Sample 3
Privacy Policy Notice
Designed for an institution that has affiliates, shares nonexperience information with them, has joint
marketing agreements, and discloses information outside of the opt-out exceptions.
This sample privacy policy notice presented below is based on the following assumptions:
1. Your institution collects information from its affiliates;
2. Your institution shares “nonexperience” information, such as application information or from a credit
report, with its affiliates and, thus, is required to provide an opt-out notice under section
603(d)(2)(A)(iii) of the Fair Credit Reporting Act;
3. Your institution discloses nonpublic personal information for marketing purposes to service providers or
to other financial institutions with whom it has joint marketing arrangements (under Section 502(b)(2) of
the GLB Act, as implemented by Section 332.13 of the federal regulatory agencies’ final privacy
regulations); and
4. Your institution discloses nonpublic personal information to affiliates and nonaffiliated third parties
outside of the opt-out exceptions.
The following two subsections provide language to modify your policies. Following these subsections, an
example of a complete policy that takes these modifications into account is provided.
Subsection 1: For Service Providers/Joint Marketing Exception
Subsection 2: For Institutions that Disclose Nonpublic Personal Information Outside the Opt-Out Exceptions
Categories of Nonpublic Personal Information
Categories of Parties to Whom the Institution Discloses Nonpublic Personal Information
Explanation of the Consumer’s Right to Opt Out
Sample 3 - Privacy Policy Notice
Subsection 1: For Service Providers/Joint Marketing Exception
If your institution discloses nonpublic personal information for marketing purposes to service providers or to
other financial institutions with which it has joint marketing arrangements, you are required (in order to avoid
offering an opt out) to include in your privacy policy notice an accurate description of the:
o Categories of nonpublic personal information your institution discloses to such entities; and
o Categories of third parties under contract with your institution.
To meet this obligation, one of the two following alternatives, as applicable, should be included in your privacy
policy notice. Alternative 1 would be used to list the specific categories of information that you disclose;
Alternative 2 would be used if you disclose all of the information that you collect.
Alternative 1
We may disclose the following information to companies that perform marketing services on our behalf or to
other financial institutions with which we have joint marketing arrangements:
o Information we receive from you on applications or other forms, such as your name, address, social
security number, assets and income;
o Information about transactions with us, [our affiliates] or others, such as your account balance, payment
history, parties to transactions and credit card usage; and
o Information we receive from credit bureaus, such as your creditworthiness and your payment history.
Alternative 2
We may disclose all of the information we collect, as described [describe location in the notice, such as “above”
or “below”] to companies that perform marketing services on our behalf or to other financial institutions with
which we have joint marketing agreements.
It is important that the alternative you use is consistent with your institution’s information disclosure
practices.
Subsection 2: For Institutions that Disclose Nonpublic Personal Information Outside the
Opt-Out Exceptions
If your institution discloses nonpublic personal information outside of the Section 502(e) opt-out exceptions,
you need to include in your privacy policy notice information regarding:
o Categories of nonpublic personal information your institution discloses;
o Categories of parties to whom your institution discloses nonpublic personal information; and
o An explanation of the consumer’s right to opt out of the disclosure of nonpublic personal information to
nonaffiliated third parties, including the method(s) by which the consumer may exercise that right.
Categories of Nonpublic Personal Information
With respect to the categories of nonpublic personal information that your institution discloses, the final privacy
regulations provide that an institution may meet this obligation by including one of the following alternatives,
as applicable, in its privacy policy notice. Alternative 1 would be used to list the specific categories
information that you disclose; Alternative 2 would be used if you disclose all of the information that you
collect.
Alternative 1
We may disclose the following kinds of nonpublic personal information about you:
o Information we receive from you on applications or other loan and account forms, such as your name,
address, social security number, assets and income;
o Information about your transactions with us, [our affiliates] or others, such as your account balance,
payment history, parties to transactions, and credit card usage;
o Information we receive from credit bureaus, such as your creditworthiness and your payment history.
Alternative 2
We may disclose all of the information that we collect, as described above [or below].
Again, it is important that the examples included in each of these paragraphs are consistent with the
information disclosed to such entities by your institution.
Categories of Parties to Whom the Institution Discloses Nonpublic Personal Information
With respect to the categories of parties to whom the institution discloses nonpublic personal information and
the explanation of the opt-out methods, the final privacy regulations provide that an institution may meet these
obligations by including the following sample language, as applicable, in its privacy policy notice.
We may disclose nonpublic personal information about you to the following types of third parties:
o Financial service providers, such as [provide illustrative examples, such as “mortgage bankers, securities
broker-dealers and insurance agents”];
o Non-financial companies, such as [provide illustrative examples, such as “retailers, direct marketers,
airlines and publishers”]; and
o Others, such as [provide illustrative examples, such as “non-profit organizations”].
We also may disclose nonpublic personal information about you to “nonaffiliated third parties” (i.e., third
parties that are not members of our corporate family) as permitted by law.
Before using this sample privacy policy notice, you should ensure that the information contained in it is
consistent with your institution’s actual privacy policies and practices.
Explanation of the Consumer’s Right to Opt Out
The following example is one way to provide an explanation of the consumer’s right to opt out of the disclosure
of nonpublic personal information to nonaffiliated third parties. Note that you should add a description of the
way(s) – which must be “reasonable” – that consumers may exercise their opt-out right. The regulations permit
several additional opt out methods to the use of toll-free numbers. For example, you may offer: a designated
check-off box in a prominent position on the form with the opt-out notice; a reply form together with the optout notice; and an electronic means to opt out if the consumer agrees to the electronic delivery of information.
If you prefer that we not disclose nonpublic personal information about you to nonaffiliated third parties [with
respect to this loan or account], you may opt out of those disclosures, that is, you may direct us not to make
those disclosures (other than disclosures permitted by law). If you wish to opt out of disclosures to
nonaffiliated third parties, you may [describe a reasonable means of opting out, such as “call the following tollfree number: (insert number)”].
Here is an example of such a privacy policy notice, selecting certain of the alternatives shown above:
Sample 3
Sample Privacy Policy Notice
Protecting your privacy is important to [institution name]. We want you to understand what information we
collect and how we use it. In order to provide our customers with a broad range of financial products and
services as effectively and conveniently as possible, we use technology to manage and maintain customer
information.
What Information We Collect
We may collect “nonpublic personal information” about you from the following sources:
o Information we receive from you on applications or other loan and account forms;
o Information about your transactions with us, our affiliates or others; and
o Information we receive from third parties such as credit bureaus.
“Nonpublic personal information” is nonpublic information about you that we obtain in connection with
providing a financial product or service to you. For example, nonpublic personal information includes
information regarding your account balance, payment history, and overdraft history.
What Information We Disclose
A. We may disclose the following kinds of nonpublic personal information about you:
o Information we receive from you on applications or other loan and account forms, such as your name,
address, social security number, assets and income;
o Information about your transactions with us, our affiliates or others, such as your account balance,
payment history, parties to transactions, and credit card usage; and
o Information we receive from credit bureaus, such as your creditworthiness and your payment history.
B. We may disclose nonpublic personal information about you to the following types of “affiliates”
(i.e., companies related to us by common control or ownership) and “nonaffiliated third parties”
(i.e., third parties that are not members of our corporate family).
o Financial service providers, such as mortgage bankers, securities broker-dealers and insurance agents;
o Non-financial companies, such as retailers, direct marketers, airlines and publishers; and
o Others, such as non-profit organizations.
If you prefer that we not disclose nonpublic personal information about you to such nonaffiliated third parties
[with respect to this loan or account], you may opt out of those disclosures, that is, you may direct us not to
make those disclosures (other than disclosures permitted by law). If you wish to opt out of disclosures to
nonaffiliated third parties, you may call the following toll-free number: 1-800-xxx-xxxx.
C. In addition, we may disclose the following information to companies that perform marketing services on our
behalf or to other financial institutions with which we have joint marketing arrangements:
o Information we receive from you on applications or other forms, such as your name, address, social
security number, assets and income;
o Information about transactions with us, our affiliates or others, such as your account balance, payment
history, parties to transactions and credit card usage; and
o Information we receive from credit bureaus, such as your creditworthiness and your payment history.
D. We also are permitted under law to share information about our experiences or transactions with you or
your account (such as your account balance and your payment history with us) with our affiliates. We also may
share additional information about you or your account (such as information we receive from you in
applications and information from credit reporting agencies) with our affiliates. You may direct us not to
disclose to our affiliates information that does not relate solely to our or our affiliates’ experiences or
transactions with you or your account (such as the application information and credit bureau information) by
calling us at 1-800-xxx-xxxx.
E. We also are permitted under law to disclose nonpublic personal information about you to “nonaffiliated third
parties” in certain other circumstances. For example, we may disclose nonpublic personal information about
you to third parties to assist us in servicing your loan or account with us, to government entities in response to
subpoenas, and to credit bureaus.
F. If you decide to close your account(s) or become an inactive customer, we will continue to adhere to the
privacy policies and practices described in this notice.
Our Security Procedures
We also take steps to safeguard customer information. We restrict access to your personal and account
information to those employees who need to know that information to provide products or services to you.
We maintain physical, electronic, and procedural safeguards that comply with federal standards to guard your
nonpublic personal information.