§6802 Obligations with respect to disclosures of personal information

Summary

Financial institutions must not share a consumer’s nonpublic personal information with unrelated companies unless they follow the notice and opt-out rules. They must give a clear written or electronic notice that the information may be shared, let the consumer choose not to have it shared before the first disclosure, and tell the consumer how to make that choice. They can share information with outside companies that do work for them (including marketing their own products or joint offers) if they fully disclose the sharing and require the outside company by contract to keep the information confidential. An outside company that gets the information can’t pass it on to another unrelated company unless the original institution could have shared it itself. Banks and similar firms may not give account numbers or access codes to unrelated companies for telemarketing, direct mail, or email marketing (except to consumer reporting agencies). Sharing is allowed in certain cases, such as to carry out a consumer’s request, with the consumer’s consent, to protect records or prevent fraud, for legal, audit, or rating purposes, to certain government or industry authorities when allowed by law, to consumer reporting agencies under the Fair Credit Reporting Act, in a sale or merger of a business unit, or to comply with subpoenas, exams, or other legal requirements.