuing relationship with a financial institution that provides one or more financial products or
services to be used primarily for personal, family, or household purposes. A consumer is an
individual who obtains or has obtained a financial product or service from a financial institution that
is to be used primarily for personal, family, or household purposes, or that individual’s legal
representative. A non-affiliated third party is any person except a financial institution’s affiliate or a
person employed jointly by a financial institution and a company that is not the financial institution’s
affiliate. An affiliate is any company that controls, is controlled by, or is under common control with
another company.
The GLBA requires that a financial institution provide a privacy notice to customers: (i) at the time of
establishing the customer relationship; (ii) annually during the continuation of the customer
relationship; and (iii) before disclosing any nonpublic personal information (NPI) about the customer
to any non-affiliated third party, unless an exception applies. The privacy notice must describe the
categories of NPI that the financial institution collects and discloses; the categories of affiliates and
non-affiliated third parties to whom the financial institution discloses NPI; the categories of NPI
disclosed to service providers and joint marketers; the policies and practices with respect to
protecting the confidentiality and security of NPI; and the disclosures of NPI to which the customer
has a right to opt out. The financial institution must also provide a reasonable means for the
customer to opt out of the disclosure of NPI to non-affiliated third parties, such as a check-off box, a
reply form, or a toll-free telephone number. The opt-out notice must be clear and conspicuous, and
must state that the customer can opt out at any time. The opt-out notice must also explain how the
customer can opt out, and the effect of opting out. The financial institution must honor the
customer’s opt-out direction as soon as reasonably practicable after receiving it, and must not
disclose any NPI to which the opt-out applies, unless an exception applies.
The GLBA provides several exceptions to the opt-out requirement, such as when the disclosure of NPI
is necessary to effect, administer, or enforce a transaction requested or authorized by the customer;
when the disclosure of NPI is required or permitted by law; when the disclosure of NPI is to a
consumer reporting agency in accordance with the Fair Credit Reporting Act; or when the disclosure
of NPI is to a person that performs marketing services on behalf of the financial institution or on
behalf of the financial institution and another financial institution under a joint marketing
agreement. A joint marketing agreement is a formal written contract between a financial institution
and any other person under which the parties agree to offer, endorse, or sponsor a financial product
or service. The joint marketing agreement must prohibit the other person from using or disclosing
the NPI for any purpose other than offering, endorsing, or sponsoring the financial product or service
covered by the agreement.
The GLBA also requires that a financial institution provide a privacy notice to consumers who are not
customers before disclosing any NPI about the consumer to any non-affiliated third party, unless an
exception applies. The financial institution does not need to provide an opt-out notice to consumers
who are not customers, unless it has a customer relationship with them. However, if the financial
institution establishes a customer relationship with a consumer who was previously not a customer,
it must provide a privacy notice and an opt-out notice to the customer as described above.
Reference:
Guide to the Gramm–Leach–Bliley Act
GLBA or FCRA? Data Sharing Between Affiliates and Non-Affiliates
Existing Privacy Laws Already Regulate Information Sharing
Why Do Banks Share Your Financial Information and Are They Allowed To?
[IAPP CIPP/US Certified Information Privacy Professional Study Guide], Chapter 5, pages 161-165.
