1. Information collected and sources
The policy outlines the types of personal and financial information collected from customers, which can include details like names, addresses, Social Security numbers, income, account balances, and transaction history. It also specifies how and where this information is collected, whether directly from the customer through applications and transactions or through other sources like credit reporting agencies.
2. Information usage and sharing
The policy explains how the collected information is used by the financial institution and whether it’s shared with other entities. This section typically differentiates between sharing with affiliates (companies within the same corporate group) and non-affiliates (outside companies), and details any joint marketing efforts with other financial institutions. It also clarifies situations where information might be disclosed under legal exceptions, such as those outlined in the Gramm-Leach-Bliley Act (GLBA).
3. Customer rights and choices
Financial privacy policies inform customers of their rights regarding their data. These can include rights such as knowing what information is collected, requesting deletion or correction of data, opting out of certain sharing practices, and limiting the use of sensitive information.
4. Data security
The policy details the institution’s measures to protect customer information’s confidentiality, security, and integrity, including restricted access and security procedures.
5. Notice and consent mechanisms
Financial institutions must provide clear and understandable privacy notices to customers initially and annually. Policies also explain how customers can provide and withdraw consent for data processing.
6. Applicable laws and regulations
Policies often reference relevant federal and state laws, such as:
- The Gramm-Leach-Bliley Act (GLBA)Â (federal):Â Requires explaining information sharing and allowing opt-outs.
- The Fair Credit Reporting Act (FCRA) (federal):Â Covers credit reporting and sharing creditworthiness information.
- The California Financial Information Privacy Act (CFIPA) (state):Â Grants California residents rights to limit sharing of financial information.
- The California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) (state):Â Provide consumers with control over personal information, including rights to know, delete, opt-out, correct, and limit the use of sensitive information.Â
Note that some data collected by financial institutions under the GLBA is exempt from the CCPA.