15 U.S.C. § 6801 — Protection of nonpublic personal informa-

Page 2289 TITLE 15—COMMERCE AND TRADE § 6801 (10) State law (A) In general The term ‘‘State law’’ includes all laws, decisions, rules, regulations, or other State action having the effect of law, of any State. (B) Laws applicable in the District of Colum- bia A law of the United States applicable only to or within the District of Columbia shall be treated as a State law rather than a law of the United States. (Pub. L. 106–102, title III, § 334, as added Pub. L. 114–1, title II, § 202(a), Jan. 12, 2015, 129 Stat. 27.) Editorial Notes PRIOR PROVISIONS Provisions similar to this section were contained in section 6766 of this title, prior to the general amend- ment of this subchapter by Pub. L. 114–1. A prior section 6764, Pub. L. 106–102, title III, § 334, Nov. 12, 1999, 113 Stat. 1433, related to coordination with other regulators, prior to the general amendment of this subchapter by Pub. L. 114–1. See section 6761 of this title. A prior section 6765, Pub. L. 106–102, title III, § 335, Nov. 12, 1999, 113 Stat. 1433, which related to judicial re- view, was omitted in the general amendment of this subchapter by Pub. L. 114–1. See section 6762 of this title. A prior section 6766, Pub. L. 106–102, title III, § 336, Nov. 12, 1999, 113 Stat. 1433, which related to definitions, was omitted in the general amendment of this sub- chapter by Pub. L. 114–1. SUBCHAPTER IV—RENTAL CAR AGENCY INSURANCE ACTIVITIES § 6781. Standard of regulation for motor vehicle rentals (a) Protection against retroactive application of regulatory and legal action Except as provided in subsection (b), during the 3-year period beginning on November 12, 1999, it shall be a presumption that no State law imposes any licensing, appointment, or edu- cation requirements on any person who solicits the purchase of or sells insurance connected with, and incidental to, the lease or rental of a motor vehicle. (b) Preeminence of State insurance law No provision of this section shall be construed as altering the validity, interpretation, con- struction, or effect of— (1) any State statute; (2) the prospective application of any court judgment interpreting or applying any State statute; or (3) the prospective application of any final State regulation, order, bulletin, or other statutorily authorized interpretation or ac- tion, which, by its specific terms, expressly regulates or exempts from regulation any person who so- licits the purchase of or sells insurance con- nected with, and incidental to, the short-term lease or rental of a motor vehicle. (c) Scope of application This section shall apply with respect to— (1) the lease or rental of a motor vehicle for a total period of 90 consecutive days or less; and (2) insurance which is provided in connection with, and incidentally to, such lease or rental for a period of consecutive days not exceeding the lease or rental period. (d) Motor vehicle defined For purposes of this section, the term ‘‘motor vehicle’’ has the same meaning as in section 13102 of title 49. (Pub. L. 106–102, title III, § 341, Nov. 12, 1999, 113 Stat. 1434.) CHAPTER 94—PRIVACY SUBCHAPTER I—DISCLOSURE OF NONPUBLIC PERSONAL INFORMATION Sec. 6801. Protection of nonpublic personal information. 6802. Obligations with respect to disclosures of per- sonal information. 6803. Disclosure of institution privacy policy. 6804. Rulemaking. 6805. Enforcement. 6806. Relation to other provisions. 6807. Relation to State laws. 6808. Study of information sharing among financial affiliates. 6809. Definitions. SUBCHAPTER II—FRAUDULENT ACCESS TO FINANCIAL INFORMATION 6821. Privacy protection for customer information of financial institutions. 6822. Administrative enforcement. 6823. Criminal penalty. 6824. Relation to State laws. 6825. Agency guidance. 6826. Reports. 6827. Definitions. SUBCHAPTER I—DISCLOSURE OF NONPUBLIC PERSONAL INFORMATION § 6801. Protection of nonpublic personal informa- tion (a) Privacy obligation policy It is the policy of the Congress that each fi- nancial institution has an affirmative and con- tinuing obligation to respect the privacy of its customers and to protect the security and con- fidentiality of those customers’ nonpublic per- sonal information. (b) Financial institutions safeguards In furtherance of the policy in subsection (a), each agency or authority described in section 6805(a) of this title, other than the Bureau of Consumer Financial Protection, shall establish appropriate standards for the financial institu- tions subject to their jurisdiction relating to ad- ministrative, technical, and physical safe- guards— (1) to insure the security and confidentiality of customer records and information; (2) to protect against any anticipated threats or hazards to the security or integrity of such records; and (3) to protect against unauthorized access to or use of such records or information which could result in substantial harm or inconven- ience to any customer. Page 2290 TITLE 15—COMMERCE AND TRADE § 6802 (Pub. L. 106–102, title V, § 501, Nov. 12, 1999, 113 Stat. 1436; Pub. L. 111–203, title X, § 1093(1), July 21, 2010, 124 Stat. 2095.) Editorial Notes AMENDMENTS 2010—Subsec. (b). Pub. L. 111–203 inserted ‘‘, other than the Bureau of Consumer Financial Protection,’’ after ‘‘section 6805(a) of this title’’ in introductory pro- visions. Statutory Notes and Related Subsidiaries EFFECTIVE DATE OF 2010 AMENDMENT Amendment by Pub. L. 111–203 effective on the des- ignated transfer date, see section 1100H of Pub. L. 111–203, set out as a note under section 552a of Title 5, Government Organization and Employees. EFFECTIVE DATE Pub. L. 106–102, title V, § 510, Nov. 12, 1999, 113 Stat. 1445, provided that: ‘‘This subtitle [subtitle A (§§ 501–510) of title V of Pub. L. 106–102, enacting this subchapter and amending section 1681s of this title] shall take effect 6 months after the date on which rules are required to be prescribed under section 504(a)(3) [15 U.S.C. 6804(a)(3)], except— ‘‘(1) to the extent that a later date is specified in the rules prescribed under section 504; and ‘‘(2) that sections 504 [15 U.S.C. 6804] and 506 [enact- ing section 6806 of this title and amending section 1681s of this title] shall be effective upon enactment [Nov. 12, 1999].’’ § 6802. Obligations with respect to disclosures of personal information (a) Notice requirements Except as otherwise provided in this sub- chapter, a financial institution may not, di- rectly or through any affiliate, disclose to a nonaffiliated third party any nonpublic personal information, unless such financial institution provides or has provided to the consumer a no- tice that complies with section 6803 of this title. (b) Opt out (1) In general A financial institution may not disclose nonpublic personal information to a non- affiliated third party unless— (A) such financial institution clearly and conspicuously discloses to the consumer, in writing or in electronic form or other form permitted by the regulations prescribed under section 6804 of this title, that such in- formation may be disclosed to such third party; (B) the consumer is given the opportunity, before the time that such information is ini- tially disclosed, to direct that such informa- tion not be disclosed to such third party; and (C) the consumer is given an explanation of how the consumer can exercise that non- disclosure option. (2) Exception This subsection shall not prevent a financial institution from providing nonpublic personal information to a nonaffiliated third party to perform services for or functions on behalf of the financial institution, including marketing of the financial institution’s own products or services, or financial products or services of- fered pursuant to joint agreements between two or more financial institutions that com- ply with the requirements imposed by the reg- ulations prescribed under section 6804 of this title, if the financial institution fully discloses the providing of such information and enters into a contractual agreement with the third party that requires the third party to main- tain the confidentiality of such information. (c) Limits on reuse of information Except as otherwise provided in this sub- chapter, a nonaffiliated third party that re- ceives from a financial institution nonpublic personal information under this section shall not, directly or through an affiliate of such re- ceiving third party, disclose such information to any other person that is a nonaffiliated third party of both the financial institution and such receiving third party, unless such disclosure would be lawful if made directly to such other person by the financial institution. (d) Limitations on the sharing of account num- ber information for marketing purposes A financial institution shall not disclose, other than to a consumer reporting agency, an account number or similar form of access num- ber or access code for a credit card account, de- posit account, or transaction account of a con- sumer to any nonaffiliated third party for use in telemarketing, direct mail marketing, or other marketing through electronic mail to the con- sumer. (e) General exceptions Subsections (a) and (b) shall not prohibit the disclosure of nonpublic personal information— (1) as necessary to effect, administer, or en- force a transaction requested or authorized by the consumer, or in connection with— (A) servicing or processing a financial product or service requested or authorized by the consumer; (B) maintaining or servicing the con- sumer’s account with the financial institu- tion, or with another entity as part of a pri- vate label credit card program or other ex- tension of credit on behalf of such entity; or (C) a proposed or actual securitization, secondary market sale (including sales of servicing rights), or similar transaction re- lated to a transaction of the consumer; (2) with the consent or at the direction of the consumer; (3)(A) to protect the confidentiality or secu- rity of the financial institution’s records per- taining to the consumer, the service or prod- uct, or the transaction therein; (B) to protect against or prevent actual or potential fraud, unauthorized transactions, claims, or other li- ability; (C) for required institutional risk con- trol, or for resolving customer disputes or in- quiries; (D) to persons holding a legal or bene- ficial interest relating to the consumer; or (E) to persons acting in a fiduciary or representa- tive capacity on behalf of the consumer; (4) to provide information to insurance rate advisory organizations, guaranty funds or agencies, applicable rating agencies of the fi- nancial institution, persons assessing the in-