What must be in the initial privacy notice?

This content is from the eCFR and is authoritative but unofficial.

• Print/PDF
• Display Options
• Published Edition

§ 1016.4 Initial privacy notice to consumers required.

(a) Initial notice requirement. You must provide a clear and conspicuous notice that accurately reflects your privacy policies and practices to:

(1) Customer. An individual who becomes your customer, not later than when you establish a customer relationship, except as provided in paragraph (e) of this section; and

(2) Consumer. A consumer, before you disclose any nonpublic personal information about the consumer to any nonaffiliated third party, if you make such a disclosure other than as authorized by §§ 1016.14 and 1016.15 of this part.

(b) When initial notice to a consumer is not required. You are not required to provide an initial notice to a consumer under paragraph (a) of this section if:

(1) You do not disclose any nonpublic personal information about the consumer to any nonaffiliated third party, other than as authorized by §§ 1016.14 and 1016.15; and

(2) You do not have a customer relationship with the consumer.

(c) When you establish a customer relationship -

(1) General rule. You establish a customer relationship when you and the consumer enter into a continuing relationship.

(2) Special rule for loans. You establish a customer relationship with a consumer when you originate or acquire the servicing rights to a loan to the consumer for personal, family, or household purposes. If you subsequently transfer the servicing rights to that loan to another financial institution, the customer relationship transfers with the servicing rights.

(3) Examples -

(i) Examples of establishing customer relationship by financial institutions other than credit unions and covered entities subject to FTC enforcement jurisdiction. For purposes of this paragraph (c)(3)(i), “you” is limited to financial institutions other than credit unions and financial institutions described in § 1016.3(l)(3). You establish a customer relationship when the consumer:

(A) Opens a credit card account with you;

(B) Executes the contract to open a deposit account with you, obtains credit from you, or purchases insurance from you;

(C) Agrees to obtain financial, economic, or investment advisory services from you for a fee; or

(D) Becomes your client for the purpose of your providing credit counseling or tax preparation services.

(ii) Examples of establishing customer relationship by covered entities subject to FTC enforcement jurisdiction. For purposes of this paragraph (c)(3)(ii), “you” is limited to financial institutions described in § 1016.3(l)(3) of this part. You establish a customer relationship when the consumer:

(A) Opens a credit card account with you;

(B) Executes the contract to obtain credit from you or purchases insurance from you;

(C) Agrees to obtain financial, economic, or investment advisory services from you for a fee;

(D) Becomes your client for the purpose of your providing credit counseling or tax preparation services or to obtain career counseling while seeking employment with a financial institution or the finance, accounting, or audit department of any company (or while employed by such a company or financial institution);

(E) Provides any personally identifiable financial information to you in an effort to obtain a mortgage loan through you;

(F) Executes the lease for personal property with you;

(G) Is an obligor on an account that you purchased from another financial institution and whom you have located and begun attempting to collect amounts owed on the account; or

(H) Provides you with the information necessary for you to compile and provide access to all of the consumer's online financial accounts at your Web site.

(iii) Examples of establishing customer relationship by credit unions. For purposes of this paragraph (c)(3)(iii), “you” is limited to a credit union. You establish a customer relationship when the consumer:

(A) Becomes your member under your bylaws;

(B) Is a nonmember and opens a credit card account with you jointly with a member under your procedures;

(C) Is a nonmember and executes the contract to open a share or share draft account with you or obtains credit from you jointly with a member, including an individual acting as a guarantor;

(D) Is a nonmember and opens an account with you and you are a credit union designated as a low-income credit union;

(E) Is a nonmember and opens an account with you pursuant to State law and you are a State-chartered credit union.

(iv) Examples of loan rule. You establish a customer relationship with a consumer who obtains a loan for personal, family, or household purposes when you:

(A) Originate the loan to the consumer; or

(B) Purchase the servicing rights to the consumer's loan.

(d) Existing customers. When an existing customer obtains a new financial product or service from you that is to be used primarily for personal, family, or household purposes, you satisfy the initial notice requirements of paragraph (a) of this section as follows:

(1) You may provide a revised privacy notice, under § 1016.8 of this part, that covers the customer's new financial product or service; or

(2) If the initial, revised, or annual notice that you most recently provided to that customer was accurate with respect to the new financial product or service, you do not need to provide a new privacy notice under paragraph (a) of this section.

(e) Exceptions to allow subsequent delivery of notice.

(1) You may provide the initial notice required by paragraph (a)(1) of this section within a reasonable time after you establish a customer relationship if:

(i) Establishing the customer relationship is not at the customer's election; or

(ii) Providing notice not later than when you establish a customer relationship would substantially delay the customer's transaction and the customer agrees to receive the notice at a later time.

(2) Examples of exceptions -

(i) Not at customer's election.

(A) In the case of financial institutions other than credit unions and financial institutions described in § 1016.3(l)(3), establishing a customer relationship is not at the customer's election if you acquire a customer's deposit liability or the servicing rights to a customer's loan from another financial institution and the customer does not have a choice about your acquisition.

(B) In the case of financial institutions described in § 1016.3(l)(3), establishing a customer relationship is not at the customer's election if you acquire a customer's loan or the servicing rights from another financial institution and the customer does not have a choice about your acquisition.

(C) In the case of credit unions, establishing a customer relationship is not at the customer's election if you acquire a customer's deposit liability from another financial institution and the customer does not have a choice about your acquisition.

(ii) Substantial delay of customer's transaction. Providing notice not later than when you establish a customer relationship would substantially delay the customer's transaction when:

(A) You and the individual agree over the telephone to enter into a customer relationship involving prompt delivery of the financial product or service; or

(B) You establish a customer relationship with an individual under a program authorized by title IV of the Higher Education Act of 1965 (20 U.S.C. 1070 et seq.) or similar student loan programs where loan proceeds are disbursed promptly without prior communication between you and the customer.

(iii) No substantial delay of customer's transaction. Providing notice not later than when you establish a customer relationship would not substantially delay the customer's transaction when the relationship is initiated in person at your office or through other means by which the customer may view the notice, such as on a Web site.

(f) Delivery. When you are required to deliver an initial privacy notice by this section, you must deliver it according to § 1016.9 of this part. If you use a short-form initial notice for non-customers according to § 1016.6(d) of this part, you may deliver your privacy notice according to § 1016.6(d)(3).

Page 2

(a)

(1) General rule. Except as provided by paragraph (e) of this section, you must provide a clear and conspicuous notice to customers that accurately reflects your privacy policies and practices not less than annually during the continuation of the customer relationship. Annually means at least once in any period of 12 consecutive months during which that relationship exists. You may define the 12-consecutive-month period, but you must apply it to the customer on a consistent basis.

(2) Example. You provide a notice annually if you define the 12-consecutive-month period as a calendar year and provide the annual notice to the customer once in each calendar year following the calendar year in which you provided the initial notice. For example, if a customer opens an account on any day of year 1, you must provide an annual notice to that customer by December 31 of year 2.

(b)

(1) Termination of customer relationship. You are not required to provide an annual notice to a former customer.

(2) Examples in the case of financial institutions other than credit unions and covered entities subject to FTC enforcement jurisdiction. For purposes of this paragraph (b)(2), “you” is limited to financial institutions other than credit unions and financial institutions described in § 1016.3(l)(3). Your customer becomes a former customer when:

(i) In the case of a deposit account, the account is inactive under your policies;

(ii) In the case of a closed-end loan, the customer pays the loan in full, you charge off the loan, or you sell the loan without retaining servicing rights;

(iii) In the case of a credit card relationship or other open-end credit relationship, you no longer provide any statements or notices to the customer concerning that relationship or you sell the credit card receivables without retaining servicing rights; or

(iv) You have not communicated with the customer about the relationship for a period of 12 consecutive months, other than to provide annual privacy notices or promotional material.

(3) Examples in the case of covered entities subject to FTC enforcement jurisdiction. For purposes of this paragraph (b)(3), “you” is limited to financial institutions described in § 1016.3(l)(3) of this part. Your customer becomes a former customer when:

(i) In the case of a closed-end loan, the customer pays the loan in full, you charge off the loan, or you sell the loan without retaining servicing rights;

(ii) In the case of a credit card relationship or other open-end credit relationship, you sell the receivables without retaining servicing rights;

(iii) In the case of credit counseling services, the customer has failed to make required payments under a debt management plan, has been notified that the plan is terminated, and you no longer provide any statements or notices to the customer concerning that relationship;

(iv) In the case of mortgage or vehicle loan brokering services, your customer has obtained a loan through you (and you no longer provide any statements or notices to the customer concerning that relationship), or has ceased using your services for such purposes;

(v) In the case of tax preparation services, you have provided and received payment for the service and no longer provide any statements or notices to the customer concerning that relationship;

(vi) In the case of providing real estate settlement services, at the time the customer completes execution of all documents related to the real estate closing, you have received payment, or you have completed all of your responsibilities with respect to the settlement, including filing documents on the public record, whichever is later; or

(vii) In cases where there is no definitive time at which the customer relationship has terminated, you have not communicated with the customer about the relationship for a period of 12 consecutive months, other than to provide annual privacy notices or promotional material.

(4) Examples in the case of a credit union. An individual becomes a former customer of a credit union when:

(i) The individual is no longer the credit union's member as defined in the credit union's bylaws;

(ii) In the case of a nonmember's share or share draft account, the account is inactive under the credit union's policies;

(iii) In the case of a nonmember's closed-end loan, the loan is paid in full, the credit union charges off the loan, or the credit union sells the loan without retaining servicing rights;

(iii) In the case of a credit card relationship or other open-end credit relationship with a nonmember, the credit union no longer provides any statements or notices to the nonmember concerning that relationship, or the credit union sells the credit card receivables without retaining servicing rights; or

(v) The credit union has not communicated with the nonmember about the relationship for a period of 12 consecutive months, other than to provide annual privacy notices or promotional material.

(c) Special rule for loans in the case of a financial institution other than a credit union. If a financial institution other than a credit union does not have a customer relationship with a consumer under the special rule for loans in § 1016.4(c)(2) of this part, then it need not provide an annual notice to that consumer under this section.

(d) Delivery. When you are required to deliver an annual privacy notice by this section, you must deliver it according to § 1016.9 of this part.

(e) Exception to annual privacy notice requirement -

(1) When exception available. You are not required to deliver an annual privacy notice if you:

(i) Provide nonpublic personal information to nonaffiliated third parties only in accordance with the provisions of § 1016.13, § 1016.14, or § 1016.15; and

(ii) Have not changed your policies and practices with regard to disclosing nonpublic personal information from the policies and practices that were disclosed to the customer under § 1016.6(a)(2) through (5) and (9) in the most recent privacy notice provided pursuant to this part.

(2) Delivery of annual privacy notice after financial institution no longer meets requirements for exception. If you have been excepted from delivering an annual privacy notice pursuant to paragraph (e)(1) of this section and change your policies or practices in such a way that you no longer meet the requirements for that exception, you must comply with paragraph (e)(2)(i) or (e)(2)(ii) of this section, as applicable.

(i) Changes preceded by a revised privacy notice. If you no longer meet the requirements of paragraph (e)(1) of this section because you change your policies or practices in such a way that § 1016.8 requires you to provide a revised privacy notice, you must provide an annual privacy notice in accordance with the timing requirements in paragraph (a) of this section, treating the revised privacy notice as an initial privacy notice.

(ii) Changes not preceded by a revised privacy notice. If you no longer meet the requirements of paragraph (e)(1) of this section because you change your policies or practices in such a way that § 1016.8 does not require you to provide a revised privacy notice, you must provide an annual privacy notice within 100 days of the change in your policies or practices that causes you to no longer meet the requirements of paragraph (e)(1) of this section.

(iii) Examples.

(A) You change your policies and practices in such a way that you no longer meet the requirements of paragraph (e)(1) of this section effective April 1 of year 1. Assuming you define the 12-consecutive-month period pursuant to paragraph (a) of this section as a calendar year, if you were required to provide a revised privacy notice under § 1016.8 and you provided that notice on March 1 of year 1, you must provide an annual privacy notice by December 31 of year 2. If you were not required to provide a revised privacy notice under § 1016.8, you must provide an annual privacy notice by July 9 of year 1.

(B) You change your policies and practices in such a way that you no longer meet the requirements of paragraph (e)(1) of this section, and so provide an annual notice to your customers. After providing the annual notice to your customers, you once again meet the requirements of paragraph (e)(1) of this section for an exception to the annual notice requirement. You do not need to provide additional annual notices to your customers until such time as you no longer meet the requirements of paragraph (e)(1) of this section.