Appendix A to Part 160 - Model Privacy Form
17:2.0.1.1.26.6.1.1.21 : Appendix A
Appendix A to Part 160 - Model Privacy Form
A. The Model Privacy Form
B. General
Instructions 1. How the Model Privacy Form Is Used
(a) The model form may be used, at the option of a financial
institution, including a group of financial institutions that use a
common privacy notice, to meet the content requirements of the
privacy notice and opt-out notice set forth in §§ 160.6 and 160.7
of this part.
(b) The model form is a standardized form, including page
layout, content, format, style, pagination, and shading.
Institutions seeking to obtain the safe harbor through use of the
model form may modify it only as described in these
Instructions.
(c) Note that disclosure of certain information, such as assets,
income, and information from a consumer reporting agency, may give
rise to obligations under the Fair Credit Reporting Act [15 U.S.C.
1681-1681x] (FCRA), such as a requirement to permit a consumer to
opt out of disclosures to affiliates or designation as a consumer
reporting agency if disclosures are made to nonaffiliated third
parties.
(d) The word “customer” may be replaced by the word “member”
whenever it appears in the model form, as appropriate.
2. The Contents of the Model Privacy Form
The model form consists of two pages, which may be printed on
both sides of a single sheet of paper, or may appear on two
separate pages. Where an institution provides a long list of
institutions at the end of the model form in accordance with
Instruction C.3(a)(1), or provides additional information in
accordance with Instruction C.3(c), and such list or additional
information exceeds the space available on page two of the model
form, such list or additional information may extend to a third
page.
(a) Page One. The first page consists of the following
components:
(1) Date last revised (upper right-hand corner).
(2) Title.
(3) Key frame (Why?, What?, How?).
(4) Disclosure table (“Reasons we can share your personal
information”).
(5) “To limit our sharing” box, as needed, for the financial
institution's opt-out information.
(6) “Questions” box, for customer service contact
information.
(7) Mail-in opt-out form, as needed.
(b) Page Two. The second page consists of the following
components:
(1) Heading (Page 2).
(2) Frequently Asked Questions (“Who we are” and “What we
do”).
(3) Definitions.
(4) “Other important information” box, as needed.
3. The Format of the Model Privacy Form
The format of the model form may be modified only as described
below.
(a) Easily readable type font. Financial institutions
that use the model form must use an easily readable type font.
While a number of factors together produce easily readable type
font, institutions are required to use a minimum of 10-point font
(unless otherwise expressly permitted in these Instructions) and
sufficient spacing between the lines of type.
(b) Logo. A financial institution may include a corporate
logo on any page of the notice, so long as it does not interfere
with the readability of the model form or the space constraints of
each page.
(c) Page size and orientation. Each page of the model
form must be printed on paper in portrait orientation, the size of
which must be sufficient to meet the layout and minimum font size
requirements, with sufficient white space on the top, bottom, and
sides of the content.
(d) Color. The model form must be printed on white or
light color paper (such as cream) with black or other contrasting
ink color. Spot color may be used to achieve visual interest, so
long as the color contrast is distinctive and the color does not
detract from the readability of the model form. Logos may also be
printed in color.
(e) Languages. The model form may be translated into
languages other than English.
C. Information Required in the Model Privacy Form
The information in the model form may be modified only as
described below:
1. Name of the Institution or Group of Affiliated Institutions
Providing the Notice
Insert the name of the financial institution providing the
notice or a common identity of affiliated institutions jointly
providing the notice on the form wherever [name of financial
institution] appears.
2. Page One
(a) Last revised date. The financial institution must
insert in the upper right-hand corner the date on which the notice
was last revised. The information shall appear in minimum 8-point
font as “rev. [month/year]” using either the name or number of the
month, such as “rev. July 2009” or “rev. 7/09”.
(b) General instructions for the “What?” box. (1) The
bulleted list identifies the types of personal information that the
institution collects and shares. All institutions must use the term
“Social Security number” in the first bullet.
(2) Institutions must use five (5) of the following terms to
complete the bulleted list: Income; account balances; payment
history; transaction history; transaction or loss history; credit
history; credit scores; assets; investment experience; credit-based
insurance scores; insurance claim history; medical information;
overdraft history; purchase history; account transactions; risk
tolerance; medical-related debts; credit card or other debt;
mortgage rates and payments; retirement assets; checking account
information; employment information; wire transfer
instructions.
(c) General instructions for the disclosure table. The
left column lists reasons for sharing or using personal
information. Each reason correlates to a specific legal provision
described in paragraph C.2(d) of this Instruction. In the middle
column, each institution must provide a “Yes” or “No” response that
accurately reflects its information sharing policies and practices
with respect to the reason listed on the left. In the right column,
each institution must provide in each box one of the following
three (3) responses, as applicable, that reflects whether a
consumer can limit such sharing: “Yes” if it is required to or
voluntarily provides an opt-out; “No” if it does not provide an
opt-out; or “We don't share” if it answers “No” in the middle
column. Only the sixth row (“For our affiliates to market to you”)
may be omitted at the option of the institution. See
paragraph C.2(d)(6) of this Instruction.
(d) Specific disclosures and corresponding legal
provisions. (1) For our everyday business purposes. This
reason incorporates sharing information under §§ 160.14 and 160.15
and with service providers pursuant to § 160.13 of this part other
than the purposes specified in paragraphs C.2(d)(2) or C.2(d)(3) of
these Instructions.
(2) For our marketing purposes. This reason incorporates
sharing information with service providers by an institution for
its own marketing pursuant to § 160.13 of this part. An institution
that shares for this reason may choose to provide an opt-out.
(3) For joint marketing with other financial companies.
This reason incorporates sharing information under joint marketing
agreements between two or more financial institutions and with any
service provider used in connection with such agreements pursuant
to § 160.13 of this part. An institution that shares for this
reason may choose to provide an opt-out.
(4) For our affiliates' everyday business purposes -
information about transactions and experiences. This reason
incorporates sharing information specified in sections
603(d)(2)(A)(i) and (ii) of the FCRA. An institution that shares
for this reason may choose to provide an opt-out.
(5) For our affiliates' everyday business purposes -
information about creditworthiness. This reason incorporates
sharing information pursuant to section 603(d)(2)(A)(iii) of the
FCRA. An institution that shares for this reason must provide an
opt-out.
(6) For our affiliates to market to you. This reason
incorporates sharing information specified in section 624 of the
FCRA. This reason may be omitted from the disclosure table when:
the institution does not have affiliates (or does not disclose
personal information to its affiliates); the institution's
affiliates do not use personal information in a manner that
requires an opt-out; or the institution provides the affiliate
marketing notice separately. Institutions that include this reason
must provide an opt-out of indefinite duration. An institution not
required to provide an opt-out under this subparagraph may elect to
include this reason in the model form. Note: The CFTC's Regulations
do not address the affiliate marketing rule.
(7) For nonaffiliates to market to you. This reason
incorporates sharing described in §§ 160.7 and 160.10(a) of this
part. An institution that shares personal information for this
reason must provide an opt-out.
(e) To limit our sharing: A financial institution must
include this section of the model form only if it provides
an opt-out. The word “choice” may be written in either the singular
or plural, as appropriate. Institutions must select one or more of
the applicable opt-out methods described: telephone, such as by a
toll-free number; a Web site; or use of a mail-in opt-out form.
Institutions may include the words “toll-free” before telephone, as
appropriate. An institution that allows consumers to opt out online
must provide either a specific Web address that takes consumers
directly to the opt-out page or a general Web address that provides
a clear and conspicuous direct link to the opt-out page. The
opt-out choices made available to the consumer who contacts the
institution through these methods must correspond accurately to the
“Yes” responses in the third column of the disclosure table. In the
part titled “Please note” institutions may insert a number that is
30 or greater in the space marked “[30].” Instructions on voluntary
or state privacy law opt-out information are in paragraph C.2(g)(5)
of these Instructions.
(f) Questions box. Customer service contact information
must be inserted as appropriate, where [phone number] or [Web site]
appear. Institutions may elect to provide either a phone number,
such as a toll-free number, or a Web address, or both. Institutions
may include the words “toll-free” before the telephone number, as
appropriate.
(g) Mail-in opt-out form. Financial institutions must
include this mail-in form only if they state in the “To
limit our sharing” box that consumers can opt out by mail. The
mail-in form must provide opt-out options that correspond
accurately to the “Yes” responses in the third column in the
disclosure table. Institutions that require customers to provide
only name and address may omit the section identified as “[account
#].” Institutions that require additional or different information,
such as a random opt-out number or a truncated account number, to
implement an opt-out election should modify the “[account #]”
reference accordingly. This includes institutions that require
customers with multiple accounts to identify each account to which
the opt-out should apply. An institution must enter its opt-out
mailing address: in the far right of this form (see version
3); or below the form (see version 4). The reverse side of
the mail-in opt-out form must not include any content of the model
form.
(1) Joint accountholder. Only institutions that provide
their joint accountholders the choice to opt out for only one
accountholder, in accordance with paragraph C.3(a)(5) of these
Instructions, must include in the far left column of the mail-in
form the following statement: “If you have a joint account, your
choice(s) will apply to everyone on your account unless you mark
below. Apply my choice(s) only to me.” The word “choice” may be
written in either the singular or plural, as appropriate. Financial
institutions that provide insurance products or services, provide
this option, and elect to use the model form may substitute the
word “policy” for “account” in this statement. Institutions that do
not provide this option may eliminate this left column from the
mail-in form.
(2) FCRA Section 603(d)(2)(A)(iii) opt-out. If the
institution shares personal information pursuant to section
603(d)(2)(A)(iii) of the FCRA, it must include in the mail-in
opt-out form the following statement: “Do not share information
about my creditworthiness with your affiliates for their everyday
business purposes.”
(3) FCRA Section 624 opt-out. If the institution
incorporates section 624 of the FCRA in accord with paragraph
C.2(d)(6) of these Instructions, it must include in the mail-in
opt-out form the following statement: “Do not allow your affiliates
to use my personal information to market to me.”
(4) Nonaffiliate opt-out. If the financial institution
shares personal information pursuant to § 160.10(a) of this part,
it must include in the mail-in opt-out form the following
statement: “Do not share my personal information with nonaffiliates
to market their products and services to me.”
(5) Additional opt-outs. Financial institutions that use
the disclosure table to provide opt-out options beyond those
required by Federal law must provide those opt-outs in this section
of the model form. A financial institution that chooses to offer an
opt-out for its own marketing in the mail-in opt-out form must
include one of the two following statements: “Do not share my
personal information to market to me.” or “Do not use my
personal information to market to me.” A financial institution that
chooses to offer an opt-out for joint marketing must include the
following statement: “Do not share my personal information with
other financial institutions to jointly market to me.”
(h) Barcodes. A financial institution may elect to
include a barcode and/or “tagline” (an internal identifier) in
6-point font at the bottom of page one, as needed for information
internal to the institution, so long as these do not interfere with
the clarity or text of the form.
3. Page Two
(a) General Instructions for the Questions. Certain of
the Questions may be customized as follows:
(1) “Who is providing this notice?” This question may be
omitted where only one financial institution provides the model
form and that institution is clearly identified in the title on
page one. Two or more financial institutions that jointly provide
the model form must use this question to identify themselves as
required by § 160.9(f) of this part. Where the list of institutions
exceeds four (4) lines, the institution must describe in the
response to this question the general types of institutions jointly
providing the notice and must separately identify those
institutions, in minimum 8-point font, directly following the
“Other important information” box, or, if that box is not included
in the institution's form, directly following the “Definitions.”
The list may appear in a multi-column format.
(2) “How does [name of financial institution] protect my
personal information?” The financial institution may only
provide additional information pertaining to its safeguards
practices following the designated response to this question. Such
information may include information about the institution's use of
cookies or other measures it uses to safeguard personal
information. Institutions are limited to a maximum of 30 additional
words.
(3) “How does [name of financial institution] collect my
personal information?” Institutions must use five (5) of the
following terms to complete the bulleted list for this question:
Open an account; deposit money; pay your bills; apply for a loan;
use your credit or debit card; seek financial or tax advice; apply
for insurance; pay insurance premiums; file an insurance claim;
seek advice about your investments; buy securities from us; sell
securities to us; direct us to buy securities; direct us to sell
your securities; make deposits or withdrawals from your account;
enter into an investment advisory contract; give us your income
information; provide employment information; give us your
employment history; tell us about your investment or retirement
portfolio; tell us about your investment or retirement earnings;
apply for financing; apply for a lease; provide account
information; give us your contact information; pay us by check;
give us your wage statements; provide your mortgage information;
make a wire transfer; tell us who receives the money; tell us where
to send the money; show your government-issued ID; show your
driver's license; order a commodity futures or option trade.
Institutions that collect personal information from their
affiliates and/or credit bureaus must include after the bulleted
list the following statement: “We also collect your personal
information from others, such as credit bureaus, affiliates, or
other companies.” Institutions that do not collect personal
information from their affiliates or credit bureaus but do collect
information from other companies must include the following
statement instead: “We also collect your personal information from
other companies.” Only institutions that do not collect any
personal information from affiliates, credit bureaus, or other
companies can omit both statements.
(4) “Why can't I limit all sharing?” Institutions that
describe state privacy law provisions in the “Other important
information” box must use the bracketed sentence: “See below
for more on your rights under state law.” Other institutions must
omit this sentence.
(5) “What happens when I limit sharing for an account I hold
jointly with someone else?” Only financial institutions that
provide opt-out options must use this question. Other institutions
must omit this question. Institutions must choose one of the
following two statements to respond to this question: “Your choices
will apply to everyone on your account.” or “Your choices will
apply to everyone on your account - unless you tell us otherwise.”
Financial institutions that provide insurance products or services
and elect to use the model form may substitute the word “policy”
for “account” in these statements.
(b) General Instructions for the Definitions. The
financial institution must customize the space below the responses
to the three definitions in this section. This specific information
must be in italicized lettering to set off the information from the
standardized definitions.
(1) Affiliates. As required by § 160.6(a)(3) of this
part, where [affiliate information] appears, the financial
institution must:
(i) If it has no affiliates, state: “[name of financial
institution] has no affiliates”;
(ii) If it has affiliates but does not share personal
information, state: “[name of financial institution] does not
share with our affiliates”; or
(iii) If it shares with its affiliates, state, as applicable:
“Our affiliates include companies with a [common corporate
identity of financial institution] name; financial companies such
as [insert illustrative list of companies]; nonfinancial companies,
such as [insert illustrative list of companies]; and others, such
as [insert illustrative list].”
(2) Nonaffiliates. As required by § 160.6(c)(3) of this
part, where [nonaffiliate information] appears, the
financial institution must:
(i) If it does not share with nonaffiliated third parties,
state: ” [name of financial institution] does not share with
nonaffiliates so they can market to you”; or
(ii) If it shares with nonaffiliated third parties, state, as
applicable: “Nonaffiliates we share with can include
[list categories of companies such as mortgage companies,
insurance companies, direct marketing companies, and nonprofit
organizations].”
(3) Joint Marketing. As required by § 160.13 of this
part, where [joint marketing] appears, the financial
institution must:
(i) If it does not engage in joint marketing, state: “[name
of financial institution] doesn't jointly market”; or
(ii) If it shares personal information for joint marketing,
state, as applicable: “Our joint marketing partners include
[list categories of companies such as credit card
companies].”
(c) General instructions for the “Other important
information” box. This box is optional. The space provided for
information in this box is not limited. Only the following types of
information can appear in this box.
(1) State and/or international privacy law information;
and/or
(2) Acknowledgment of receipt form.
[74 FR 62975, Dec. 1, 2009]