REG P 12 CFR 1016 - Privacy of Consumer Financial Information (1-1-19 ED)

Bur. of Consumer Financial Protection

§ 1016.1

PART 1016—PRIVACY OF CONSUMER FINANCIAL INFORMATION (REGULATION P)
Sec.
1016.1
1016.2
1016.3

Purpose and scope.
Model privacy form and examples.
Definitions.

Subpart A—Privacy and Opt Out Notices
1016.4 Initial privacy notice to consumers
required.
1016.5 Annual privacy notice to customers
required.
1016.6 Information to be included in privacy
notices.
1016.7 Form of opt out notice to consumers;
opt out methods.
1016.8 Revised privacy notices.
1016.9 Delivering privacy and opt out notices.

Subpart B—Limits on Disclosures
1016.10 Limits on disclosure of nonpublic
personal information to nonaffiliated
third parties.
1016.11 Limits on redisclosure and reuse of
information.
1016.12 Limits on sharing account number
information for marketing purposes.

Subpart C—Exceptions
1016.13 Exception to opt out requirements
for service providers and joint marketing.
1016.14 Exceptions to notice and opt out requirements for processing and servicing
transactions.
1016.15 Other exceptions to notice and opt
out requirements.

Subpart D—Relation to Other Laws
1016.16 Protection of Fair Credit Reporting
Act.
1016.17 Relation to state laws.
APPENDIX
FORM

TO

PART

1016—MODEL

PRIVACY

AUTHORITY: 12 U.S.C. 5512, 5581; 15 U.S.C.
6804.
SOURCE: 76 FR 79028, Dec. 21, 2011, unless
otherwise noted.

kpayne on VMOFRWIN702 with $$_JOB

§ 1016.1

Purpose and scope.

(a) Purpose. This part governs the
treatment of nonpublic personal information about consumers by the financial institutions listed in paragraph (b)
of this section. This part:

(1) Requires a financial institution to
provide notice to customers about its
privacy policies and practices;
(2) Describes the conditions under
which a financial institution may disclose nonpublic personal information
about consumers to nonaffiliated third
parties; and
(3) Provides a method for consumers
to prevent a financial institution from
disclosing that information to most
nonaffiliated third parties by ‘‘opting
out’’ of that disclosure, subject to the
exceptions in §§ 1016.13, 1016.14, and
1016.15.
(b) Scope. (1) This part applies only to
nonpublic personal information about
individuals who obtain financial products or services primarily for personal,
family, or household purposes from the
institutions listed below. This part
does not apply to information about
companies or about individuals who obtain financial products or services for
business, commercial, or agricultural
purposes. This part applies to those financial institutions and other persons
for which the Bureau of Consumer Financial Protection (Bureau) has rulemaking authority pursuant to section
504(a)(1)(A) of the Gramm-Leach-Bliley
Act (GLB Act) (15 U.S.C. 6804(a)(1)(A)).
Specifically, this part applies to any financial institution and other covered
person or service provider that is subject to Subtitle A of Title V of the GLB
Act, including third parties that are
not financial institutions but that receive nonpublic personal information
from financial institutions with whom
they are not affiliated. This part does
not apply to certain motor vehicle
dealers described in 12 U.S.C. 5519 or to
entities for which the Securities and
Exchange Commission or the Commodity Futures Trading Commission
has rulemaking authority pursuant to
sections 504(a)(1)(A)–(B) of the GLB Act
(15 U.S.C. 6804(a)(1)(A)–(B)). Except as
otherwise specifically provided herein,
entities to which this part applies are
referred to in this part as ‘‘you.’’
(2)(i) Nothing in this part modifies,
limits, or supersedes the standards governing individually identifiable health
information promulgated by the Secretary of Health and Human Services
under the authority of sections 262 and
264 of the Health Insurance Portability

487

VerDate Sep<11>2014

14:53 Mar 26, 2019

Jkt 247042

PO 00000

Frm 00497

Fmt 8010

Sfmt 8010

Q:\12\12V8.TXT

PC31

§ 1016.2

12 CFR Ch. X (1–1–19 Edition)

and Accountability Act of 1996 (42
U.S.C. 1320d–1320d–8).
(ii) Any institution of higher education that complies with the Federal
Educational Rights and Privacy Act
(FERPA), 20 U.S.C. 1232g, and its implementing regulations, 34 CFR part 99,
and that is also a financial institution
described in § 1016.3(l)(3) of this part,
shall be deemed to be in compliance
with this part if it is in compliance
with FERPA.
(3) Nothing in this part shall apply
to:
(i) A financial institution that is a
person described in section 1029(a) of
the Consumer Financial Protection Act
of 2010, title X of the Dodd-Frank Wall
Street Reform and Consumer Protection Act (Dodd-Frank Act), Public Law
111–203, 124 Stat. 1376 (12 U.S.C. 5519(a));
(ii) A financial institution or other
person subject to the jurisdiction on
the Commodity Futures Trading Commission under 7 U.S.C. 7b–2;
(iii) A broker or dealer that is registered under the Securities Exchange
Act of 1934 (15 U.S.C. 78a et seq.;)
(iv) A registered investment adviser,
properly registered by or on behalf of
either the Securities Exchange Commission or any state, with respect to
its investment advisory activities and
its activities incidental to those investment advisory activities;
(v) An investment company that is
registered under the Investment Company Act of 1940 (15 U.S.C. 80a–1 et seq.;)
or
(vi) An insurance company, with respect to its insurance activities and its
activities incidental to those insurance
activities, that is subject to supervision by a state insurance regulator.

kpayne on VMOFRWIN702 with $$_JOB

[76 FR 79028, Dec. 21, 2011, as amended at 79
FR 64081, Oct. 28, 2014]

§ 1016.2 Model privacy form and examples.
(a) Model privacy form. Use of the
model privacy form in the appendix to
this part, consistent with the instructions in the appendix constitutes compliance with the notice content requirements of §§ 1016.6 and 1016.7 of this
part, although use of the model privacy
form is not required.
(b) Examples. The examples in this
part are not exclusive. Compliance

with an example, to the extent applicable, constitutes compliance with this
part.
§ 1016.3 Definitions.
As used in this part, unless the context requires otherwise:
(a)(1) Affiliate means any company
that controls, is controlled by, or is
under common control with another
company.
(2) Examples in the case of a credit
union. (i) An affiliate of a Federal credit union is a credit union service organization (CUSO), as provided in 12 CFR
part 712, that is controlled by the Federal credit union.
(ii) An affiliate of a federally-insured,
state-chartered credit union is a company that is controlled by the credit
union.
(b)(1) Clear and conspicuous means
that a notice is reasonably understandable and designed to call attention to
the nature and significance of the information in the notice.
(2) Examples—(i) Reasonably understandable. You make your notice reasonably understandable if you:
(A) Present the information in the
notice in clear, concise sentences,
paragraphs, and sections;
(B) Use short explanatory sentences
or bullet lists whenever possible;
(C) Use definite, concrete, everyday
words and active voice whenever possible;
(D) Avoid multiple negatives;
(E) Avoid legal and highly technical
business terminology whenever possible; and
(F) Avoid explanations that are imprecise and readily subject to different
interpretations.
(ii) Designed to call attention. You design your notice to call attention to
the nature and significance of the information in it if you:
(A) Use a plain-language heading to
call attention to the notice;
(B) Use a typeface and type size that
are easy to read;
(C) Provide wide margins and ample
line spacing;
(D) Use boldface or italics for key
words; and
(E) In a form that combines your notice with other information, use distinctive type size, style, and graphic

488

VerDate Sep<11>2014

14:53 Mar 26, 2019

Jkt 247042

PO 00000

Frm 00498

Fmt 8010

Sfmt 8010

Q:\12\12V8.TXT

PC31

kpayne on VMOFRWIN702 with $$_JOB

Bur. of Consumer Financial Protection

§ 1016.3

devices, such as shading or sidebars,
when you combine your notice with
other information.
(iii) Notices on Web sites. If you provide a notice on a Web site, you design
your notice to call attention to the nature and significance of the information in it if you use text or visual cues
to encourage scrolling down the page if
necessary to view the entire notice and
ensure that other elements on the Web
site (such as text, graphics, hyperlinks,
or sound) do not distract attention
from the notice, and you either:
(A) Place the notice on a screen that
consumers frequently access, such as a
page on which transactions are conducted; or
(B) Place a link on a screen that consumers frequently access, such as a
page on which transactions are conducted, that connects directly to the
notice and is labeled appropriately to
convey the importance, nature, and
relevance of the notice.
(c) Collect means to obtain information that you organize or can retrieve
by the name of an individual or by
identifying number, symbol, or other
identifying particular assigned to the
individual, irrespective of the source of
the underlying information.
(d) Company means any corporation,
limited liability company, business
trust, general or limited partnership,
association, or similar organization.
(e)(1) Consumer means an individual
who obtains or has obtained a financial
product or service from you that is to
be used primarily for personal, family,
or household purposes, or that individual’s legal representative.
(2) Examples in the case of a financial
institution other than a credit union. For
purposes of this paragraph (e)(2), ‘‘you’’
is limited to financial institutions
other than credit unions.
(i) An individual who applies to you
for credit for personal, family, or
household purposes is a consumer of a
financial service, regardless of whether
the credit is extended.
(ii) An individual who provides nonpublic personal information to you in
order to obtain a determination about
whether he or she may qualify for a
loan to be used primarily for personal,
family, or household purposes is a con-

sumer of a financial service, regardless
of whether the loan is extended.
(iii) An individual who provides nonpublic personal information to you in
connection with obtaining or seeking
to obtain financial, investment, or economic advisory services is a consumer
regardless of whether you establish a
continuing advisory relationship.
(iv) If you hold ownership or servicing rights to an individual’s loan that
is used primarily for personal, family,
or household purposes, the individual is
your consumer, even if you hold those
rights in conjunction with one or more
other institutions. (The individual is
also a consumer with respect to the
other financial institutions involved.)
An individual who has a loan in which
you have ownership or servicing rights
is your consumer, even if you, or another institution with those rights,
hire an agent to collect on the loan.
(v) An individual who is a consumer
of another financial institution is not
your consumer solely because you act
as agent for, or provide processing or
other services to, that financial institution.
(vi) An individual is not your consumer solely because he or she has designated you as trustee for a trust.
(vii) An individual is not your consumer solely because he or she is a beneficiary of a trust for which you are a
trustee.
(viii) An individual is not your consumer solely because he or she is a participant or a beneficiary of an employee benefit plan that you sponsor or
for which you act as a trustee or fiduciary.
(3) Examples in the case of a credit
union. For purposes of this paragraph
(e)(3), ‘‘you’’ is limited to credit
unions.
(i) An individual who provides nonpublic personal information to you in
connection with obtaining or seeking
to obtain credit union membership is
your consumer regardless of whether
you establish a customer relationship.
(ii) An individual who provides nonpublic personal information to you in
connection with using your ATM is
your consumer.
(iii) If you hold ownership or servicing rights to an individual’s loan, the
individual is your consumer, even if

489

VerDate Sep<11>2014

14:53 Mar 26, 2019

Jkt 247042

PO 00000

Frm 00499

Fmt 8010

Sfmt 8010

Q:\12\12V8.TXT

PC31

kpayne on VMOFRWIN702 with $$_JOB

§ 1016.3

12 CFR Ch. X (1–1–19 Edition)

you hold those rights in conjunction
with one or more financial institutions. The individual is also a consumer with respect to the other financial institutions involved. This applies
even if you, or another financial institution with those rights, hire an agent
to collect on the loan or to provide
processing or other services.
(iv) An individual who is a consumer
of another financial institution is not
your consumer solely because you act
as agent for, or provide processing or
other services to, that financial institution.
(v) An individual is not your consumer solely because he or she is a participant or a beneficiary of an employee benefit plan that you sponsor or
for which you act as a trustee or fiduciary.
(f) Consumer reporting agency has the
same meaning as in section 603(f) of the
Fair Credit Reporting Act (15 U.S.C.
1681a(f)).
(g) Control of a company means:
(1) Ownership, control, or power to
vote 25 percent or more of the outstanding shares of any class of voting
security of the company, directly or indirectly, or acting through one or more
other persons;
(2) Control in any manner over the
election of a majority of the directors,
trustees, or general partners (or individuals exercising similar functions) of
the company; or
(3) The power to exercise, directly or
indirectly, a controlling influence over
the management or policies of the
company as determined by the applicable prudential regulator (as defined in
12 U.S.C. 5481(24)), if any.
(4) Example in the case of credit unions.
A credit union is presumed to have a
controlling influence over the management or policies of a CUSO, if the
CUSO is 67% owned by credit unions.
(h) Credit union means a Federal or
state-chartered credit union that the
National Credit Union Share Insurance
Fund insures.
(i) Customer means a consumer who
has a customer relationship with you.
(j)(1) Customer relationship means a
continuing relationship between a consumer and you under which you provide one or more financial products or
services to the consumer that are to be

used primarily for personal, family, or
household purposes. As noted in the examples, and for purposes of this part
only, in the case of a credit union, a
customer relationship will exist between a credit union and certain consumers that are not the credit union’s
members.
(2) Examples in the case of financial institutions other than credit unions and
covered entities subject to FTC enforcement jurisdiction. For purposes of this
paragraph (j)(2), ‘‘you’’ is limited to financial institutions other than credit
unions and financial institutions described in paragraph (l)(3) of this section.
(i) Continuing relationship. A consumer has a continuing relationship
with you if the consumer:
(A) Has a deposit or investment account with you;
(B) Obtains a loan from you;
(C) Has a loan for which you own the
servicing rights;
(D) Purchases an insurance product
from you;
(E) Holds an investment product
through you, such as when you act as a
custodian for securities or for assets in
an Individual Retirement Arrangement;
(F) Enters into an agreement or understanding with you whereby you undertake to arrange or broker a home
mortgage loan for the consumer;
(G) Enters into a lease of personal
property with you; or
(H) Obtains financial, investment, or
economic advisory services from you
for a fee.
(ii) No continuing relationship. A consumer does not, however, have a continuing relationship with you if:
(A) The consumer obtains a financial
product or service only in isolated
transactions, such as using your ATM
to withdraw cash from an account at
another financial institution or purchasing a cashier’s check or money
order;
(B) You sell the consumer’s loan and
do not retain the rights to service that
loan; or
(C) You sell the consumer airline
tickets, travel insurance, or traveler’s
checks in isolated transactions.

490

VerDate Sep<11>2014

14:53 Mar 26, 2019

Jkt 247042

PO 00000

Frm 00500

Fmt 8010

Sfmt 8010

Q:\12\12V8.TXT

PC31

kpayne on VMOFRWIN702 with $$_JOB

Bur. of Consumer Financial Protection

§ 1016.3

(3) Examples in the case of covered entities subject to FTC enforcement jurisdiction. For purposes of this paragraph
(j)(3), ‘‘you’’ is limited to financial institutions described in paragraph (l)(3)
of this section.
(i) Continuing relationship. A consumer has a continuing relationship
with you if the consumer:
(A) Has a credit or investment account with you;
(B) Obtains a loan from you;
(C) Purchases an insurance product
from you;
(D) Holds an investment product
through you, such as when you act as a
custodian for securities or for assets in
an Individual Retirement Arrangement;
(E) Enters into an agreement or understanding with you whereby you undertake to arrange or broker a home
mortgage loan, or credit to purchase a
vehicle, for the consumer;
(F) Enters into a lease of personal
property on a non-operating basis with
you;
(G) Obtains financial, investment, or
economic advisory services from you
for a fee;
(H) Becomes your client for the purpose of obtaining tax preparation or
credit counseling services from you;
(I) Obtains career counseling while
seeking employment with a financial
institution or the finance, accounting,
or audit department of any company
(or while employed by such a financial
institution or department of any company);
(J) Is obligated on an account that
you purchase from another financial
institution, regardless of whether the
account is in default when purchased,
unless you do not locate the consumer
or attempt to collect any amount from
the consumer on the account;
(K) Obtains real estate settlement
services from you; or
(L) Has a loan for which you own the
servicing rights.
(ii) No continuing relationship. A consumer does not, however, have a continuing relationship with you if:
(A) The consumer obtains a financial
product or service from you only in isolated transactions, such as using your
ATM to withdraw cash from an account at another financial institution;

purchasing a money order from you;
cashing a check with you; or making a
wire transfer through you;
(B) You sell the consumer’s loan and
do not retain the rights to service that
loan;
(C) You sell the consumer airline
tickets, travel insurance, or traveler’s
checks in isolated transactions;
(D) The consumer obtains one-time
personal or real property appraisal
services from you; or
(E) The consumer purchases checks
for a personal checking account from
you.
(4) Examples in the case of a credit
union. (i) Continuing relationship. A consumer has a continuing relationship
with a credit union if the consumer:
(A) Is a member as defined in the
credit union’s bylaws;
(B) Is a nonmember who has a share,
share draft, or credit card account with
the credit union jointly with a member;
(C) Is a nonmember who has a loan
that the credit union services;
(D) Is a nonmember who has an account with a credit union that has been
designated as a low-income credit
union; or
(E) Is a nonmember who has an account in a federally-insured, statechartered credit union pursuant to
state law.
(ii) No continuing relationship. A consumer does not, however, have a continuing relationship with a credit
union if the consumer is a nonmember
and:
(A) The consumer only obtains a financial product or service in isolated
transactions, such as using the credit
union’s ATM to withdraw cash from an
account maintained at another financial institution or purchasing travelers
checks; or
(B) The credit union sells the consumer’s loan and does not retain the
rights to service that loan.
(k) Federal functional regulator means:
(1) The Board of Governors of the
Federal Reserve System;
(2) The Office of the Comptroller of
the Currency;
(3) The Board of Directors of the Federal Deposit Insurance Corporation;
(4) The National Credit Union Administration Board; and

491

VerDate Sep<11>2014

14:53 Mar 26, 2019

Jkt 247042

PO 00000

Frm 00501

Fmt 8010

Sfmt 8010

Q:\12\12V8.TXT

PC31

kpayne on VMOFRWIN702 with $$_JOB

§ 1016.3

12 CFR Ch. X (1–1–19 Edition)

(5) The Securities and Exchange
Commission.
(l)(1) Except for entities described in
paragraph (l)(3) of this section, financial institution means any institution
the business of which is engaging in activities that are financial in nature or
incidental to such financial activities
as described in section 4(k) of the Bank
Holding Company Act of 1956 (12 U.S.C.
1843(k)).
(2) For purposes of paragraph (l)(1) of
this section, financial institution does
not include:
(i) Any person or entity with respect
to any financial activity that is subject
to the jurisdiction of the Commodity
Futures Trading Commission under the
Commodity Exchange Act (7 U.S.C. 1 et
seq.;)
(ii) The Federal Agricultural Mortgage Corporation or any entity chartered and operating under the Farm
Credit Act of 1971 (12 U.S.C. 2001 et seq.;)
or
(iii) Institutions chartered by Congress
specifically
to
engage
in
securitizations, secondary market sales
(including sales of servicing rights), or
similar transactions related to a transaction of a consumer, as long as such
institutions do not sell or transfer nonpublic personal information to a nonaffiliated third party.
(3)(i) Special definition for entities subject to the Federal Trade Commission’s enforcement jurisdiction. In the case of an
entity described in section 505(a)(7) of
the GLB Act (other than such an entity
described in section 504(a)(1)(C) of that
Act), financial institution means any institution the business of which is engaging in financial activities as described in section 4(k) of the Bank
Holding Company Act of 1956 (12 U.S.C.
1843(k)). For purposes of this paragraph
(l)(3), an institution that is significantly engaged in financial activities
is a financial institution.
(ii) Examples of financial institution.
For purposes of this paragraph (l)(3):
(A) A retailer that extends credit by
issuing its own credit card directly to
consumers is a financial institution because extending credit is a financial
activity listed in 12 CFR 225.28(b)(1)
and referenced in section 4(k)(4)(F) of
the Bank Holding Company Act and
issuing that extension of credit

through a proprietary credit card demonstrates that a retailer is significantly engaged in extending credit.
(B) A personal property or real estate
appraiser is a financial institution because real and personal property appraisal is a financial activity listed in
12 CFR 225.28(b)(2)(i) and referenced in
section 4(k)(4)(F) of the Bank Holding
Company Act.
(C) An automobile dealership that is
not described in section 1029(a) of the
Dodd-Frank Act (12 U.S.C. 5519(a)) and
that, as a usual part of its business,
leases automobiles on a nonoperating
basis for longer than 90 days is a financial institution with respect to its leasing business because leasing personal
property on a nonoperating basis where
the initial term of the lease is at least
90 days is a financial activity listed in
12 CFR 225.28(b)(3) and referenced in
section 4(k)(4)(F) of the Bank Holding
Company Act.
(D) A career counselor that specializes in providing career counseling
services to individuals currently employed by or recently displaced from a
financial organization, individuals who
are seeking employment with a financial organization, or individuals who
are currently employed by or seeking
placement with the finance, accounting or audit departments of any company is a financial institution because
such career counseling activities are financial activities listed in 12 CFR
225.28(b)(9)(iii) and referenced in section 4(k)(4)(F) of the Bank Holding
Company Act.
(E) A business that prints and sells
checks for consumers, either as its sole
business or as one of its product lines,
is a financial institution because printing and selling checks is a financial activity that is listed in 12 CFR
225.28(b)(10)(ii) and referenced in section 4(k)(4)(F) of the Bank Holding
Company Act.
(F) A business that regularly wires
money to and from consumers is a financial institution because transferring money is a financial activity referenced in section 4(k)(4)(A) of the
Bank Holding Company Act and regularly providing that service demonstrates that the business is significantly engaged in that activity.

492

VerDate Sep<11>2014

14:53 Mar 26, 2019

Jkt 247042

PO 00000

Frm 00502

Fmt 8010

Sfmt 8010

Q:\12\12V8.TXT

PC31

kpayne on VMOFRWIN702 with $$_JOB

Bur. of Consumer Financial Protection

§ 1016.3

(G) A check cashing business is a financial institution because cashing a
check is exchanging money, which is a
financial activity listed in section
4(k)(4)(A) of the Bank Holding Company Act.
(H) An accountant or other tax preparation service that is in the business
of completing income tax returns is a
financial institution because tax preparation services is a financial activity
listed in 12 CFR 225.28(b)(6)(vi) and referenced in section 4(k)(4)(G) of the
Bank Holding Company Act.
(I) A business that operates a travel
agency in connection with financial
services is a financial institution because operating a travel agency in connection with financial services is a financial activity listed in 12 CFR
211.5(d)(15) and referenced in section
4(k)(4)(G) of the Bank Holding Company Act.
(J) An entity that provides real estate settlement services is a financial
institution because providing real estate settlement services is a financial
activity
listed
in
12
CFR
225.28(b)(2)(viii) and referenced in section 4(k)(4)(F) of the Bank Holding
Company Act.
(K) A mortgage broker is a financial
institution because brokering loans is
a financial activity listed in 12 CFR
225.28(b)(1) and referenced in section
4(k)(4)(F) of the Bank Holding Company Act.
(L) An investment advisory company
and a credit counseling service are
each financial institutions because providing financial and investment advisory services are financial activities
referenced in section 4(k)(4)(C) of the
Bank Holding Company Act.
(iii) For purposes of this paragraph
(l)(3), financial institution does not include:
(A) Any person or entity with respect
to any financial activity that is subject
to the jurisdiction of the Commodity
Futures Trading Commission under the
Commodity Exchange Act (7 U.S.C. 1 et
seq.;)
(B) The Federal Agricultural Mortgage Corporation or any entity chartered and operating under the Farm
Credit Act of 1971 (12 U.S.C. 2001 et seq.;)
or

(C) Institutions chartered by Congress
specifically
to
engage
in
securitizations, secondary market sales
(including sales of servicing rights) or
similar transactions related to a transaction of a consumer, as long as such
institutions do not sell or transfer nonpublic personal information to a nonaffiliated third party other than as permitted by §§ 1016.14 and 1016.15 of this
part.
(D) Entities that engage in financial
activities but that are not significantly
engaged in those financial activities.
(iv) Examples of entities that are not
significantly engaged in financial activities. (A) A retailer is not a financial institution if its only means of extending
credit are occasional ‘‘lay away’’ and
deferred payment plans or accepting
payment by means of credit cards
issued by others.
(B) A retailer is not a financial institution merely because it accepts payment in the form of cash, checks, or
credit cards that it did not issue.
(C) A merchant is not a financial institution merely because it allows an
individual to ‘‘run a tab.’’
(D) A grocery store is not a financial
institution merely because it allows individuals to whom it sells groceries to
cash a check, or write a check for a
higher amount than the grocery purchase and obtain cash in return.
(m)(1) Financial product or service
means any product or service that a financial holding company could offer by
engaging in an activity that is financial in nature or incidental to such a financial activity under section 4(k) of
the Bank Holding Company Act of 1956
(12 U.S.C. 1843(k)).
(2) Special definition for entities subject
to the Federal Trade Commission’s enforcement jurisdiction. In the case of an
entity described in section 505(a)(7) of
the GLB Act (other than such an entity
described in section 504(a)(1)(C) of that
Act), financial product or service means
any product or service that a financial
holding company could offer by engaging in a financial activity under section 4(k) of the Bank Holding Company
Act of 1956 (12 U.S.C. 1843(k)).
(3) Financial service includes your
evaluation or brokerage of information
that you collect in connection with a

493

VerDate Sep<11>2014

14:53 Mar 26, 2019

Jkt 247042

PO 00000

Frm 00503

Fmt 8010

Sfmt 8010

Q:\12\12V8.TXT

PC31

kpayne on VMOFRWIN702 with $$_JOB

§ 1016.3

12 CFR Ch. X (1–1–19 Edition)

request or an application from a consumer for a financial product or service.
(n) Member means a consumer who is
a member of a credit union, as defined
in the credit union’s bylaws.
(o)(1) Nonaffiliated third party means
any person except:
(i) Your affiliate; or
(ii) A person employed jointly by you
and any company that is not your affiliate (but nonaffiliated third party includes the other company that jointly
employs the person).
(2) Nonaffiliated third party includes,
for financial institutions other than
credit unions, any company that is an
affiliate solely by virtue of your or
your affiliate’s direct or indirect ownership or control of the company in
conducting merchant banking or investment banking activities of the type
described in section 4(k)(4)(H) or insurance company investment activities of
the type described in section 4(k)(4)(I)
of the Bank Holding Company Act of
1956 (12 U.S.C. 1843(k)(4)(H) and (I)).
(p)(1) Nonpublic personal information
means:
(i) Personally identifiable financial
information; and
(ii) Any list, description, or other
grouping of consumers (and publicly
available information pertaining to
them) that is derived using any personally identifiable financial information
that is not publicly available.
(2) Nonpublic personal information does
not include:
(i) Publicly available information,
except as included on a list described in
paragraph (p)(1)(ii) of this section; or
(ii) Any list, description, or other
grouping of consumers (and publicly
available information pertaining to
them) that is derived without using
any personally identifiable financial
information that is not publicly available.
(3) Examples of lists. (i) Nonpublic personal information includes any list of
individuals’ names and street addresses
that is derived in whole or in part
using personally identifiable financial
information that is not publicly available, such as account numbers.
(ii) Nonpublic personal information
does not include any list of individuals’
names and addresses that contains

only publicly available information, is
not derived in whole or in part using
personally identifiable financial information that is not publicly available,
and is not disclosed in a manner that
indicates that any of the individuals on
the list is a consumer of a financial institution.
(q)(1) Personally identifiable financial
information means any information:
(i) A consumer provides to you to obtain a financial product or service from
you;
(ii) About a consumer resulting from
any transaction involving a financial
product or service between you and a
consumer; or
(iii) You otherwise obtain about a
consumer in connection with providing
a financial product or service to that
consumer.
(2) Examples—(i) Information included.
Personally identifiable financial information includes:
(A) Information a consumer provides
to you on an application to obtain a
loan, a credit card, a credit union
membership, or other financial product
or service;
(B) Account balance information,
payment history, overdraft history,
and credit or debit card purchase information;
(C) The fact that an individual is or
has been one of your customers or has
obtained a financial product or service
from you;
(D) Any information about your consumer if it is disclosed in a manner
that indicates that the individual is or
has been your consumer;
(E) Any information that a consumer
provides to you or that you or your
agent otherwise obtain in connection
with collecting on, or servicing, a loan
or a credit account;
(F) Any information you collect
through an internet ‘‘cookie’’ (an information collecting device from a Web
server); and
(G) Information from a consumer report.
(ii) Information not included. Personally identifiable financial information
does not include:
(A) A list of names and addresses of
customers of an entity that is not a financial institution; and

494

VerDate Sep<11>2014

14:53 Mar 26, 2019

Jkt 247042

PO 00000

Frm 00504

Fmt 8010

Sfmt 8010

Q:\12\12V8.TXT

PC31

kpayne on VMOFRWIN702 with $$_JOB

Bur. of Consumer Financial Protection

§ 1016.4

(B) Information that does not identify a consumer, such as aggregate information or blind data that does not
contain personal identifiers such as account numbers, names, or addresses.
(r)(1) Publicly available information
means any information that you have a
reasonable basis to believe is lawfully
made available to the general public
from:
(i) Federal, state, or local government records;
(ii) Widely distributed media; or
(iii) Disclosures to the general public
that are required to be made by Federal, state, or local law.
(2) Reasonable basis. You have a reasonable basis to believe that information is lawfully made available to the
general public if you have taken steps
to determine:
(i) That the information is of the
type that is available to the general
public; and
(ii) Whether an individual can direct
that the information not be made
available to the general public and, if
so, that your consumer has not done
so.
(3) Examples—(i) Government records.
Publicly available information in government records includes information
in government real estate records and
security interest filings.
(ii) Widely distributed media. Publicly
available information from widely distributed media includes information
from a telephone book, a television or
radio program, a newspaper, or a Web
site that is available to the general
public on an unrestricted basis. A Web
site is not restricted merely because an
Internet service provider or a site operator requires a fee or a password, so
long as access is available to the general public.
(iii) Reasonable basis. (A) You have a
reasonable basis to believe that mortgage information is lawfully made
available to the general public if you
have determined that the information
is of the type included on the public
record in the jurisdiction where the
mortgage would be recorded.
(B) You have a reasonable basis to
believe that an individual’s telephone
number is lawfully made available to
the general public if you have located
the telephone number in the telephone

book or the consumer has informed you
that the telephone number is not unlisted.
(s)(1) You means a financial institution for which the Bureau has rulemaking
authority
under
section
504(a)(1)(A) of the GLB Act (15 U.S.C.
6804(a)(1)(A)).
(2) You does not include:
(i) A financial institution that is a
person described in section 1029(a) of
the Consumer Financial Protection Act
of 2010 (12 U.S.C. 5519(a));
(ii) A financial institution or other
person subject to the jurisdiction on
the Commodity Futures Trading Commission under 7 U.S.C. 7b–2;
(iii) A broker or dealer that is registered under the Securities Exchange
Act of 1934 (15 U.S.C. 78a et seq.;)
(iv) A registered investment adviser,
properly registered by or on behalf of
either the Securities Exchange Commission or any State, with respect to
its investment advisory activities and
its activities incidental to those investment advisory activities;
(v) An investment company that is
registered under the Investment Company Act of 1940 (15 U.S.C. 80a–1 et seq.;)
or
(vi) An insurance company, with respect to its insurance activities and its
activities incidental to those insurance
activities, that is subject to supervision by a State insurance regulator.
[76 FR 79028, Dec. 21, 2011, as amended by
CFPB-2016-0032, 83 FR 40958, Aug. 17, 2018]

Subpart A—Privacy and Opt Out
Notices
§ 1016.4 Initial privacy notice to consumers required.
(a) Initial notice requirement. You
must provide a clear and conspicuous
notice that accurately reflects your
privacy policies and practices to:
(1) Customer. An individual who becomes your customer, not later than
when you establish a customer relationship, except as provided in paragraph (e) of this section; and
(2) Consumer. A consumer, before you
disclose any nonpublic personal information about the consumer to any
nonaffiliated third party, if you make
such a disclosure other than as authorized by §§ 1016.14 and 1016.15 of this part.

495

VerDate Sep<11>2014

14:53 Mar 26, 2019

Jkt 247042

PO 00000

Frm 00505

Fmt 8010

Sfmt 8010

Q:\12\12V8.TXT

PC31

kpayne on VMOFRWIN702 with $$_JOB

§ 1016.4

12 CFR Ch. X (1–1–19 Edition)

(b) When initial notice to a consumer is
not required. You are not required to
provide an initial notice to a consumer
under paragraph (a) of this section if:
(1) You do not disclose any nonpublic
personal information about the consumer to any nonaffiliated third party,
other than as authorized by §§ 1016.14
and 1016.15; and
(2) You do not have a customer relationship with the consumer.
(c) When you establish a customer relationship—(1) General rule. You establish
a customer relationship when you and
the consumer enter into a continuing
relationship.
(2) Special rule for loans. You establish
a customer relationship with a consumer when you originate or acquire
the servicing rights to a loan to the
consumer for personal, family, or
household purposes. If you subsequently transfer the servicing rights to
that loan to another financial institution, the customer relationship transfers with the servicing rights.
(3) Examples—(i) Examples of establishing customer relationship by financial
institutions other than credit unions and
covered entities subject to FTC enforcement jurisdiction. For purposes of this
paragraph (c)(3)(i), ‘‘you’’ is limited to
financial institutions other than credit
unions and financial institutions described in § 1016.3(l)(3). You establish a
customer relationship when the consumer:
(A) Opens a credit card account with
you;
(B) Executes the contract to open a
deposit account with you, obtains credit from you, or purchases insurance
from you;
(C) Agrees to obtain financial, economic, or investment advisory services
from you for a fee; or
(D) Becomes your client for the purpose of your providing credit counseling or tax preparation services.
(ii) Examples of establishing customer
relationship by covered entities subject to
FTC enforcement jurisdiction. For purposes of this paragraph (c)(3)(ii), ‘‘you’’
is limited to financial institutions described in § 1016.3(l)(3) of this part. You
establish a customer relationship when
the consumer:
(A) Opens a credit card account with
you;

(B) Executes the contract to obtain
credit from you or purchases insurance
from you;
(C) Agrees to obtain financial, economic, or investment advisory services
from you for a fee;
(D) Becomes your client for the purpose of your providing credit counseling or tax preparation services or to
obtain career counseling while seeking
employment with a financial institution or the finance, accounting, or
audit department of any company (or
while employed by such a company or
financial institution);
(E) Provides any personally identifiable financial information to you in an
effort to obtain a mortgage loan
through you;
(F) Executes the lease for personal
property with you;
(G) Is an obligor on an account that
you purchased from another financial
institution and whom you have located
and begun attempting to collect
amounts owed on the account; or
(H) Provides you with the information necessary for you to compile and
provide access to all of the consumer’s
online financial accounts at your Web
site.
(iii) Examples of establishing customer
relationship by credit unions. For purposes of this paragraph (c)(3)(iii),
‘‘you’’ is limited to a credit union. You
establish a customer relationship when
the consumer:
(A) Becomes your member under
your bylaws;
(B) Is a nonmember and opens a credit card account with you jointly with a
member under your procedures;
(C) Is a nonmember and executes the
contract to open a share or share draft
account with you or obtains credit
from you jointly with a member, including an individual acting as a guarantor;
(D) Is a nonmember and opens an account with you and you are a credit
union designated as a low-income credit union;
(E) Is a nonmember and opens an account with you pursuant to State law
and you are a State-chartered credit
union.
(iv) Examples of loan rule. You establish a customer relationship with a

496

VerDate Sep<11>2014

14:53 Mar 26, 2019

Jkt 247042

PO 00000

Frm 00506

Fmt 8010

Sfmt 8010

Q:\12\12V8.TXT

PC31

kpayne on VMOFRWIN702 with $$_JOB

Bur. of Consumer Financial Protection

§ 1016.5

consumer who obtains a loan for personal, family, or household purposes
when you:
(A) Originate the loan to the consumer; or
(B) Purchase the servicing rights to
the consumer’s loan.
(d) Existing customers. When an existing customer obtains a new financial
product or service from you that is to
be used primarily for personal, family,
or household purposes, you satisfy the
initial notice requirements of paragraph (a) of this section as follows:
(1) You may provide a revised privacy
notice, under § 1016.8 of this part, that
covers the customer’s new financial
product or service; or
(2) If the initial, revised, or annual
notice that you most recently provided
to that customer was accurate with respect to the new financial product or
service, you do not need to provide a
new privacy notice under paragraph (a)
of this section.
(e) Exceptions to allow subsequent delivery of notice. (1) You may provide the
initial notice required by paragraph
(a)(1) of this section within a reasonable time after you establish a customer relationship if:
(i) Establishing the customer relationship is not at the customer’s election; or
(ii) Providing notice not later than
when you establish a customer relationship would substantially delay the
customer’s transaction and the customer agrees to receive the notice at a
later time.
(2) Examples of exceptions—(i) Not at
customer’s election. (A) In the case of financial institutions other than credit
unions and financial institutions described in § 1016.3(l)(3), establishing a
customer relationship is not at the customer’s election if you acquire a customer’s deposit liability or the servicing rights to a customer’s loan from
another financial institution and the
customer does not have a choice about
your acquisition.
(B) In the case of financial institutions described in § 1016.3(l)(3), establishing a customer relationship is not
at the customer’s election if you acquire a customer’s loan or the servicing rights from another financial in-

stitution and the customer does not
have a choice about your acquisition.
(C) In the case of credit unions, establishing a customer relationship is
not at the customer’s election if you
acquire a customer’s deposit liability
from another financial institution and
the customer does not have a choice
about your acquisition.
(ii) Substantial delay of customer’s
transaction. Providing notice not later
than when you establish a customer relationship would substantially delay
the customer’s transaction when:
(A) You and the individual agree over
the telephone to enter into a customer
relationship involving prompt delivery
of the financial product or service; or
(B) You establish a customer relationship with an individual under a
program authorized by title IV of the
Higher Education Act of 1965 (20 U.S.C.
1070 et seq.) or similar student loan programs where loan proceeds are disbursed promptly without prior communication between you and the customer.
(iii) No substantial delay of customer’s
transaction. Providing notice not later
than when you establish a customer relationship would not substantially
delay the customer’s transaction when
the relationship is initiated in person
at your office or through other means
by which the customer may view the
notice, such as on a Web site.
(f) Delivery. When you are required to
deliver an initial privacy notice by this
section, you must deliver it according
to § 1016.9 of this part. If you use a
short-form initial notice for non-customers according to § 1016.6(d) of this
part, you may deliver your privacy notice according to § 1016.6(d)(3).
§ 1016.5 Annual privacy notice to customers required.
(a)(1) General rule. Except as provided
by paragraph (e) of this section, you
must provide a clear and conspicuous
notice to customers that accurately reflects your privacy policies and practices not less than annually during the
continuation of the customer relationship. Annually means at least once in
any period of 12 consecutive months
during which that relationship exists.
You may define the 12-consecutive-

497

VerDate Sep<11>2014

14:53 Mar 26, 2019

Jkt 247042

PO 00000

Frm 00507

Fmt 8010

Sfmt 8010

Q:\12\12V8.TXT

PC31

kpayne on VMOFRWIN702 with $$_JOB

§ 1016.5

12 CFR Ch. X (1–1–19 Edition)

month period, but you must apply it to
the customer on a consistent basis.
(2) Example. You provide a notice annually if you define the 12-consecutivemonth period as a calendar year and
provide the annual notice to the customer once in each calendar year following the calendar year in which you
provided the initial notice. For example, if a customer opens an account on
any day of year 1, you must provide an
annual notice to that customer by December 31 of year 2.
(b)(1) Termination of customer relationship. You are not required to provide
an annual notice to a former customer.
(2) Examples in the case of financial institutions other than credit unions and
covered entities subject to FTC enforcement jurisdiction. For purposes of this
paragraph (b)(2), ‘‘you’’ is limited to financial institutions other than credit
unions and financial institutions described in § 1016.3(l)(3). Your customer
becomes a former customer when:
(i) In the case of a deposit account,
the account is inactive under your policies;
(ii) In the case of a closed-end loan,
the customer pays the loan in full, you
charge off the loan, or you sell the loan
without retaining servicing rights;
(iii) In the case of a credit card relationship or other open-end credit relationship, you no longer provide any
statements or notices to the customer
concerning that relationship or you
sell the credit card receivables without
retaining servicing rights; or
(iv) You have not communicated with
the customer about the relationship for
a period of 12 consecutive months,
other than to provide annual privacy
notices or promotional material.
(3) Examples in the case of covered entities subject to FTC enforcement jurisdiction. For purposes of this paragraph
(b)(3), ‘‘you’’ is limited to financial institutions described in § 1016.3(l)(3) of
this part. Your customer becomes a
former customer when:
(i) In the case of a closed-end loan,
the customer pays the loan in full, you
charge off the loan, or you sell the loan
without retaining servicing rights;
(ii) In the case of a credit card relationship or other open-end credit relationship, you sell the receivables without retaining servicing rights;

(iii) In the case of credit counseling
services, the customer has failed to
make required payments under a debt
management plan, has been notified
that the plan is terminated, and you no
longer provide any statements or notices to the customer concerning that
relationship;
(iv) In the case of mortgage or vehicle loan brokering services, your customer has obtained a loan through you
(and you no longer provide any statements or notices to the customer concerning that relationship), or has
ceased using your services for such purposes;
(v) In the case of tax preparation
services, you have provided and received payment for the service and no
longer provide any statements or notices to the customer concerning that
relationship;
(vi) In the case of providing real estate settlement services, at the time
the customer completes execution of
all documents related to the real estate
closing, you have received payment, or
you have completed all of your responsibilities with respect to the settlement, including filing documents on
the public record, whichever is later; or
(vii) In cases where there is no definitive time at which the customer relationship has terminated, you have not
communicated with the customer
about the relationship for a period of 12
consecutive months, other than to provide annual privacy notices or promotional material.
(4) Examples in the case of a credit
union. An individual becomes a former
customer of a credit union when:
(i) The individual is no longer the
credit union’s member as defined in the
credit union’s bylaws;
(ii) In the case of a nonmember’s
share or share draft account, the account is inactive under the credit
union’s policies;
(iii) In the case of a nonmember’s
closed-end loan, the loan is paid in full,
the credit union charges off the loan,
or the credit union sells the loan without retaining servicing rights;
(iii) In the case of a credit card relationship or other open-end credit relationship with a nonmember, the credit
union no longer provides any statements or notices to the nonmember

498

VerDate Sep<11>2014

14:53 Mar 26, 2019

Jkt 247042

PO 00000

Frm 00508

Fmt 8010

Sfmt 8010

Q:\12\12V8.TXT

PC31

kpayne on VMOFRWIN702 with $$_JOB

Bur. of Consumer Financial Protection

§ 1016.6

concerning that relationship, or the
credit union sells the credit card receivables without retaining servicing
rights; or
(v) The credit union has not communicated with the nonmember about the
relationship for a period of 12 consecutive months, other than to provide annual privacy notices or promotional
material.
(c) Special rule for loans in the case of
a financial institution other than a credit
union. If a financial institution other
than a credit union does not have a
customer relationship with a consumer
under the special rule for loans in
§ 1016.4(c)(2) of this part, then it need
not provide an annual notice to that
consumer under this section.
(d) Delivery. When you are required to
deliver an annual privacy notice by
this section, you must deliver it according to § 1016.9 of this part.
(e) Exception to annual privacy notice
requirement—(1) When exception available. You are not required to deliver an
annual privacy notice if you:
(i) Provide nonpublic personal information to nonaffiliated third parties
only in accordance with the provisions
of § 1016.13, § 1016.14, or § 1016.15; and
(ii) Have not changed your policies
and practices with regard to disclosing
nonpublic personal information from
the policies and practices that were
disclosed to the customer under
§ 1016.6(a)(2) through (5) and (9) in the
most recent privacy notice provided
pursuant to this part.
(2) Delivery of annual privacy notice
after financial institution no longer meets
requirements for exception. If you have
been excepted from delivering an annual privacy notice pursuant to paragraph (e)(1) of this section and change
your policies or practices in such a way
that you no longer meet the requirements for that exception, you must
comply with paragraph (e)(2)(i) or
(e)(2)(ii) of this section, as applicable.
(i) Changes preceded by a revised privacy notice. If you no longer meet the
requirements of paragraph (e)(1) of this
section because you change your policies or practices in such a way that
§ 1016.8 requires you to provide a revised privacy notice, you must provide
an annual privacy notice in accordance
with the timing requirements in para-

graph (a) of this section, treating the
revised privacy notice as an initial privacy notice.
(ii) Changes not preceded by a revised
privacy notice. If you no longer meet
the requirements of paragraph (e)(1) of
this section because you change your
policies or practices in such a way that
§ 1016.8 does not require you to provide
a revised privacy notice, you must provide an annual privacy notice within
100 days of the change in your policies
or practices that causes you to no
longer meet the requirements of paragraph (e)(1) of this section.
(iii) Examples. (A) You change your
policies and practices in such a way
that you no longer meet the requirements of paragraph (e)(1) of this section effective April 1 of year 1. Assuming you define the 12-consecutivemonth period pursuant to paragraph
(a) of this section as a calendar year, if
you were required to provide a revised
privacy notice under § 1016.8 and you
provided that notice on March 1 of year
1, you must provide an annual privacy
notice by December 31 of year 2. If you
were not required to provide a revised
privacy notice under § 1016.8, you must
provide an annual privacy notice by
July 9 of year 1.
(B) You change your policies and
practices in such a way that you no
longer meet the requirements of paragraph (e)(1) of this section, and so provide an annual notice to your customers. After providing the annual notice to your customers, you once again
meet the requirements of paragraph
(e)(1) of this section for an exception to
the annual notice requirement. You do
not need to provide additional annual
notices to your customers until such
time as you no longer meet the requirements of paragraph (e)(1) of this
section.
[76 FR 79028, Dec. 21, 2011, as amended by
CFPB-2016-0032, 83 FR 40958, Aug. 17, 2018]

§ 1016.6 Information to be included in
privacy notices.
(a) General rule. The initial, annual,
and revised privacy notices that you
provide under §§ 1016.4, 1016.5, and 1016.8
of this part must include each of the
following items of information, in addition to any other information you wish
to provide, that applies to you and to

499

VerDate Sep<11>2014

14:53 Mar 26, 2019

Jkt 247042

PO 00000

Frm 00509

Fmt 8010

Sfmt 8010

Q:\12\12V8.TXT

PC31

kpayne on VMOFRWIN702 with $$_JOB

§ 1016.6

12 CFR Ch. X (1–1–19 Edition)

the consumers to whom you send your
privacy notice:
(1) The categories of nonpublic personal information that you collect;
(2) The categories of nonpublic personal information that you disclose;
(3) The categories of affiliates and
nonaffiliated third parties to whom
you disclose nonpublic personal information, other than those parties to
whom you disclose information under
§§ 1016.14 and 1016.15 of this part;
(4) The categories of nonpublic personal information about your former
customers that you disclose and the
categories of affiliates and nonaffiliated third parties to whom you
disclose nonpublic personal information about your former customers,
other than those parties to whom you
disclose information under §§ 1016.14
and 1016.15;
(5) If you disclose nonpublic personal
information to a nonaffiliated third
party under § 1016.13 (and no other exception in § 1016.14 or § 1016.15 applies to
that disclosure), a separate statement
of the categories of information you
disclose and the categories of third parties with whom you have contracted;
(6) An explanation of the consumer’s
right under § 1016.10(a) of this part to
opt out of the disclosure of nonpublic
personal information to nonaffiliated
third parties, including the method(s)
by which the consumer may exercise
that right at that time;
(7) Any disclosures that you make
under section 603(d)(2)(A)(iii) of the
Fair Credit Reporting Act (15 U.S.C.
1681a(d)(2)(A)(iii)) (that is, notices regarding the ability to opt out of disclosures of information among affiliates);
(8) Your policies and practices with
respect to protecting the confidentiality and security of nonpublic personal information; and
(9) Any disclosure that you make
under paragraph (b) of this section.
(b) Description of nonaffiliated third
parties subject to exceptions. If you disclose nonpublic personal information
to third parties as authorized under
§§ 1016.14 and 1016.15, you are not required to list those exceptions in the
initial or annual privacy notices required by §§ 1016.4 and 1016.5. When describing the categories with respect to
those parties, it is sufficient to state

that you make disclosures to other
nonaffiliated companies:
(1) For your everyday business purposes, such as [include all that apply] to
process transactions, maintain account(s), respond to court orders and
legal investigations, or report to credit
bureaus; or
(2) As permitted by law.
(c) Examples—(1) Categories of nonpublic personal information that you collect. You satisfy the requirement to
categorize the nonpublic personal information that you collect if you list
the following categories, as applicable:
(i) Information from the consumer;
(ii) Information about the consumer’s
transactions with you or your affiliates;
(iii) Information about the consumer’s transactions with nonaffiliated
third parties; and
(iv) Information from a consumer reporting agency.
(2) Categories of nonpublic personal information you disclose. (i) You satisfy
the requirement to categorize the nonpublic personal information that you
disclose if you list the categories described in paragraph (c)(1) of this section, as applicable, and a few examples
to illustrate the types of information
in each category.
(ii) If you reserve the right to disclose all of the nonpublic personal information about consumers that you
collect, you may simply state that fact
without describing the categories or
examples of the nonpublic personal information you disclose.
(3) Categories of affiliates and nonaffiliated third parties to whom you disclose. You satisfy the requirement to
categorize the affiliates and nonaffiliated third parties to whom you
disclose nonpublic personal information if you list the following categories, as applicable, and a few examples to illustrate the types of third parties in each category.
(i) Financial service providers, followed by illustrative examples such as
mortgage bankers, securities brokerdealers, and insurance agents;
(ii) Non-financial companies, followed by illustrative examples such as
retailers, magazine publishers, airlines,
and direct marketers; and

500

VerDate Sep<11>2014

14:53 Mar 26, 2019

Jkt 247042

PO 00000

Frm 00510

Fmt 8010

Sfmt 8010

Q:\12\12V8.TXT

PC31

kpayne on VMOFRWIN702 with $$_JOB

Bur. of Consumer Financial Protection

§ 1016.7

(iii) Others, followed by examples
such as nonprofit organizations.
(4) Disclosures under exception for service providers and joint marketers. If you
disclose nonpublic personal information under the exception in § 1016.13 of
this part to a nonaffiliated third party
to market products or services that
you offer alone or jointly with another
financial institution, you satisfy the
disclosure requirement of paragraph
(a)(5) of this section if you:
(i) List the categories of nonpublic
personal information you disclose,
using the same categories and examples you used to meet the requirements
of paragraph (a)(2) of this section, as
applicable; and
(ii) State whether the third party is:
(A) A service provider that performs
marketing services on your behalf or
on behalf of you and another financial
institution; or
(B) A financial institution with
whom you have a joint marketing
agreement.
(5) Simplified notices. If you do not disclose, and do not wish to reserve the
right to disclose, nonpublic personal
information about customers or former
customers to affiliates or nonaffiliated
third parties except as authorized
under §§ 1016.14 and 1016.15, you may
simply state that fact, in addition to
the information you must provide
under paragraphs (a)(1), (a)(8), (a)(9),
and (b) of this section.
(6) Confidentiality and security. You
describe your policies and practices
with respect to protecting the confidentiality and security of nonpublic
personal information if you do both of
the following:
(i) Describe in general terms who is
authorized to have access to the information; and
(ii) State whether you have security
practices and procedures in place to ensure the confidentiality of the information in accordance with your policy.
You are not required to describe technical information about the safeguards
you use.
(d) Short-form initial notice with opt
out notice for non-customers. (1) You
may satisfy the initial notice requirements in §§ 1016.4(a)(2), 1016.7(b), and
1016.7(c) of this part for a consumer
who is not a customer by providing a

short-form initial notice at the same
time as you deliver an opt out notice
as required in § 1016.7.
(2) A short-form initial notice must:
(i) Be clear and conspicuous;
(ii) State that your privacy notice is
available upon request; and
(iii) Explain a reasonable means by
which the consumer may obtain that
notice.
(3) You must deliver your short-form
initial notice according to § 1016.9. You
are not required to deliver your privacy notice with your short-form initial notice. You instead may simply
provide the consumer a reasonable
means to obtain your privacy notice. If
a consumer who receives your shortform notice requests your privacy notice, you must deliver your privacy notice according to § 1016.9.
(4) Examples of obtaining privacy notice. You provide a reasonable means by
which a consumer may obtain a copy of
your privacy notice if you:
(i) Provide a toll-free telephone number that the consumer may call to request the notice; or
(ii) For a consumer who conducts
business in person at your office, maintain copies of the notice on hand that
you provide to the consumer immediately upon request.
(e) Future disclosures. Your notice
may include:
(1) Categories of nonpublic personal
information that you reserve the right
to disclose in the future, but do not
currently disclose; and
(2) Categories of affiliates or nonaffiliated third parties to whom you reserve the right in the future to disclose, but to whom you do not currently disclose, nonpublic personal information.
(f) Model privacy form. Pursuant to
§ 1016.2(a) of this part, a model privacy
form that meets the notice content requirements of this section is included
in the appendix to this part.
§ 1016.7 Form of opt out notice to consumers; opt out methods.
(a)(1) Form of opt out notice. If you are
required to provide an opt out notice
under § 1016.10(a), you must provide a
clear and conspicuous notice to each of

501

VerDate Sep<11>2014

14:53 Mar 26, 2019

Jkt 247042

PO 00000

Frm 00511

Fmt 8010

Sfmt 8010

Q:\12\12V8.TXT

PC31

kpayne on VMOFRWIN702 with $$_JOB

§ 1016.7

12 CFR Ch. X (1–1–19 Edition)

your consumers that accurately explains the right to opt out under that
section. The notice must state:
(i) That you disclose or reserve the
right to disclose nonpublic personal information about your consumer to a
nonaffiliated third party;
(ii) That the consumer has the right
to opt out of that disclosure; and
(iii) A reasonable means by which the
consumer may exercise the opt out
right.
(2) Examples—(i) Adequate opt out notice. You provide adequate notice that
the consumer can opt out of the disclosure of nonpublic personal information
to a nonaffiliated third party if you:
(A) Identify all of the categories of
nonpublic personal information that
you disclose or reserve the right to disclose, and all of the categories of nonaffiliated third parties to which you
disclose the information, as described
in § 1016.6(a)(2) and (3) of this part, and
state that the consumer can opt out of
the disclosure of that information; and
(B) Identify the financial products or
services that the consumer obtains
from you, either singly or jointly, to
which the opt out direction would
apply.
(ii) Reasonable opt out means. You provide a reasonable means to exercise an
opt out right if you:
(A) Designate check-off boxes in a
prominent position on the relevant
forms with the opt out notice;
(B) Include a reply form together
with the opt out notice that, in the
case of financial institutions described
in § 1016.3(l)(3) of this part, includes the
address to which the form should be
mailed;
(C) Provide an electronic means to
opt out, such as a form that can be sent
via electronic mail or a process at your
Web site, if the consumer agrees to the
electronic delivery of information; or
(D) Provide a toll-free telephone
number that consumers may call to opt
out.
(iii) Unreasonable opt out means. You
do not provide a reasonable means of
opting out if:
(A) The only means of opting out is
for the consumer to write his or her
own letter to exercise that opt out
right; or

(B) The only means of opting out as
described in any notice subsequent to
the initial notice is to use a check-off
box that you provided with the initial
notice but did not include with the subsequent notice.
(iv) Specific opt out means. You may
require each consumer to opt out
through a specific means, as long as
that means is reasonable for that consumer.
(b) Same form as initial notice permitted. You may provide the opt out notice together with or on the same written or electronic form as the initial notice you provide in accordance with
§ 1016.4.
(c) Initial notice required when opt out
notice delivered subsequent to initial notice. If you provide the opt out notice
later than required for the initial notice in accordance with § 1016.4 of this
part, you must also include a copy of
the initial notice with the opt out notice in writing or, if the consumer
agrees, electronically.
(d) Joint relationships in the case of financial institutions other than credit
unions and covered entities subject to
FTC enforcement jurisdiction. For purposes of this paragraph (d), ‘‘you’’ is
limited to financial institutions other
than credit unions and financial institutions described in § 1016.3(l)(3) of this
part.
(1) If two or more consumers jointly
obtain a financial product or service
from you, you may provide a single opt
out notice. Your opt out notice must
explain how you will treat an opt out
direction by a joint consumer (as explained in paragraph (d)(5) of this section).
(2) Any of the joint consumers may
exercise the right to opt out. You may
either:
(i) Treat an opt out direction by a
joint consumer as applying to all of the
associated joint consumers; or
(ii) Permit each joint consumer to
opt out separately.
(3) If you permit each joint consumer
to opt out separately, you must permit
one of the joint consumers to opt out
on behalf of all of the joint consumers.
(4) You may not require all joint consumers to opt out before you implement any opt out direction.

502

VerDate Sep<11>2014

14:53 Mar 26, 2019

Jkt 247042

PO 00000

Frm 00512

Fmt 8010

Sfmt 8010

Q:\12\12V8.TXT

PC31

kpayne on VMOFRWIN702 with $$_JOB

Bur. of Consumer Financial Protection

§ 1016.7

(5) Example. If John and Mary have a
joint checking account with you and
arrange for you to send statements to
John’s address, you may do any of the
following, but you must explain in
your opt out notice which opt out policy you will follow:
(i) Send a single opt out notice to
John’s address, but you must accept an
opt out direction from either John or
Mary.
(ii) Treat an opt out direction by either John or Mary as applying to the
entire account. If you do so, and John
opts out, you may not require Mary to
opt out as well before implementing
John’s opt out direction.
(iii) Permit John and Mary to make
different opt out directions. If you do
so:
(A) You must permit John and Mary
to opt out for each other;
(B) If both opt out, you must permit
both to notify you in a single response
(such as on a form or through a telephone call); and
(C) If John opts out and Mary does
not, you may only disclose nonpublic
personal information about Mary, but
not about John and not about John and
Mary jointly.
(e) Joint relationships in the case of
credit unions. (1) If two or more consumers jointly obtain a financial product or service, other than a loan, from
a credit union, the credit union may
provide only a single opt out notice.
The opt out notice must explain how
the credit union will treat an opt out
direction by a joint consumer (as explained in the examples in paragraph
(e)(5) of this section).
(2) Any of the joint consumers may
exercise the right to opt out. A credit
union may either:
(i) Treat an opt out direction by a
joint consumer to apply to all of the
associated joint consumers; or
(ii) Permit each joint consumer to
opt out separately.
(3) If a credit union permits each
joint consumer to opt out separately,
the credit union must permit one of
the joint consumers to opt out on behalf of all of the joint consumers.
(4) A credit union may not require all
joint consumers to opt out before the
credit union implements any opt out
direction.

(5) Example. If John and Mary have a
joint share account with a credit union
and arrange for the credit union to
send statements to John’s address, the
credit union may do any of the following, but it must explain in its opt
out notice which opt out policy it will
follow:
(i) Send a single opt out notice to
John’s address, but it must accept an
opt out direction from either John or
Mary.
(ii) Treat an opt out direction by either John or Mary as applying to the
entire account. If it does so, and John
opts out, it may not require Mary to
opt out as well before implementing
John’s opt out direction.
(iii) Permit John and Mary to make
different opt out directions. If it does
so, and if John and Mary both opt out,
it must permit one or both of them to
notify it in a single response (such as
on a form or through a telephone call).
(6) Special rule for loans. (i) A credit
union is required to provide an initial
opt out notice to a borrower or guarantor on a loan if it shares his or her
nonpublic personal information with
nonaffiliated third parties other than
for purposes under §§ 1016.13, 1016.14,
and 1016.15.
(ii) A credit union may satisfy its annual opt out notice requirement by
providing one notice to those borrowers and guarantors jointly.
(f) Joint relationships in the case of covered entities subject to FTC enforcement
jurisdiction. For purposes of this paragraph (f), ‘‘you’’ is limited to the financial
institutions
described
in
§ 1016.3(l)(3).
(1) If two or more consumers jointly
obtain a financial product or service
from you, you may provide a single opt
out notice, unless one or more of those
consumers requests a separate opt out
notice. Your opt out notice must explain how you will treat an opt out direction by a joint consumer (as explained in paragraph (f)(5) of this section).
(2) Any of the joint consumers may
exercise the right to opt out. You may
either:
(i) Treat an opt out direction by a
joint consumer as applying to all of the
associated joint consumers; or

503

VerDate Sep<11>2014

14:53 Mar 26, 2019

Jkt 247042

PO 00000

Frm 00513

Fmt 8010

Sfmt 8010

Q:\12\12V8.TXT

PC31

kpayne on VMOFRWIN702 with $$_JOB

§ 1016.8

12 CFR Ch. X (1–1–19 Edition)

(ii) Permit each joint consumer to
opt out separately.
(3) If you permit each joint consumer
to opt out separately, you must permit
one of the joint consumers to opt out
on behalf of all of the joint consumers.
(4) You may not require all joint consumers to opt out before you implement any opt out direction.
(5) Example. If John and Mary have a
joint credit card account with you and
arrange for you to send statements to
John’s address, you may do any of the
following, but you must explain in
your opt out notice which opt out policy you will follow:
(i) Send a single opt out notice to
John’s address, but you must accept an
opt out direction from either John or
Mary.
(ii) Treat an opt out direction by either John or Mary as applying to the
entire account. If you do so, and John
opts out, you may not require Mary to
opt out as well before implementing
John’s opt out direction.
(iii) Permit John and Mary to make
different opt out directions. If you do
so:
(A) You must permit John and Mary
to opt out for each other;
(B) If both opt out, you must permit
both to notify you in a single response
(such as on a form or through a telephone call); and
(C) If John opts out and Mary does
not, you may only disclose nonpublic
personal information about Mary, but
not about John and not about John and
Mary jointly.
(g) Time to comply with opt out. You
must comply with a consumer’s opt out
direction as soon as reasonably practicable after you receive it.
(h) Continuing right to opt out. A consumer may exercise the right to opt
out at any time.
(i) Duration of consumer’s opt out direction. (1) A consumer’s direction to
opt out under this section is effective
until the consumer revokes it in writing or, if the consumer agrees, electronically.
(2) When a customer relationship terminates, the customer’s opt out direction continues to apply to the nonpublic personal information that you
collected during or related to that relationship. If the individual subsequently

establishes a new customer relationship with you, the opt out direction
that applied to the former relationship
does not apply to the new relationship.
(j) Delivery. When you are required to
deliver an opt out notice by this section, you must deliver it according to
§ 1016.9 of this part.
(k) Model privacy form. Pursuant to
§ 1016.2(a) of this part, a model privacy
form that meets the notice content requirements of this section is included
in the appendix to this part.
§ 1016.8 Revised privacy notices.
(a) General rule. Except as otherwise
authorized in this part, you must not,
directly or through any affiliate, disclose any nonpublic personal information about a consumer to a nonaffiliated third party other than as described in the initial notice that you
provided to that consumer under
§ 1016.4 of this part, unless:
(1) You have provided to the consumer a clear and conspicuous revised
notice that accurately describes your
policies and practices;
(2) You have provided to the consumer a new opt out notice;
(3) You have given the consumer a
reasonable opportunity, before you disclose the information to the nonaffiliated third party, to opt out of the
disclosure; and
(4) The consumer does not opt out.
(b) Examples. (1) Except as otherwise
permitted by §§ 1016.13, 1016.14, and
1016.15 of this part, you must provide a
revised notice before you:
(i) Disclose a new category of nonpublic personal information to any
nonaffiliated third party;
(ii) Disclose nonpublic personal information to a new category of nonaffiliated third party; or
(iii) Disclose nonpublic personal information about a former customer to
a nonaffiliated third party, if that
former customer has not had the opportunity to exercise an opt out right
regarding that disclosure.
(2) A revised notice is not required if
you disclose nonpublic personal information to a new nonaffiliated third
party that you adequately described in
your prior notice.
(c) Delivery. When you are required to
deliver a revised privacy notice by this

504

VerDate Sep<11>2014

14:53 Mar 26, 2019

Jkt 247042

PO 00000

Frm 00514

Fmt 8010

Sfmt 8010

Q:\12\12V8.TXT

PC31

Bur. of Consumer Financial Protection

§ 1016.9

kpayne on VMOFRWIN702 with $$_JOB

section, you must deliver it according
to § 1016.9 of this part.
§ 1016.9 Delivering privacy and opt out
notices.
(a) How to provide notices. You must
provide any privacy notices and opt
out notices, including short-form initial notices, that this part requires so
that each consumer can reasonably be
expected to receive actual notice in
writing or, if the consumer agrees,
electronically.
(b)(1) Examples of reasonable expectation of actual notice. You may reasonably expect that a consumer will receive actual notice if you:
(i) Hand-deliver a printed copy of the
notice to the consumer;
(ii) Mail a printed copy of the notice
to the last known address of the consumer;
(iii) For the consumer who conducts
transactions electronically:
(A) In the case of financial institutions other than those described in
§ 1016.3(l)(3) of this part, post the notice
on the electronic site and require the
consumer to acknowledge receipt of
the notice as a necessary step to obtaining a particular financial product
or service; or
(B) In the case of financial institutions described in § 1016.3(l)(3), clearly
and conspicuously post the notice on
the electronic site and require the consumer to acknowledge receipt of the
notice as a necessary step to obtaining
a particular financial product or service;
(iv) For an isolated transaction with
the consumer, such as an ATM transaction, post the notice on the ATM
screen and require the consumer to acknowledge receipt of the notice as a
necessary step to obtaining the particular financial product or service.
(2) Examples of unreasonable expectation of actual notice. You may not, however, reasonably expect that a consumer will receive actual notice of
your privacy policies and practices if
you:
(i) Only post a sign in your branch or
office or generally publish advertisements of your privacy policies and
practices; or
(ii) Send the notice via electronic
mail to a consumer who does not ob-

tain a financial product or service from
you electronically.
(c) Annual notices only. You may reasonably expect that a customer will receive actual notice of your annual privacy notice if:
(1) The customer uses your website to
access financial products and services
electronically and agrees to receive notices at the website, and you post your
current privacy notice continuously in
a clear and conspicuous manner on the
website; or
(2) The customer has requested that
you refrain from sending any information regarding the customer relationship, and your current privacy notice
remains available to the customer
upon request.
(d) Oral description of notice insufficient. You may not provide any notice
required by this part solely by orally
explaining the notice, either in person
or over the telephone.
(e) Retention or accessibility of notices
for customers. (1) For customers only,
you must provide the initial notice required by § 1016.4(a)(1), the annual notice required by § 1016.5(a), and the revised notice required by § 1016.8 so that
the customer can retain them or obtain
them later in writing or, if the customer agrees, electronically.
(2) Examples of retention or accessibility. You provide a privacy notice to
the customer so that the customer can
retain it or obtain it later if you:
(i) Hand-deliver a printed copy of the
notice to the customer;
(ii) Mail a printed copy of the notice
to the last known address of the customer, or, in the case of credit unions,
mail a printed copy of the notice to the
last known address of the customer
upon request of the customer; or
(iii) Make your current privacy notice available on a Web site (or a link
to another Web site) for the customer
who obtains a financial product or
service electronically and agrees to receive the notice at the Web site.
(f) Joint notice with other financial institutions. You may provide a joint notice from you and one or more of your
affiliates or other financial institutions, as identified in the notice, as
long as the notice is accurate with respect to you and the other institutions.

505

VerDate Sep<11>2014

14:53 Mar 26, 2019

Jkt 247042

PO 00000

Frm 00515

Fmt 8010

Sfmt 8010

Q:\12\12V8.TXT

PC31

§ 1016.10

12 CFR Ch. X (1–1–19 Edition)

(g) Joint relationships in the case of financial institutions other than credit
unions and covered entities subject to
FTC enforcement jurisdiction. For purposes of this paragraph (g), ‘‘you’’ is
limited to financial institutions other
than credit unions and the financial institutions described in § 1016.3(l)(3). If
two or more consumers jointly obtain a
financial product or service from you,
you may satisfy the initial, annual,
and revised notice requirements of
§§ 1016.4(a), 1016.5(a), and 1016.8(a), respectively, by providing one notice to
those consumers jointly.
(h) Joint relationships in the case of
covered entities subject to FTC enforcement jurisdiction. For purposes of this
paragraph (h), ‘‘you’’ is limited to the
financial institutions described in
§ 1016.3(l)(3). If two or more consumers
jointly obtain a financial product or
service from you, you may satisfy the
initial, annual, and revised notice requirements of §§ 1016.4(a), 1016.5(a), and
1016.8(a) by providing one notice to
those consumers jointly, unless one or
more of those consumers requests separate notices.
(i) Joint relationships in the case of
credit unions. (1) If two or more consumers jointly obtain a financial product or service, other than a loan, from
a credit union, the credit union may
satisfy the requirements of § 1016.4(a)
by providing one initial notice to those
consumers jointly.
(2) Special rule for loans in the case of
credit unions. (i) A credit union is required to provide an initial notice to a
borrower or guarantor on a loan if the
credit union shares his or her nonpublic personal information with nonaffiliated third parties other than for
purposes under §§ 1016.13, 1016.14, and
1016.15.
(ii) A credit union may satisfy the
annual notice requirements of § 1016.5
by providing one notice to those borrowers and guarantors jointly.

kpayne on VMOFRWIN702 with $$_JOB

[76 FR 79028, Dec. 21, 2011, as amended at 79
FR 64081, Oct. 28, 2014; CFPB-2016-0032, 83 FR
40959, Aug. 17, 2018]

Subpart B—Limits on Disclosures
§ 1016.10 Limits on disclosure of nonpublic personal information to nonaffiliated third parties.
(a)(1) Conditions for disclosure. Except
as otherwise authorized in this part,
you may not, directly or through any
affiliate, disclose any nonpublic personal information about a consumer to
a nonaffiliated third party unless:
(i) You have provided to the consumer an initial notice as required
under § 1016.4 of this part;
(ii) You have provided to the consumer an opt out notice as required in
§ 1016.7 of this part;
(iii) You have given the consumer a
reasonable opportunity, before you disclose the information to the nonaffiliated third party, to opt out of the
disclosure; and
(iv) The consumer does not opt out.
(2) Opt out definition. Opt out means a
direction by the consumer that you not
disclose nonpublic personal information about that consumer to a nonaffiliated third party, other than as
permitted by §§ 1016.13, 1016.14, and
1016.15.
(3) Examples of reasonable opportunity
to opt out. You provide a consumer with
a reasonable opportunity to opt out if:
(i) By mail. You mail the notices required in paragraph (a)(1) of this section to the consumer and allow the
consumer to opt out by mailing a form,
calling a toll-free telephone number, or
any other reasonable means within 30
days from the date you mailed the notices.
(ii) By electronic means. A customer
opens an online account with you and
agrees to receive the notices required
in paragraph (a)(1) of this section electronically, and you allow the customer
to opt out by any reasonable means
within 30 days after the date that the
customer acknowledges receipt of the
notices in conjunction with opening
the account.
(iii) Isolated transaction with consumer. For an isolated transaction,
such as the purchase of a cashier’s
check by a consumer, you provide the
consumer with a reasonable opportunity to opt out if you provide the notices required in paragraph (a)(1) of

506

VerDate Sep<11>2014

14:53 Mar 26, 2019

Jkt 247042

PO 00000

Frm 00516

Fmt 8010

Sfmt 8010

Q:\12\12V8.TXT

PC31

Bur. of Consumer Financial Protection

§ 1016.11

kpayne on VMOFRWIN702 with $$_JOB

this section at the time of the transaction and request that the consumer
decide, as a necessary part of the transaction, whether to opt out before completing the transaction.
(b) Application of opt out to all consumers and all nonpublic personal information. (1) You must comply with this
section, regardless of whether you and
the consumer have established a customer relationship.
(2) Unless you comply with this section, you may not, directly or through
any affiliate, disclose any nonpublic
personal information about a consumer
that you have collected, regardless of
whether you collected it before or after
receiving the direction to opt out from
the consumer.
(c) Partial opt out. You may allow a
consumer to select certain nonpublic
personal information or certain nonaffiliated third parties with respect to
which the consumer wishes to opt out.
§ 1016.11 Limits on redisclosure and
reuse of information.
(a)(1) Information you receive under an
exception. If you receive nonpublic personal information from a nonaffiliated
financial institution under an exception in § 1016.14 or § 1016.15 of this part,
your disclosure and use of that information is limited as follows:
(i) You may disclose the information
to the affiliates of the financial institution from which you received the information;
(ii) You may disclose the information
to your affiliates, but your affiliates
may, in turn, disclose and use the information only to the extent that you
may disclose and use the information;
and
(iii) You may disclose and use the information pursuant to an exception in
§ 1016.14 or § 1016.15 in the ordinary
course of business to carry out the activity covered by the exception under
which you received the information.
(2) Example. If you receive a customer
list from a nonaffiliated financial institution in order to provide account
processing services under the exception
in § 1016.14(a), you may disclose that information under any exception in
§ 1016.14 or § 1016.15 in the ordinary
course of business in order to provide
those services. For example, you could

disclose the information in response to
a properly authorized subpoena or, in
the case of financial institutions other
than those described in § 1016.3(l)(3), to
your attorneys, accountants, and auditors. You could not disclose that information to a third party for marketing
purposes or use that information for
your own marketing purposes.
(b)(1) Information you receive outside of
an exception. If you receive nonpublic
personal information from a nonaffiliated financial institution other
than under an exception in § 1016.14 or
§ 1016.15 of this part, you may disclose
the information only:
(i) To the affiliates of the financial
institution from which you received
the information;
(ii) To your affiliates, but your affiliates may, in turn, disclose the information only to the extent that you can
disclose the information; and
(iii) To any other person, if the disclosure would be lawful if made directly to that person by the financial
institution from which you received
the information.
(2) Example. If you obtain a customer
list from a nonaffiliated financial institution outside of the exceptions in
§§ 1016.14 and 1016.15:
(i) You may use that list for your
own purposes; and
(ii) You may disclose that list to another nonaffiliated third party only if
the financial institution from which
you purchased the list could have lawfully disclosed the list to that third
party. That is, you may disclose the
list in accordance with the privacy policy of the financial institution from
which you received the list, as limited
by the opt out direction of each consumer whose nonpublic personal information you intend to disclose, and you
may disclose the list in accordance
with an exception in § 1016.14 or
§ 1016.15, such as to your attorneys or
accountants.
(c) Information you disclose under an
exception. If you disclose nonpublic personal information to a nonaffiliated
third party under an exception in
§ 1016.14 or § 1016.15 of this part, the
third party may disclose and use that
information only as follows:
(1) The third party may disclose the
information to your affiliates;

507

VerDate Sep<11>2014

14:53 Mar 26, 2019

Jkt 247042

PO 00000

Frm 00517

Fmt 8010

Sfmt 8010

Q:\12\12V8.TXT

PC31

§ 1016.12

12 CFR Ch. X (1–1–19 Edition)

(2) The third party may disclose the
information to its affiliates, but its affiliates may, in turn, disclose and use
the information only to the extent that
the third party may disclose and use
the information; and
(3) The third party may disclose and
use the information pursuant to an exception in § 1016.14 or § 1016.15 in the ordinary course of business to carry out
the activity covered by the exception
under which it received the information.
(d) Information you disclose outside of
an exception. If you disclose nonpublic
personal information to a nonaffiliated
third party other than under an exception in § 1016.14 or § 1016.15 of this part,
the third party may disclose the information only:
(1) To your affiliates;
(2) To its affiliates, but its affiliates,
in turn, may disclose the information
only to the extent the third party can
disclose the information; and
(3) To any other person, if the disclosure would be lawful if you made it directly to that person.

kpayne on VMOFRWIN702 with $$_JOB

§ 1016.12 Limits on sharing account
number information for marketing
purposes.
(a) General prohibition on disclosure of
account numbers. You must not, directly or through an affiliate, disclose,
other than to a consumer reporting
agency, an account number or similar
form of access number or access code
for a consumer’s credit card account,
deposit account, share account, or
transaction account to any nonaffiliated third party for use in telemarketing, direct mail marketing, or
other marketing through electronic
mail to the consumer.
(b) Exceptions. Paragraph (a) of this
section does not apply if you disclose
an account number or similar form of
access number or access code:
(1) To your agent or service provider
solely in order to perform marketing
for your own products or services, as
long as the agent or service provider is
not authorized to directly initiate
charges to the account; or
(2) To a participant in a private label
credit card program or an affinity or
similar program where the participants
in the program are identified to the

customer when the customer enters
into the program.
(c) Examples—(1) Account number. An
account number, or similar form of access number or access code, does not
include a number or code in an
encrypted form, as long as you do not
provide the recipient with a means to
decode the number or code.
(2) Transaction account. A transaction
account is an account other than a deposit account, a share account, or a
credit card account. A transaction account does not include an account to
which third parties cannot initiate
charges.

Subpart C—Exceptions
§ 1016.13 Exception to opt out requirements for service providers and
joint marketing.
(a) General rule. (1) The opt out requirements in §§ 1016.7 and 1016.10 of
this part do not apply when you provide nonpublic personal information to
a nonaffiliated third party to perform
services for you or functions on your
behalf, if you:
(i) Provide the initial notice in accordance with § 1016.4; and
(ii) Enter into a contractual agreement with the third party that prohibits the third party from disclosing
or using the information other than to
carry out the purposes for which you
disclosed the information, including
use under an exception in § 1016.14 or
§ 1016.15 in the ordinary course of business to carry out those purposes.
(2) Example. If you disclose nonpublic
personal information under this section to a financial institution with
which you perform joint marketing,
your contractual agreement with that
institution meets the requirements of
paragraph (a)(1)(ii) of this section if it
prohibits the institution from disclosing or using the nonpublic personal
information except as necessary to
carry out the joint marketing or under
an exception in § 1016.14 or § 1016.15 in
the ordinary course of business to
carry out that joint marketing.
(b) Service may include joint marketing.
The services a nonaffiliated third party
performs for you under paragraph (a) of
this section may include marketing of

508

VerDate Sep<11>2014

14:53 Mar 26, 2019

Jkt 247042

PO 00000

Frm 00518

Fmt 8010

Sfmt 8010

Q:\12\12V8.TXT

PC31

Bur. of Consumer Financial Protection

§ 1016.15

your own products or services or marketing of financial products or services
offered pursuant to joint agreements
between you and one or more financial
institutions.
(c) Definition of joint agreement. For
purposes of this section, joint agreement means a written contract pursuant to which you and one or more financial institutions jointly offer, endorse, or sponsor a financial product or
service.

kpayne on VMOFRWIN702 with $$_JOB

§ 1016.14 Exceptions to notice and opt
out requirements for processing
and servicing transactions.
(a) Exceptions for processing transactions at consumer’s request. The requirements for initial notice in
§ 1016.4(a)(2), for the opt out in §§ 1016.7
and 1016.10, and for service providers
and joint marketing in § 1016.13 do not
apply if you disclose nonpublic personal information as necessary to effect, administer, or enforce a transaction that a consumer requests or authorizes, or in connection with:
(1) Servicing or processing a financial
product or service that a consumer requests or authorizes;
(2) Maintaining or servicing the consumer’s account with you, or with another entity as part of a private label
credit card program or other extension
of credit on behalf of such entity; or
(3)
A
proposed
or
actual
securitization, secondary market sale
(including sales of servicing rights), or
similar transaction related to a transaction of the consumer.
(b) Necessary to effect, administer, or
enforce a transaction means that the
disclosure is:
(1) Required, or is one of the lawful
or appropriate methods, to enforce
your rights or the rights of other persons engaged in carrying out the financial transaction or providing the product or service; or
(2) Required, or is a usual, appropriate or acceptable method:
(i) To carry out the transaction or
the product or service business of
which the transaction is a part, and
record, service, or maintain the consumer’s account in the ordinary course
of providing the financial service or financial product;

(ii) To administer or service benefits
or claims relating to the transaction or
the product or service business of
which it is a part;
(iii) To provide a confirmation, statement, or other record of the transaction, or information on the status or
value of the financial service or financial product to the consumer or the
consumer’s agent or broker;
(iv) To accrue or recognize incentives
or bonuses associated with the transaction that are provided by you or any
other party;
(v) To underwrite insurance at the
consumer’s request or for reinsurance
purposes, or for any of the following
purposes as they relate to a consumer’s
insurance: account administration, reporting, investigating, or preventing
fraud or material misrepresentation,
processing premium payments, processing insurance claims, administering
insurance benefits (including utilization review activities), participating in
research projects, or as otherwise required or specifically permitted by
Federal or state law; or
(vi) In connection with:
(A) The authorization, settlement,
billing, processing, clearing, transferring, reconciling or collection of
amounts charged, debited, or otherwise
paid using a debit, credit, or other payment card, check, or account number,
or by other payment means;
(B) The transfer of receivables, accounts, or interests therein; or
(C) The audit of debit, credit, or
other payment information.
§ 1016.15 Other exceptions to notice
and opt out requirements.
(a) Exceptions to opt out requirements.
The requirements for initial notice in
§ 1016.4(a)(2), for the opt out in §§ 1016.7
and 1016.10, and for service providers
and joint marketing in § 1016.13 do not
apply when you disclose nonpublic personal information:
(1) With the consent or at the direction of the consumer, provided that the
consumer has not revoked the consent
or direction;
(2)(i) To protect the confidentiality
or security of your records pertaining
to the consumer, service, product, or
transaction;

509

VerDate Sep<11>2014

14:53 Mar 26, 2019

Jkt 247042

PO 00000

Frm 00519

Fmt 8010

Sfmt 8010

Q:\12\12V8.TXT

PC31

kpayne on VMOFRWIN702 with $$_JOB

§ 1016.16

12 CFR Ch. X (1–1–19 Edition)

(ii) To protect against or prevent actual or potential fraud, unauthorized
transactions, claims, or other liability;
(iii) For required institutional risk
control or for resolving consumer disputes or inquiries;
(iv) To persons holding a legal or beneficial interest relating to the consumer; or
(v) To persons acting in a fiduciary
or representative capacity on behalf of
the consumer;
(3) To provide information to insurance rate advisory organizations, guaranty funds or agencies, agencies that
are rating you, persons that are assessing your compliance with industry
standards, and your attorneys, accountants, and auditors;
(4) To the extent specifically permitted or required under other provisions of law and in accordance with the
Right to Financial Privacy Act of 1978
(12 U.S.C. 3401 et seq.) to law enforcement agencies (including the Bureau, a
Federal functional regulator, the Secretary of the Treasury, with respect to
31 U.S.C. Chapter 53, Subchapter II
(Records and Reports on Monetary Instruments and Transactions) and 12
U.S.C. Chapter 21 (Financial Recordkeeping), a state insurance authority,
with respect to any person domiciled in
that insurance authority’s state that is
engaged in providing insurance, and
the Federal Trade Commission), selfregulatory organizations, or for an investigation on a matter related to public safety;
(5)(i) To a consumer reporting agency
in accordance with the Fair Credit Reporting Act (15 U.S.C. 1681 et seq.); or
(ii) From a consumer report reported
by a consumer reporting agency;
(6) In connection with a proposed or
actual sale, merger, transfer, or exchange of all or a portion of a business
or operating unit if the disclosure of
nonpublic personal information concerns solely consumers of such business
or unit; or
(7)(i) To comply with Federal, state,
or local laws, rules and other applicable legal requirements;
(ii) To comply with a properly authorized civil, criminal, or regulatory
investigation, or subpoena or summons
by Federal, state, or local authorities;
or

(iii) To respond to judicial process or
government
regulatory
authorities
having jurisdiction over you for examination, compliance, or other purposes
as authorized by law.
(b) Examples of consent and revocation
of consent. (1) A consumer may specifically consent to your disclosure to a
nonaffiliated insurance company of the
fact that the consumer has applied to
you for a mortgage so that the insurance company can offer homeowner’s
insurance to the consumer.
(2) A consumer may revoke consent
by subsequently exercising the right to
opt out of future disclosures of nonpublic personal information as permitted under § 1016.7(h) of this part.

Subpart D—Relation to Other Laws
§ 1016.16 Protection of Fair Credit Reporting Act.
Nothing in this part shall be construed to modify, limit, or supersede
the operation of the Fair Credit Reporting Act (15 U.S.C. 1681 et seq.), and
no inference shall be drawn on the
basis of the provisions of this part regarding whether information is transaction or experience information under
section 603 of that Act.
§ 1016.17

Relation to state laws.

(a) In general. This part shall not be
construed as superseding, altering, or
affecting any statute, regulation,
order, or interpretation in effect in any
state, except to the extent that such
state statute, regulation, order, or interpretation is inconsistent with the
provisions of this part, and then only
to the extent of the inconsistency.
(b) Greater protection under state law.
For purposes of this section, a state
statute, regulation, order, or interpretation is not inconsistent with the provisions of this part if the protection
such statute, regulation, order, or interpretation affords any consumer is
greater than the protection provided
under this part, as determined by the
Bureau, on its own motion or upon the
petition of any interested party, after
consultation with the agency or authority with jurisdiction under section
505(a) of the GLB Act (15 U.S.C. 6805(a))
over either the person that initiated

510

VerDate Sep<11>2014

14:53 Mar 26, 2019

Jkt 247042

PO 00000

Frm 00520

Fmt 8010

Sfmt 8010

Q:\12\12V8.TXT

PC31

Bur. of Consumer Financial Protection

Pt. 1016, App.

the complaint or that is the subject of
the complaint.
APPENDIX TO PART 1016—MODEL PRIVACY FORM

511

VerDate Sep<11>2014

14:53 Mar 26, 2019

Jkt 247042

PO 00000

Frm 00521

Fmt 8010

Sfmt 8006

Q:\12\12V8.TXT

PC31

ER21DE11.058

kpayne on VMOFRWIN702 with $$_JOB

A. THE MODEL PRIVACY FORM

12 CFR Ch. X (1–1–19 Edition)

512

VerDate Sep<11>2014

14:53 Mar 26, 2019

Jkt 247042

PO 00000

Frm 00522

Fmt 8010

Sfmt 8006

Q:\12\12V8.TXT

PC31

ER21DE11.059

kpayne on VMOFRWIN702 with $$_JOB

Pt. 1016, App.

Pt. 1016, App.

513

VerDate Sep<11>2014

14:53 Mar 26, 2019

Jkt 247042

PO 00000

Frm 00523

Fmt 8010

Sfmt 8006

Q:\12\12V8.TXT

PC31

ER21DE11.060

kpayne on VMOFRWIN702 with $$_JOB

Bur. of Consumer Financial Protection

12 CFR Ch. X (1–1–19 Edition)

514

VerDate Sep<11>2014

14:53 Mar 26, 2019

Jkt 247042

PO 00000

Frm 00524

Fmt 8010

Sfmt 8006

Q:\12\12V8.TXT

PC31

ER21DE11.061

kpayne on VMOFRWIN702 with $$_JOB

Pt. 1016, App.

Pt. 1016, App.

515

VerDate Sep<11>2014

14:53 Mar 26, 2019

Jkt 247042

PO 00000

Frm 00525

Fmt 8010

Sfmt 8006

Q:\12\12V8.TXT

PC31

ER21DE11.062

kpayne on VMOFRWIN702 with $$_JOB

Bur. of Consumer Financial Protection

12 CFR Ch. X (1–1–19 Edition)

516

VerDate Sep<11>2014

14:53 Mar 26, 2019

Jkt 247042

PO 00000

Frm 00526

Fmt 8010

Sfmt 8006

Q:\12\12V8.TXT

PC31

ER21DE11.063

kpayne on VMOFRWIN702 with $$_JOB

Pt. 1016, App.

Bur. of Consumer Financial Protection

Pt. 1016, App.

B. GENERAL INSTRUCTIONS
1. How the Model Privacy Form Is Used
(a) The model form may be used, at the option of a financial institution, including a
group of financial institutions that use a
common privacy notice, to meet the content
requirements of the privacy notice and optout notice set forth in §§ 1016.6 and 1016.7 of
this part.
(b) The model form is a standardized form,
including page layout, content, format,
style, pagination, and shading. Institutions
seeking to obtain the safe harbor through
use of the model form may modify it only as
described in these Instructions.
(c) Note that disclosure of certain information, such as assets, income, and information
from a consumer reporting agency, may give
rise to obligations under the Fair Credit Reporting Act [15 U.S.C. 1681–1681x] (FCRA),
such as a requirement to permit a consumer
to opt out of disclosures to affiliates or designation as a consumer reporting agency if
disclosures are made to nonaffiliated third
parties.
(d) The word ‘‘customer’’ may be replaced
by the word ‘‘member’’ whenever it appears
in the model form, as appropriate.

3. The Format of the Model Privacy Form
The format of the model form may be
modified only as described below.
(a) Easily readable type font. Financial institutions that use the model form must use
an easily readable type font. While a number
of factors together produce easily readable
type font, institutions are required to use a
minimum of 10-point font (unless otherwise
expressly permitted in these Instructions)
and sufficient spacing between the lines of
type.
(b) Logo. A financial institution may include a corporate logo on any page of the notice, so long as it does not interfere with the
readability of the model form or the space
constraints of each page.

517

VerDate Sep<11>2014

14:53 Mar 26, 2019

Jkt 247042

PO 00000

Frm 00527

Fmt 8010

Sfmt 8002

Q:\12\12V8.TXT

PC31

ER21DE11.064

kpayne on VMOFRWIN702 with $$_JOB

2. The Contents of the Model Privacy Form
The model form consists of two pages,
which may be printed on both sides of a single sheet of paper, or may appear on two separate pages. Where an institution provides a
long list of institutions at the end of the
model form in accordance with Instruction
C.3(a)(1), or provides additional information
in accordance with Instruction C.3(c), and
such list or additional information exceeds
the space available on page two of the model

form, such list or additional information
may extend to a third page.
(a) Page One. The first page consists of the
following components:
(1) Date last revised (upper right-hand corner).
(2) Title.
(3) Key frame (Why?, What?, How?).
(4) Disclosure table (‘‘Reasons we can share
your personal information’’).
(5) ‘‘To limit our sharing’’ box, as needed,
for the financial institution’s opt-out information.
(6) ‘‘Questions’’ box, for customer service
contact information.
(7) Mail-in opt-out form, as needed.
(b) Page Two. The second page consists of
the following components:
(1) Heading (Page 2).
(2) Frequently Asked Questions (‘‘Who we
are’’ and ‘‘What we do’’).
(3) Definitions.
(4) ‘‘Other important information’’ box, as
needed.

Pt. 1016, App.

12 CFR Ch. X (1–1–19 Edition)

(c) Page size and orientation. Each page of
the model form must be printed on paper in
portrait orientation, the size of which must
be sufficient to meet the layout and minimum font size requirements, with sufficient
white space on the top, bottom, and sides of
the content.
(d) Color. The model form must be printed
on white or light color paper (such as cream)
with black or other contrasting ink color.
Spot color may be used to achieve visual interest, so long as the color contrast is distinctive and the color does not detract from
the readability of the model form. Logos
may also be printed in color.
(e) Languages. The model form may be
translated into languages other than
English.
C. INFORMATION REQUIRED IN THE MODEL
PRIVACY FORM
The information in the model form may be
modified only as described below:
1. Name of the Institution or Group of Affiliated
Institutions Providing the Notice
Insert the name of the financial institution
providing the notice or a common identity of
affiliated institutions jointly providing the
notice on the form wherever [name of financial institution] appears.

kpayne on VMOFRWIN702 with $$_JOB

2. Page One
(a) Last revised date. The financial institution must insert in the upper right-hand corner the date on which the notice was last revised. The information shall appear in minimum 8-point font as ‘‘rev. [month/year]’’
using either the name or number of the
month, such as ‘‘rev. July 2009’’ or ‘‘rev. 7/
09’’.
(b) General instructions for the ‘‘What?’’ box.
(1) The bulleted list identifies the types of
personal information that the institution
collects and shares. All institutions must use
the term ‘‘Social Security number’’ in the
first bullet.
(2) Institutions must use five (5) of the following terms to complete the bulleted list:
Income; account balances; payment history;
transaction history; transaction or loss history; credit history; credit scores; assets; investment experience; credit-based insurance
scores; insurance claim history; medical information; overdraft history; purchase history; account transactions; risk tolerance;
medical-related debts; credit card or other
debt; mortgage rates and payments; retirement assets; checking account information;
employment information; wire transfer instructions.
(c) General instructions for the disclosure
table. The left column lists reasons for sharing or using personal information. Each reason correlates to a specific legal provision
described in paragraph C.2(d) of this Instruc-

tion. In the middle column, each institution
must provide a ‘‘Yes’’ or ‘‘No’’ response that
accurately reflects its information sharing
policies and practices with respect to the
reason listed on the left. In the right column, each institution must provide in each
box one of the following three (3) responses,
as applicable, that reflects whether a consumer can limit such sharing: ‘‘Yes’’ if it is
required to or voluntarily provides an optout; ‘‘No’’ if it does not provide an opt-out;
or ‘‘We don’t share’’ if it answers ‘‘No’’ in the
middle column. Only the sixth row (‘‘For our
affiliates to market to you’’) may be omitted
at the option of the institution. See paragraph C.2(d)(6) of this Instruction.
(d) Specific disclosures and corresponding
legal provisions.
(1) For our everyday business purposes. This
reason incorporates sharing information
under §§ 1016.14 and 1016.15 and with service
providers pursuant to § 1016.13 of this part
other than the purposes specified in paragraphs C.2(d)(2) or C.2(d)(3) of these Instructions.
(2) For our marketing purposes. This reason
incorporates sharing information with service providers by an institution for its own
marketing pursuant to § 1016.13 of this part.
An institution that shares for this reason
may choose to provide an opt-out.
(3) For joint marketing with other financial
companies. This reason incorporates sharing
information under joint marketing agreements between two or more financial institutions and with any service provider used in
connection with such agreements pursuant
to § 1016.13 of this part. An institution that
shares for this reason may choose to provide
an opt-out.
(4) For our affiliates’ everyday business purposes—information about transactions and experiences. This reason incorporates sharing
information
specified
in
sections
603(d)(2)(A)(i) and (ii) of the FCRA. An institution that shares for this reason may
choose to provide an opt-out.
(5) For our affiliates’ everyday business purposes—information about creditworthiness. This
reason incorporates sharing information pursuant to section 603(d)(2)(A)(iii) of the FCRA.
An institution that shares for this reason
must provide an opt-out.
(6) For our affiliates to market to you. This
reason incorporates sharing information
specified in section 624 of the FCRA. This
reason may be omitted from the disclosure
table when: the institution does not have affiliates (or does not disclose personal information to its affiliates); the institution’s affiliates do not use personal information in a
manner that requires an opt-out; or the institution provides the affiliate marketing
notice separately. Institutions that include
this reason must provide an opt-out of indefinite duration. An institution that is required to provide an affiliate marketing opt-

518

VerDate Sep<11>2014

14:53 Mar 26, 2019

Jkt 247042

PO 00000

Frm 00528

Fmt 8010

Sfmt 8002

Q:\12\12V8.TXT

PC31

kpayne on VMOFRWIN702 with $$_JOB

Bur. of Consumer Financial Protection

Pt. 1016, App.

out, but does not include that opt-out in the
model form under this part, must comply
with section 624 of the FCRA and 12 CFR
part 1022, subpart C, with respect to the initial notice and opt-out and any subsequent
renewal notice and opt-out. An institution
not required to provide an opt-out under this
subparagraph may elect to include this reason in the model form.
(7) For nonaffiliates to market to you. This
reason incorporates sharing described in
§§ 1016.7 and 1016.10(a) of this part. An institution that shares personal information for
this reason must provide an opt-out.
(e) To limit our sharing: A financial institution must include this section of the model
form only if it provides an opt-out. The word
‘‘choice’’ may be written in either the singular or plural, as appropriate. Institutions
must select one or more of the applicable
opt-out methods described: Telephone, such
as by a toll-free number; a Web site; or use
of a mail-in opt-out form. Institutions may
include the words ‘‘toll-free’’ before telephone, as appropriate. An institution that
allows consumers to opt out online must provide either a specific Web address that takes
consumers directly to the opt-out page or a
general Web address that provides a clear
and conspicuous direct link to the opt-out
page. The opt-out choices made available to
the consumer who contacts the institution
through these methods must correspond accurately to the ‘‘Yes’’ responses in the third
column of the disclosure table. In the part titled ‘‘Please note,’’ institutions may insert a
number that is 30 or greater in the space
marked ‘‘[30].’’ Instructions on voluntary or
state privacy law opt-out information are in
paragraph C.2(g)(5) of these Instructions.
(f) Questions box. Customer service contact
information must be inserted as appropriate,
where [phone number] or [Web site] appear.
Institutions may elect to provide either a
phone number, such as a toll-free number, or
a web address, or both. Institutions may include the words ‘‘toll-free’’ before the telephone number, as appropriate.
(g) Mail-in opt-out form. Financial institutions must include this mail-in form only if
they state in the ‘‘To limit our sharing’’ box
that consumers can opt out by mail. The
mail-in form must provide opt-out options
that correspond accurately to the ‘‘Yes’’ responses in the third column in the disclosure
table. Institutions that require customers to
provide only name and address may omit the
section identified as ‘‘[account #].’’ Institutions that require additional or different information, such as a random opt-out number
or a truncated account number, to implement an opt-out election should modify the
‘‘[account #]’’ reference accordingly. This includes institutions that require customers
with multiple accounts to identify each account to which the opt-out should apply. An
institution must enter its opt-out mailing

address: in the far right of this form (see
version 3); or below the form (see version 4).
The reverse side of the mail-in opt-out form
must not include any content of the model
form.
(1) Joint accountholder. Only institutions
that provide their joint accountholders the
choice to opt out for only one accountholder,
in accordance with paragraph C.3(a)(5) of
these Instructions, must include in the far
left column of the mail-in form the following
statement: ‘‘If you have a joint account,
your choice(s) will apply to everyone on your
account unless you mark below. Apply my
choice(s) only to me.’’ The word ‘‘choice’’
may be written in either the singular or plural, as appropriate. Financial institutions
that provide insurance products or services,
provide this option, and elect to use the
model form may substitute the word ‘‘policy’’ for ‘‘account’’ in this statement. Institutions that do not provide this option may
eliminate this left column from the mail-in
form.
(2) FCRA section 603(d)(2)(A)(iii) opt-out. If
the institution shares personal information
pursuant to section 603(d)(2)(A)(iii) of the
FCRA, it must include in the mail-in opt-out
form the following statement: ‘‘ Do not share
information about my creditworthiness with
your affiliates for their everyday business
purposes.’’
(3) FCRA section 624 opt-out. If the institution incorporates section 624 of the FCRA in
accord with paragraph C.2(d)(6) of these Instructions, it must include in the mail-in
opt-out form the following statement: ‘‘ Do
not allow your affiliates to use my personal
information to market to me.’’
(4) Nonaffiliate opt-out. If the financial institution shares personal information pursuant to § 1016.10(a) of this part, it must include
in the mail-in opt-out form the following
statement: ‘‘ Do not share my personal information with nonaffiliates to market their
products and services to me.’’
(5) Additional opt-outs. Financial institutions that use the disclosure table to provide
opt-out options beyond those required by
Federal law must provide those opt-outs in
this section of the model form. A financial
institution that chooses to offer an opt-out
for its own marketing in the mail-in opt-out
form must include one of the two following
statements: ‘‘ Do not share my personal information to market to me.’’ or ‘‘ Do not use
my personal information to market to me.’’
A financial institution that chooses to offer
an opt-out for joint marketing must include
the following statement: ‘‘ Do not share my
personal information with other financial institutions to jointly market to me.’’
(h) Barcodes. A financial institution may
elect to include a barcode and/or ‘‘tagline’’
(an internal identifier) in 6-point font at the
bottom of page one, as needed for information internal to the institution, so long as

519

VerDate Sep<11>2014

14:53 Mar 26, 2019

Jkt 247042

PO 00000

Frm 00529

Fmt 8010

Sfmt 8002

Q:\12\12V8.TXT

PC31

Pt. 1016, App.

12 CFR Ch. X (1–1–19 Edition)

these do not interfere with the clarity or
text of the form.

kpayne on VMOFRWIN702 with $$_JOB

3. Page Two
(a) General Instructions for the Questions.
Certain of the Questions may be customized
as follows:
(1) ‘‘Who is providing this notice?’’ This question may be omitted where only one financial institution provides the model form and
that institution is clearly identified in the
title on page one. Two or more financial institutions that jointly provide the model
form must use this question to identify
themselves as required by § 1016.9(f) of this
part. Where the list of institutions exceeds
four (4) lines, the institution must describe
in the response to this question the general
types of institutions jointly providing the
notice and must separately identify those institutions, in minimum 8-point font, directly
following the ‘‘Other important information’’ box, or, if that box is not included in
the institution’s form, directly following the
‘‘Definitions.’’ The list may appear in a
multi-column format.
(2) ‘‘How does [name of financial institution]
protect my personal information?’’ The financial institution may only provide additional
information pertaining to its safeguards
practices following the designated response
to this question. Such information may include information about the institution’s use
of cookies or other measures it uses to safeguard personal information. Institutions are
limited to a maximum of 30 additional
words.
(3) ‘‘How does [name of financial institution]
collect my personal information?’’ Institutions
must use five (5) of the following terms to
complete the bulleted list for this question:
Open an account; deposit money; pay your
bills; apply for a loan; use your credit or
debit card; seek financial or tax advice;
apply for insurance; pay insurance premiums; file an insurance claim; seek advice
about your investments; buy securities from
us; sell securities to us; direct us to buy securities; direct us to sell your securities;
make deposits or withdrawals from your account; enter into an investment advisory
contract; give us your income information;
provide employment information; give us
your employment history; tell us about your
investment or retirement portfolio; tell us
about your investment or retirement earnings; apply for financing; apply for a lease;
provide account information; give us your
contact information; pay us by check; give
us your wage statements; provide your mortgage information; make a wire transfer; tell
us who receives the money; tell us where to
send the money; show your governmentissued ID; show your driver’s license; order a
commodity futures or option trade. Institutions that collect personal information from
their affiliates and/or credit bureaus must

include after the bulleted list the following
statement: ‘‘We also collect your personal
information from others, such as credit bureaus, affiliates, or other companies.’’ Institutions that do not collect personal information from their affiliates or credit bureaus
but do collect information from other companies must include the following statement
instead: ‘‘We also collect your personal information from other companies.’’ Only institutions that do not collect any personal information from affiliates, credit bureaus, or
other companies can omit both statements.
(4) ‘‘Why can’t I limit all sharing?’’ Institutions that describe state privacy law provisions in the ‘‘Other important information’’
box must use the bracketed sentence: ‘‘See
below for more on your rights under state
law.’’ Other institutions must omit this sentence.
(5) ‘‘What happens when I limit sharing for
an account I hold jointly with someone else?’’
Only financial institutions that provide optout options must use this question. Other institutions must omit this question. Institutions must choose one of the following two
statements to respond to this question:
‘‘Your choices will apply to everyone on your
account.’’ or ‘‘Your choices will apply to everyone on your account—unless you tell us
otherwise.’’ Financial institutions that provide insurance products or services and elect
to use the model form may substitute the
word ‘‘policy’’ for ‘‘account’’ in these statements.
(b) General Instructions for the Definitions.
The financial institution must customize the
space below the responses to the three definitions in this section. This specific information must be in italicized lettering to set off
the information from the standardized definitions.
(1) Affiliates. As required by § 1016.6(a)(3) of
this part, where [affiliate information] appears, the financial institution must:
(i) If it has no affiliates, state: ‘‘[name of financial institution] has no affiliates’’;
(ii) If it has affiliates but does not share
personal information, state: ‘‘[name of financial institution] does not share with our affiliates’’; or
(iii) If it shares with its affiliates, state, as
applicable: ‘‘Our affiliates include companies
with a [common corporate identity of financial
institution] name; financial companies such as
[insert illustrative list of companies]; nonfinancial companies, such as [insert illustrative
list of companies]; and others, such as [insert illustrative list].’’
(2) Nonaffiliates. As required by § 1016.6(c)(3)
of this part, where [nonaffiliate information]
appears, the financial institution must:
(i) If it does not share with nonaffiliated
third parties, state: ‘‘[name of financial institution] does not share with nonaffiliates so they
can market to you’’; or

520

VerDate Sep<11>2014

14:53 Mar 26, 2019

Jkt 247042

PO 00000

Frm 00530

Fmt 8010

Sfmt 8002

Q:\12\12V8.TXT

PC31

Bur. of Consumer Financial Protection

Pt. 1022

(ii) If it shares with nonaffiliated third parties, state, as applicable: ‘‘Nonaffiliates we
share with can include [list categories of companies such as mortgage companies, insurance
companies, direct marketing companies, and
nonprofit organizations].’’
(3) Joint Marketing. As required by § 1016.13
of this part, where [joint marketing] appears,
the financial institution must:
(i) If it does not engage in joint marketing,
state: ‘‘[name of financial institution] doesn’t
jointly market’’; or
(ii) If it shares personal information for
joint marketing, state, as applicable: ‘‘Our
joint marketing partners include [list categories
of companies such as credit card companies].’’
(c) General instructions for the ‘‘Other important information box.’’ This box is optional.
The space provided for information in this
box is not limited. Only the following types
of information can appear in this box.
(1) State and/or international privacy law
information; and/or
(2) Acknowledgment of receipt form.

PART 1022—FAIR CREDIT
REPORTING (REGULATION V)

1022.42 Reasonable policies and procedures
concerning the accuracy and integrity of
furnished information.
1022.43 Direct disputes.

Subpart F—Duties of Users Regarding
Obtaining and Using Consumer Reports
1022.50–1022.53 [Reserved]
1022.54 Duties of users making written firm
offers of credit or insurance based on information contained in consumer files.

Subpart G [Reserved]
Subpart H—Duties of Users Regarding RiskBased Pricing
1022.70 Scope.
1022.71 Definitions.
1022.72 General requirements for risk-based
pricing notices.
1022.73 Content, form, and timing of riskbased pricing notices.
1022.74 Exceptions.
1022.75 Rules of construction.

Subpart I—Duties of Users of Consumer
Reports Regarding Identity Theft

Subpart A—General Provisions
Sec.
1022.1 Purpose, scope, and model forms and
disclosures.
1022.2 Examples.
1022.3 Definitions.

1022.80–1022.81 [Reserved]
1022.82 Duties of users regarding address
discrepancies.

Subparts J–L [Reserved]
Subpart M—Duties of Consumer Reporting
Agencies Regarding Identity Theft

Subpart B [Reserved]
Subpart C—Affiliate Marketing
1022.20 Coverage and definitions.
1022.21 Affiliate marketing opt-out and exceptions.
1022.22 Scope and duration of opt-out.
1022.23 Contents of opt-out notice; consolidated and equivalent notices.
1022.24 Reasonable opportunity to opt out.
1022.25 Reasonable and simple methods of
opting out.
1022.26 Delivery of opt-out notices.
1022.27 Renewal of opt-out.

Subpart D—Medical Information

kpayne on VMOFRWIN702 with $$_JOB

1022.30 Obtaining or using medical information in connection with a determination
of eligibility for credit.
1022.31 Limits on redisclosure of information.
1022.32 Sharing medical information with
affiliates.

Subpart E—Duties of Furnishers of
Information
1022.40
1022.41

1022.120
1022.121
1022.122
1022.123

[Reserved]
Active duty alerts.
[Reserved]
Proof of identity.

Subpart N—Duties of Consumer Reporting
Agencies Regarding Disclosures to
Consumers
1022.130 Definitions
1022.131–1022.135 [Reserved]
1022.136 Centralized source for requesting
annual file disclosures from nationwide
consumer reporting agencies.
1022.137 Streamlined process for requesting
annual file disclosures from nationwide
specialty consumer reporting agencies.
1022.138 Prevention of deceptive marketing
of free credit reports.

Subpart O—Miscellaneous Duties of
Consumer Reporting Agencies
1022.140 Prohibition against circumventing
or evading treatment as a consumer reporting agency.
APPENDIX A TO PART 1022 [RESERVED]

Scope.
Definitions.

521

VerDate Sep<11>2014

14:53 Mar 26, 2019

Jkt 247042

PO 00000

Frm 00531

Fmt 8010

Sfmt 8010

Q:\12\12V8.TXT

PC31