27.1 Privacy Sharing Exceptions, Account Numbers and Reuse
Key Takeaways
Privacy exceptions cover specified servicing, processing and other permitted disclosures.
Account-number marketing restrictions contain specific exceptions and must be applied to the actual arrangement.
Recipients’ redisclosure and reuse rights depend on how they received the information.
1. Section 13 Exception: Service Providers & Joint Marketing (12 CFR § 1016.13)
Permits sharing NPI with a nonaffiliated third party that performs services for the bank or executes joint marketing with another financial institution. To qualify for Section 13 protection, the bank must satisfy two mandatory requirements:
- Privacy Notice Disclosure: The bank must have fully disclosed that it shares NPI with service providers and joint marketing partners in its initial and annual privacy notices.
- Mandatory Confidentiality Agreement: The bank must execute a formal, written contract with the third party that strictly prohibits the third party from disclosing or using the NPI for any purpose other than executing the specific services or marketing authorized by the bank.
2. Section 14 Exception: Processing & Servicing Transactions (12 CFR § 1016.14)
Permits disclosing NPI as necessary to effect, administer, or enforce a transaction requested or authorized by the consumer. Covered activities include:
- Processing and clearing paper checks, Automated Clearing House (ACH) transfers, and wire transfers;
- Transmitting transaction data across credit card and debit card payment authorization networks (e.g., Visa, Mastercard);
- Servicing loans, billing statements, and maintaining escrow accounts;
- Performing securitization, secondary market loan sales, or reinsurance administration.
3. Section 15 Exception: Operational, Legal & Regulatory Mandates (12 CFR § 1016.15)
Permits disclosing NPI without opt-out for critical operational, safety, and legal functions:
- Fraud Prevention: Protecting against or preventing actual or potential fraud, unauthorized transactions, identity theft, or institutional claims;
- Risk Management & Professional Advisers: Disclosing records to institutional risk managers, internal auditors, external certified public accountants, legal counsel, and credit rating agencies;
- Credit Reporting: Reporting customer loan performance and payment histories to consumer reporting agencies (CRAs) in compliance with the Fair Credit Reporting Act (FCRA);
- Legal Process & Regulatory Supervision: Complying with federal, state, or local laws, grand jury subpoenas, judicial court orders, government civil investigative demands, or formal regulatory examinations conducted by the OCC, Federal Reserve, FDIC, CFPB, or state banking agencies.
4. Account Number Protection & Redisclosure Limitations
Regulation P enforces two vital consumer safeguards designed to prevent unauthorized financial exploitation:
Account-Number Marketing Restriction and Exceptions (12 CFR § 1016.12)
A depository institution must not disclose, directly or through an affiliate, an account number or similar access number or access code for a transaction account (including checking accounts, savings accounts, credit cards, or lines of credit) to any nonaffiliated third party for use in:
- Telemarketing;
- Direct mail marketing; or
- Electronic mail (email) marketing.
Consent is not enough: An opt-in does not by itself override the account-number marketing restriction. Check the actual exceptions, including a marketing agent acting for the bank without authority to initiate charges, qualifying private-label or affinity card arrangements, and encrypted information that cannot be decoded by the recipient. Sharing a usable debit card number with an independent warranty seller for its own charges does not fit those examples.
Statutory Limits on Redisclosure and Reuse (12 CFR § 1016.11)
A nonaffiliated third party that receives NPI from a financial institution under a Section 14 or Section 15 exception is legally restricted: the third party may disclose and use the NPI only in the ordinary course of business to carry out the specific activity covered by the exception. The receiving third party cannot repurpose the NPI for independent commercial marketing or sell the information to data brokers.
5. Comparison Matrix: Regulation P Privacy Disclosures & Opt-Out Triggers
| Notice Type | Governing Section | Statutory Delivery Trigger | Mandatory Content Elements | Opt-Out Mechanism Required? |
|---|---|---|---|---|
| Initial Privacy Notice | 12 CFR § 1016.4 | Upon establishing customer relationship (account opening), or prior to disclosing NPI for consumers. | Categories of NPI collected/disclosed, third-party sharing categories, confidentiality safeguards, opt-out rules. | Yes, if sharing outside Sections 13, 14, 15 exceptions; No, if sharing solely under exceptions. |
| Annual Privacy Notice | 12 CFR § 1016.5 | Delivered at least once every 12 consecutive months during customer relationship. | Comprehensive review of privacy policies, practices, sharing categories, and active opt-out instructions. | Yes, if non-exempt sharing occurs; N/A if eligible for FAST Act exception. |
| FAST Act Exemption | 12 CFR § 1016.5(e) | Annual delivery excused if sharing solely under §§ 1016.13, .14, .15 AND policies unchanged. | No delivery required; institutional policies remain available on public website or upon request. | No, because no non-exempt sharing occurs. |
| Revised Privacy Notice | 12 CFR § 1016.8 | Before new non-exempt sharing, with a reasonable opt-out opportunity. | Specific explanation of new sharing categories, updated policy statement, and new opt-out instructions. | Yes, a reasonable opt-out opportunity is required. |
| Opt-Out Notice | 12 CFR § 1016.7 | Delivered with Initial, Annual, or Revised notice whenever non-exempt sharing is proposed. | Clear explanation of opt-out right, identification of sharing categories, and reasonable opt-out methods. | Yes, must provide reasonable, cost-free opt-out mechanism. |
Exceptions and annual-notice timing
Regulation P requires an annual notice at least once in any period of twelve consecutive months while the relationship continues; its calendar-year approach is permitted. The annual-notice exception requires both qualifying sharing practices and no policy changes that remove eligibility. A reasonable opt-out opportunity is required before non-exempt sharing; thirty days is an example, not a universal fixed statutory period. Section 1016.12 has account-number marketing exceptions, including specified agents performing marketing for the bank and private-label or affinity card arrangements, and certain encrypted information. A third party’s use of an actual debit card number to charge its own warranty premiums does not fit those exceptions. FCRA affiliate information sharing and affiliate marketing restrictions are separate analyses.
A regional commercial bank contracts with an independent predictive analytics firm to analyze deposit account transaction data and build internal credit risk scoring models. The bank's initial privacy notice disclosed that it shares information with service providers. The bank executes a written contract with the analytics firm that explicitly limits the firm's use of the customer data solely to developing the bank's internal scoring models and strictly prohibits redisclosure. Under CFPB Regulation P (12 CFR § 1016.13), how does this arrangement affect customer opt-out rights?
The arrangement violates Regulation P because customer transaction histories cannot be shared with external software vendors.
Customers have no opt-out rights because the sharing falls under the Section 13 service provider exception.
The bank must provide all affected customers with a 30-day opt-out notice before transmitting the data to the vendor.
The bank may only share the data if customers have affirmatively opted in to third-party data sharing.
A third-party auto warranty marketing company approaches a bank with a proposed partnership. Under the contract, the bank would provide the warranty company with the names, home addresses, phone numbers, and active debit card numbers of auto loan borrowers so the company can market extended vehicle warranties and automatically charge monthly premiums. How must the compliance officer advise executive management regarding this proposal under 12 CFR § 1016.12?
The bank may proceed with the partnership provided customers are given a 30-day notice and a reasonable opportunity to opt out.
The bank may disclose the debit card numbers only if the customer signs an affirmative opt-in consent form at loan origination.
The proposal is strictly prohibited under federal law, which generally prohibits, subject to specified exceptions, disclosing transaction account or debit card numbers to nonaffiliated third parties for marketing purposes.
The disclosure is permitted under the Section 13 joint marketing exception as long as a formal confidentiality agreement is executed.
Sections you finish are checked off in the contents.