Regulation P: Privacy of Consumer Financial Information ...

1 Regulation P: Privacy of Consumer Financial InformationFrequently Asked QuestionsDecember 2001iContentsA. Financial institutions, products, and services that arecovered under the Privacy Rule (Q. - )B. Individuals who are entitled to receive notices (Q. - )C. Delivering your Privacy notices (Q. - )D. Providing notices to joint account holders (Q. - )E. Complying with the opt out provisions for joint account holders (Q. - )F. Delivering opt out notices and providing consumers with a reasonable opportunity to opt out (Q. - )G. Complying with the limitations on redisclosure and reuse of nonpublic personal Information (Q. - )H. Complying with the limitation on disclosing account numbers (Q. - )I. Disclosing nonpublic personal Information under the exceptions tothe notice and opt out provisions (Q. - )J. Complying with the exception to the opt out provisions for joint marketing arrangements (Q.)

2 - )iiiAbout the FAQsThe staff of the Board of Governors of the Federal Reserve System have developed thisset of frequently asked questions (FAQs) to assist Financial institutions in complying withthe Privacy provisions of the Gramm-Leach-Bliley Act (GLB Act) and the Board sRegulation P (in the FAQs, termed the Privacy Rule ). The FAQs illustrate howselected provisions of the Regulation apply to specific situations a Financial institutionmay confront. However, they do not necessarily address all provisions that may apply toany given situation. Additionally, this staff guidance addresses a Financial institution sobligations only under sections 502-509 of the GLB Act and Regulation P and does notaddress the applicability of the Fair Credit Reporting Act or any other federal or state lawthat may pertain to the questions and answers. The staff may supplement or revise theFAQs as necessary or appropriate in light of further questions and institutions, products, and services that are coveredunder the Privacy must comply with the Privacy Rule?

3 Any Financial institution that provides Financial products or services to consumers mustcomply with the Privacy provisions of Title V of the Gramm-Leach-Bliley Act ( GLB Act )(15 6801-09) and the Privacy Rule. Under the banking agencies rules,1 you are afinancial institution if you engage in an activity that is Financial in nature or incidental to afinancial activity, as described in 4(k) of the Bank Holding Company Act of 1956 ( BHCAct ) (12 1843(k)). For purposes of the banking agencies rules, activities described in 4(k) of the BHC Act include the activities specifically listed in 4(k) andany additional activities the Board, in consultation with the Secretary of the Treasury,determines to be Financial in nature or incidental to a Financial activity in accordance with 4(k).Section of the Board s Regulation Y lists or otherwise references the activities thatare Financial in nature as of the date of these FAQs.

4 See 12 Note, however,that additional activities the Board authorizes in the future, such as activities approved byBoard order, may not necessarily be listed at Financial activities as of the date of these FAQs include but are not limited to thefollowing: Lending, exchanging, transferring, investing for others, or safeguarding money orsecurities; Insuring, guaranteeing, or indemnifying against loss, harm, damage, illness, disability,or death, or providing and issuing annuities, either as principal, agent, or broker; and Providing Financial advice, underwriting, dealing in, or making a market in have consumers if you provide your Financial products or services to individuals to beused primarily for their personal, family, or household , the Privacy Rule restricts the use and disclosure of nonpublic personalinformation obtained from a nonaffiliated Financial institution, as discussed below.

5 1 The scope of the Privacy Regulation promulgated by the Federal Trade Commission ( FTC ) is more limitedthan that of the other agencies. Under the FTC s Privacy Regulation , Financial institution means anyinstitution the business of which is engaging in Financial activities as described in 4(k) of the Bank HoldingCompany Act of 1956. See 16 (k)(1). Moreover, an institution is not a Financial institutionunless it is significantly engaged in Financial activities. Id. In addition, the FTC s Regulation does notautomatically apply to institutions significantly engaged in activities that the Board determines, afterNovember 12, 1999, to be Financial in nature. See 16 (a)(2). am a small Financial institution with no affiliates. I do not disclose informationabout my customers or consumers to anyone, except as permitted by an exceptionunder and of the Privacy Does the Privacy Rule apply to asmall operation like mine?

6 Yes. You have responsibilities under the Privacy Rule regardless of your size, affiliaterelationships, or Information collection and disclosure practices. The Privacy Rule isfocused not only on regulating the disclosure of Financial Information about customers andconsumers, but also on requiring each Financial institution to provide initial and annualnotices of its policies to its customers. You may, however, provide notice in a simplifiedform, as illustrated by the notice described in (c)(5). provide trust services. In this capacity, I serve as the trustee of trusts whosebeneficiaries are individuals. Does the Privacy Rule apply to my trust operations?When you act as a trustee, you have a relationship with the trust. Because the trust itself isnot an individual, it is not a Consumer under the Privacy Rule. Even if the grantor and allthe beneficiaries are individuals, neither the grantor nor any of the beneficiaries are yourconsumers solely because of their relationship to the trust.

7 If, for example, the trust requiresyou, as trustee, to transfer money to a beneficiary, you provide that Financial service to thetrust rather than the individual who is the beneficiary. In other words, grantors andbeneficiaries of a trust are not your consumers unless they directly obtain a Financial productand service from you for their personal, family, or household purposes. Accordingly, youdo not have any obligations under the Privacy Rule with respect to the trust. Your duties asa fiduciary , however, may require you to maintain the confidentiality of Information aboutthe trust, its grantor, and its act as a custodian for Individual Retirement Arrangements ( IRAs ). Are theindividuals who own the IRAs my customers?Yes. An individual who establishes an IRA account for which you act as a custodian hasobtained a Financial product or service that is to be used primarily for personal, family, orhousehold purposes; therefore, he or she is a Consumer .

8 When an individual selects you toact as custodian for his or her IRA, the individual enters into a continuing relationship withyou and becomes your customer under the Privacy Rule. By contrast, an individual who is aparticipant or a beneficiary of an employee benefit plan that you sponsor or for which youact as trustee or fiduciary is not your customer because your relationship in that case is withthe plan. 2 All subsequent section references are to the Privacy Rule unless otherwise am a tax return preparer and I understand that I may be subject to the Privacy Ruleconcerning the disclosure of my clients nonpublic personal Information . However, Ialso am subject to section 7216 of the Internal Revenue Code, which restricts the useand disclosure of my customers federal tax return Information . Do the privacyprovisions of the GLB Act and the Privacy Rule supersede the restrictions in section7216?

9 May I now disclose my customers federal income tax return Information afterI provide them with the proper notices and give my customers a reasonableopportunity to opt out?No. The Privacy Rule does not supersede the restrictions in section 7216. The GLB Actand the Agencies implementing regulations do not authorize a Financial institution todisclose nonpublic personal Information in a way that is prohibited by some other , you may not avoid the restrictions of section 7216 by providing your customerswith an opt out notice and a reasonable opportunity to opt who are entitled to receive does the Privacy Rule sometimes refer to consumers and other times tocustomers? Aren t customers also consumers?All customers are consumers, but not all consumers are Consumer is an individual who obtains a Financial product or service from you that isprimarily for personal, family, or household purposes.

10 A Financial product or serviceincludes the evaluation or brokerage of Information collected in connection with a request orapplication, such as a bank s review of loan application materials to determine whether anapplicant qualifies for a loan. A customer is a type of Consumer , namely, an individual whohas an ongoing relationship with you under which you provide a Financial product orservice. Note that neither a business nor an individual who obtains a Financial product orservice for business purposes is a Consumer or a customer under the Privacy rule distinguishes consumers from customers because your responsibilities to providenotices to consumers and to customers differ in several respects. You must give all your customers initial Privacy notices. You must give initial notices (or short form notices) to consumers who are not yourcustomers only if you intend to disclose nonpublic personal Information about thoseconsumers to nonaffiliated third parties (unless an exception in or such that no initial notice is required prior to the disclosure).