GLBA Sections 6802 and 6803 - disclosure + notice + opt-out obligations. SECTION 6802 OBLIGATIONS WITH RESPECT TO DISCLOSURES: a financial institution may not disclose NPI to a NONAFFILIATED THIRD PARTY unless (a) the financial institution has provided the consumer a notice complying with Section 6803; (b) for non-marketing disclosures the institution clearly + conspicuously discloses + the consumer is given a REASONABLE OPPORTUNITY TO OPT OUT before the disclosure occurs + the consumer does not opt out. EXCEPTIONS include disclosures to service providers + joint marketing partners + as necessary to effect/administer/enforce a transaction + with consent + protect against fraud + comply with law + to regulators + and others (Sec. 6802(e)). RE-DISCLOSURE LIMITATIONS (Sec. 6802(c)): a nonaffiliated third party receiving NPI from a financial institution may not directly or indirectly disclose such information to any other person that is a nonaffiliated third party of both the disclosing financial institution + such recipient + unless the disclosure would be lawful if made directly. SECTION 6803 DISCLOSURE OF INSTITUTION PRIVACY POLICY: at the time of establishing a customer relationship + and NOT LESS THAN ANNUALLY during continuation + a financial institution shall provide a CLEAR AND CONSPICUOUS DISCLOSURE of its policies + practices with respect to (1) disclosing NPI to affiliates + nonaffiliated third parties + including the categories of information; (2) disclosing NPI of former customers; (3) protecting the NPI of consumers. EXCEPTIONS to annual notice were created by the FAST Act 2015 - no annual notice required if institution does not share information with nonaffiliated third parties + and has not changed its policies since last notice provided. MODEL PRIVACY FORM: issued by 8 regulators jointly + provides safe-harbor compliance with Section 6803.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.