15 U.S.C. § 6802 — Obligations with respect to disclosures of personal information

(a) Notice. Unless this subchapter provides otherwise, a financial institution^* may not disclose a consumer's nonpublic personal information^* to a nonaffiliated third party^*, directly or through an affiliate^*, unless it gives the consumer^* a notice meeting section 6803. This section does not define “nonpublic personal information,” “nonaffiliated third party,” or “financial institution.”

(b) Opt-out. (1) Before making the first disclosure, the institution must clearly and conspicuously tell the consumer in writing, electronically, or in another permitted form that the information may be disclosed; give the consumer a chance to tell the institution not to disclose it; and explain how to exercise that choice. (2) This does not stop the institution from giving information to a nonaffiliated third party that performs services or functions for the institution, including marketing the institution's own products or services or products offered under a compliant joint agreement^*, if the institution fully discloses the sharing and contracts with the third party to keep the information confidential.

(c) Reuse. A nonaffiliated third party that receives information under this section may not disclose it, directly or through its affiliate, to another person who is a nonaffiliated third party of both institutions unless the financial institution itself could lawfully have made that disclosure.

(d) Account numbers. A financial institution may not give a nonaffiliated third party a consumer's credit-card, deposit-account, or transaction-account number or similar access number or code for telemarketing, direct mail, or electronic-mail marketing to that consumer. The only stated exception is disclosure to a consumer reporting agency.

(e) General exceptions. Subsections (a) and (b) do not bar disclosure—(1) as needed to carry out, administer, or enforce a consumer-requested or authorized transaction, including servicing a financial product, maintaining an account or private-label credit account, or a securitization or secondary-market transaction; (2) with the consumer's consent or direction; (3) to protect records, products, transactions, or security; prevent or investigate fraud, unauthorized transactions, claims, or liability; control institutional risk or resolve disputes; or to persons with a legal or beneficial interest or acting for the consumer; (4) to insurance advisory organizations, guaranty funds or agencies, rating agencies, industry-standard assessors, attorneys, accountants, or auditors; (5) when specifically allowed or required by law and the Right to Financial Privacy Act, to listed law-enforcement, regulatory, self-regulatory, or public-safety investigators; (6) to a consumer reporting agency under the Fair Credit Reporting Act, or from a consumer report; (7) in a proposed or actual sale, merger, transfer, or exchange of all or part of a business or operating unit when the information concerns only that business or unit's consumers; or (8) to obey Federal, State, or local law, a properly authorized investigation, subpoena, summons, judicial process, or examination or other action by a regulator with jurisdiction.