§6803 Disclosure of institution privacy policy

Summary

Financial institutions must give every new customer, and at least once a year while the relationship continues, a clear written or electronic notice about their privacy practices. The notice must explain how the institution shares customers’ private personal information with affiliates and with other companies, whether it shares information about former customers, what kinds of personal data it collects, and how it keeps that information safe. It must also include details about sharing with nonaffiliated third parties (who may get data) and any specific disclosure required under section 1681a(d)(2)(A)(iii). Notices must follow rules set under section 6804. The agencies in section 6804(a)(1) must create a short, easy-to-read model form and publish it for public comment not later than 180 days after October 13, 2006; using that form means a firm is complying. Certified public accountants who are state-licensed and bound by state rules that bar disclosure without a consumer’s consent are not covered by the notice requirement, but financial institutions affiliated with such CPAs are still covered. “State” means any State or territory of the United States, the District of Columbia, Puerto Rico, Guam, American Samoa, the Trust Territory of the Pacific Islands, the Virgin Islands, or the Northern Mariana Islands.