16 C.F.R. § 313.4 : Commercial Practices — FEDERAL TRADE COMMISSION — REGULATIONS UNDER SPECIFIC ACTS OF CONGRESS — PRIVACY OF CONSUMER FINANCIAL INFORMATION — PRIVACY AND OPT OUT NOTICES — Initial privacy notice to consumers required

(a) Initial notice requirement. You must provide a clear and conspicuous notice that accurately reflects your privacy policies and practices to:

(1) Customer. An individual who becomes your customer, not later than when you establish a customer relationship, except as provided in paragraph (e) of this section; and

(2) Consumer. A consumer, before you disclose any nonpublic personal information about the consumer to any nonaffiliated third party, if you make such a disclosure other than as authorized by §§313.14 and 313.15.

(b) When initial notice to a consumer is not required. You are not required to provide an initial notice to a consumer under paragraph (a) of this section if:

(1) You do not disclose any nonpublic personal information about the consumer to any nonaffiliated third party, other than as authorized by §§313.14 and 313.15; and

(2) You do not have a customer relationship with the consumer.

(c) When you establish a customer relationship -

(1) General rule. You establish a customer relationship when you and the consumer enter into a continuing relationship.

(2) Special rule for loans. You establish a customer relationship with a consumer when you originate a loan to the consumer for personal, family, or household purposes. If you subsequently transfer the servicing rights to that loan to another financial institution, the customer relationship transfers with the servicing rights.

(3) Examples -

(i) Examples of establishing a customer relationship. You establish a customer relationship when the consumer:

(A) Executes the contract to obtain credit from you or purchase insurance from you; or

(B) Executes the lease for personal property with you.

(ii) Examples of loan rule. You establish a customer relationship with a consumer who obtains a loan for personal, family, or household purposes when you:

(A) Originate the loan to the consumer and retain the servicing rights; or

(B) Purchase the servicing rights to the consumer's loan.

(d) Existing customers. When an existing customer obtains a new financial product or service from you that is to be used primarily for personal, family, or household purposes, you satisfy the initial notice requirements of paragraph (a) of this section as follows:

(1) You may provide a revised privacy notice, under §313.8, that covers the customer's new financial product or service; or

(2) If the initial, revised, or annual notice that you most recently provided to that customer was accurate with respect to the new financial product or service, you do not need to provide a new privacy notice under paragraph (a) of this section.

(e) Exceptions to allow subsequent delivery of notice -

(1) General. You may provide the initial notice required by paragraph (a)(1) of this section within a reasonable time after you establish a customer relationship if:

(i) Establishing the customer relationship is not at the customer's election; or

(ii) Providing notice not later than when you establish a customer relationship would substantially delay the customer's transaction and customer agrees to receive the notice at a later time.

(2) Examples of exceptions -

(i) Substantial delay of customer's transaction. Providing notice not later than when you establish a customer relationship would substantially delay the customer's transaction when you and the individual agree over the telephone to enter into a customer relationship involving prompt delivery of the financial product or service.

(ii) No substantial delay of customer's transaction. Providing notice not later than when you establish a customer relationship would not substantially delay the customer's transaction when the relationship is initiated in person at your office or through other means by which the customer may view the notice, such as through a website.

(f) Delivery. When you are required to deliver an initial privacy notice by this section, you must deliver it according to §313.9. If you use a short-form initial notice for non-customers according to §313.6(d), you may deliver your privacy notice according to §313.6(d)(3).

16 C.F.R. §313.4

86 FR 70020, 1/10/2022