15 U.S.C. § 6803 — Disclosure of institution privacy policy

Page 2291 TITLE 15—COMMERCE AND TRADE § 6803 1 So in original. Probably should be followed by a comma. stitution’s compliance with industry stand- ards, and the institution’s attorneys, account- ants, and auditors; (5) to the extent specifically permitted or re- quired under other provisions of law and in ac- cordance with the Right to Financial Privacy Act of 1978 [12 U.S.C. 3401 et seq.], to law en- forcement agencies (including the Bureau of Consumer Financial Protection 1 a Federal functional regulator, the Secretary of the Treasury with respect to subchapter II of chapter 53 of title 31, and chapter 2 of title I of Public Law 91–508 (12 U.S.C. 1951–1959), a State insurance authority, or the Federal Trade Commission), self-regulatory organiza- tions, or for an investigation on a matter re- lated to public safety; (6)(A) to a consumer reporting agency in ac- cordance with the Fair Credit Reporting Act [15 U.S.C. 1681 et seq.], or (B) from a consumer report reported by a consumer reporting agen- cy; (7) in connection with a proposed or actual sale, merger, transfer, or exchange of all or a portion of a business or operating unit if the disclosure of nonpublic personal information concerns solely consumers of such business or unit; or (8) to comply with Federal, State, or local laws, rules, and other applicable legal require- ments; to comply with a properly authorized civil, criminal, or regulatory investigation or subpoena or summons by Federal, State, or local authorities; or to respond to judicial process or government regulatory authorities having jurisdiction over the financial institu- tion for examination, compliance, or other purposes as authorized by law. (Pub. L. 106–102, title V, § 502, Nov. 12, 1999, 113 Stat. 1437; Pub. L. 111–203, title X, § 1093(2), July 21, 2010, 124 Stat. 2095.) Editorial Notes REFERENCES IN TEXT This subchapter, referred to in subsecs. (a) and (c), was in the original ‘‘this subtitle’’, meaning subtitle A (§§ 501–510) of title V of Pub. L. 106–102, Nov. 12, 1999, 113 Stat. 1436, which is classified principally to this sub- chapter. For complete classification of subtitle A to the Code, see Tables. The Right to Financial Privacy Act of 1978, referred to in subsec. (e)(5), is title XI of Pub. L. 95–630, Nov. 10, 1978, 92 Stat. 3697, which is classified generally to chap- ter 35 (§ 3401 et seq.) of Title 12, Banks and Banking. For complete classification of this Act to the Code, see Short Title note set out under section 3401 of Title 12 and Tables. Chapter 2 of title I of Public Law 91–508, referred to in subsec. (e)(5), is chapter 2 (§§ 121–129) of title I of Pub. L. 91–508, Oct. 26, 1970, 84 Stat. 1116, which is classified generally to chapter 21 (§ 1951 et seq.) of Title 12, Banks and Banking. For complete classification of chapter 2 to the Code, see Tables. The Fair Credit Reporting Act, referred to in subsec. (e)(6)(A), is title VI of Pub. L. 90–321, as added by Pub. L. 91–508, title VI, § 601, Oct. 26, 1970, 84 Stat. 1127, which is classified generally to subchapter III (§ 1681 et seq.) of chapter 41 of this title. For complete classification of this Act to the Code, see Short Title note set out under section 1601 of this title and Tables. AMENDMENTS 2010—Subsec. (e)(5). Pub. L. 111–203 inserted ‘‘the Bu- reau of Consumer Financial Protection’’ after ‘‘(includ- ing’’. Statutory Notes and Related Subsidiaries EFFECTIVE DATE OF 2010 AMENDMENT Amendment by Pub. L. 111–203 effective on the des- ignated transfer date, see section 1100H of Pub. L. 111–203, set out as a note under section 552a of Title 5, Government Organization and Employees. § 6803. Disclosure of institution privacy policy (a) Disclosure required At the time of establishing a customer rela- tionship with a consumer and not less than an- nually during the continuation of such relation- ship, a financial institution shall provide a clear and conspicuous disclosure to such consumer, in writing or in electronic form or other form per- mitted by the regulations prescribed under sec- tion 6804 of this title, of such financial institu- tion’s policies and practices with respect to— (1) disclosing nonpublic personal informa- tion to affiliates and nonaffiliated third par- ties, consistent with section 6802 of this title, including the categories of information that may be disclosed; (2) disclosing nonpublic personal informa- tion of persons who have ceased to be cus- tomers of the financial institution; and (3) protecting the nonpublic personal infor- mation of consumers. (b) Regulations Disclosures required by subsection (a) shall be made in accordance with the regulations pre- scribed under section 6804 of this title. (c) Information to be included The disclosure required by subsection (a) shall include— (1) the policies and practices of the institu- tion with respect to disclosing nonpublic per- sonal information to nonaffiliated third par- ties, other than agents of the institution, con- sistent with section 6802 of this title, and in- cluding— (A) the categories of persons to whom the information is or may be disclosed, other than the persons to whom the information may be provided pursuant to section 6802(e) of this title; and (B) the policies and practices of the insti- tution with respect to disclosing of non- public personal information of persons who have ceased to be customers of the financial institution; (2) the categories of nonpublic personal in- formation that are collected by the financial institution; (3) the policies that the institution main- tains to protect the confidentiality and secu- rity of nonpublic personal information in ac- cordance with section 6801 of this title; and (4) the disclosures required, if any, under section 1681a(d)(2)(A)(iii) of this title. (d) Exemption for certified public accountants (1) In general The disclosure requirements of subsection (a) do not apply to any person, to the extent that the person is— Page 2292 TITLE 15—COMMERCE AND TRADE § 6804 (A) a certified public accountant; (B) certified or licensed for such purpose by a State; and (C) subject to any provision of law, rule, or regulation issued by a legislative or regu- latory body of the State, including rules of professional conduct or ethics, that pro- hibits disclosure of nonpublic personal infor- mation without the knowing and expressed consent of the consumer. (2) Limitation Nothing in this subsection shall be con- strued to exempt or otherwise exclude any fi- nancial institution that is affiliated or be- comes affiliated with a certified public ac- countant described in paragraph (1) from any provision of this section. (3) Definitions For purposes of this subsection, the term ‘‘State’’ means any State or territory of the United States, the District of Columbia, Puer- to Rico, Guam, American Samoa, the Trust Territory of the Pacific Islands, the Virgin Is- lands, or the Northern Mariana Islands. (e) Model forms (1) In general The agencies referred to in section 6804(a)(1) of this title shall jointly develop a model form which may be used, at the option of the finan- cial institution, for the provision of disclo- sures under this section. (2) Format A model form developed under paragraph (1) shall— (A) be comprehensible to consumers, with a clear format and design; (B) provide for clear and conspicuous dis- closures; (C) enable consumers easily to identify the sharing practices of a financial institution and to compare privacy practices among fi- nancial institutions; and (D) be succinct, and use an easily readable type font. (3) Timing A model form required to be developed by this subsection shall be issued in proposed form for public comment not later than 180 days after October 13, 2006. (4) Safe harbor Any financial institution that elects to pro- vide the model form developed by the agencies under this subsection shall be deemed to be in compliance with the disclosures required under this section. (f) Exception to annual notice requirement A financial institution that— (1) provides nonpublic personal information only in accordance with the provisions of sub- section (b)(2) or (e) of section 6802 of this title or regulations prescribed under section 6804(b) of this title, and (2) has not changed its policies and practices with regard to disclosing nonpublic personal information from the policies and practices that were disclosed in the most recent disclo- sure sent to consumers in accordance with this section, shall not be required to provide an annual dis- closure under this section until such time as the financial institution fails to comply with any criteria described in paragraph (1) or (2). (Pub. L. 106–102, title V, § 503, Nov. 12, 1999, 113 Stat. 1439; Pub. L. 109–351, title VI, § 609, title VII, § 728, Oct. 13, 2006, 120 Stat. 1983, 2003; Pub. L. 114–94, div. G, title LXXV, § 75001, Dec. 4, 2015, 129 Stat. 1787.) Editorial Notes AMENDMENTS 2015—Subsec. (f). Pub. L. 114–94 added subsec. (f). 2006—Pub. L. 109–351 designated concluding provisions of subsec. (a) as (b), inserted heading, substituted ‘‘Dis- closures required by subsection (a)’’ for ‘‘Such disclo- sures’’, redesignated former subsec. (b) as (c), and added subsecs. (d) and (e). Executive Documents TERMINATION OF TRUST TERRITORY OF THE PACIFIC ISLANDS For termination of Trust Territory of the Pacific Is- lands, see note set out preceding section 1681 of Title 48, Territories and Insular Possessions. § 6804. Rulemaking (a) Regulatory authority (1) Rulemaking (A) In general Except as provided in subparagraph (C), the Bureau of Consumer Financial Protec- tion and the Securities and Exchange Com- mission shall have authority to prescribe such regulations as may be necessary to carry out the purposes of this subchapter with respect to financial institutions and other persons subject to their respective ju- risdiction under section 6805 of this title (and notwithstanding subtitle B of the Con- sumer Financial Protection Act of 2010 [12 U.S.C. 5511 et seq.]), except that the Bureau of Consumer Financial Protection shall not have authority to prescribe regulations with respect to the standards under section 6801 of this title. (B) CFTC The Commodity Futures Trading Commis- sion shall have authority to prescribe such regulations as may be necessary to carry out the purposes of this subchapter with respect to financial institutions and other persons subject to the jurisdiction of the Commodity Futures Trading Commission under section 7b–2 of title 7. (C) Federal Trade Commission authority Notwithstanding the authority of the Bu- reau of Consumer Financial Protection under subparagraph (A), the Federal Trade Commission shall have authority to pre- scribe such regulations as may be necessary to carry out the purposes of this subchapter with respect to any financial institution that is a person described in section 1029(a) of the Consumer Financial Protection Act of 2010 [12 U.S.C. 5519(a)].