GLBA

Subtitle A: Disclosure of nonpublic personal information (sections 501 to 510, 15 U.S.C. 6801 to 6809) – GLBA

GLBA 502(c): Sec. 502(c) (15 U.S.C. 6802(c)) Limits on reuse by the receiving third party

A nonaffiliated third party that receives nonpublic personal information from a financial institution under section 502 may not, directly or through an affiliate, disclose it to any other person that is a nonaffiliated third party of both the institution and the recipient, unless the disclosure would be lawful if made directly by the institution.

Maintained by Gerard BlokdykControl text last updated 21 May 2026

Other controls in Subtitle A: Disclosure of nonpublic personal information (sections 501 to 510, 15 U.S.C. 6801 to 6809) – GLBA

501(b) Sec. 501(b) (15 U.S.C. 6801(b)) Safeguards standard: security and confidentiality, anticipated threats, unauthorised access
502(a) Sec. 502(a) (15 U.S.C. 6802(a)) No disclosure to nonaffiliated third parties without a compliant notice
502(b)(1) Sec. 502(b)(1) (15 U.S.C. 6802(b)(1)) Opt-out before disclosure to nonaffiliated third parties
502(b)(2) Sec. 502(b)(2) (15 U.S.C. 6802(b)(2)) Service provider and joint marketing exception with disclosure and a confidentiality contract
502(d) Sec. 502(d) (15 U.S.C. 6802(d)) No sharing of account numbers for marketing
503(a) Sec. 503(a) (15 U.S.C. 6803(a)) Initial and annual privacy notice
503(b) Sec. 503(b) (15 U.S.C. 6803(b)) Contents of the privacy notice

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All GLBA controls