My bank has a question regarding our privacy notice and affiliate sharing. The bank’s privacy notice states that it shares customer information both with nonaffiliated third parties and with our affiliates for marketing purposes and that customers may opt out of having this information shared. The bank gives consumers 30 days to opt out before it begins sharing.
Q However, looking at Regulation V (Fair Credit Reporting Act or FCRA) §1022.24(b)(3)-(4), it appears that the bank does not have to wait 30 days if it presents the privacy notice to customers at the time of an online account opening or in person. Am I interpreting this portion correctly?
A Not quite. Though not explicit, it appears the regulation considers that, for accounts opened online or in person, 30 days is a “reasonable time to opt out.”
The examples in Regulation V’s §1022.24(b)(3) and (b)(4) that you cite indicate that requiring the consumer to decide to opt out before completing the opt-out notice electronically or in-person is a “reasonable opportunity to opt out” for “transactions.” Specifically, §1022.24(b)(3) provides, “The consumer is required to decide, as a necessary part of proceeding with the transaction, whether to opt out before completing the transaction.” (emphasis added) Section 1022.24(b)(4) uses similar terminology for in-person “transactions.”
In contrast, §1022.24 (b)(2) provides that, in the situation where the consumer has “obtained a product or service” through a website, a reasonable opportunity to opt out is 30 days. (emphasis added) The difference in the terminology suggests the examples in §1022.24(b)(3) and (b)(4) do not anticipate an account opening situation but an isolated transaction.
Moreover, under §1022.24(b)(5), if the bank includes the Regulation V opt-out notice with the Gramm-Leach- Bliley Act privacy opt-out notice (Regulation P), it must allow consumers to opt out “within a reasonable period of time” and in the same manner as the opt-out under Regulation P. Regulation P states that, for opening an account online, allowing consumers 30 days after the date the consumer receives the opt-out notice is a “reasonable opportunity” to opt out. (§1016.10(a)(3)) Regulation P provides other examples similar to those of Regulation V. Notably, its example allowing consumers to opt out at the time of the “transaction” is limited to “isolated transactions” such as “the purchase of a cashier’s check.” (§1016.10(a)(3)(iii))
Bottom line—while it is not explicit, the use of different terms in Regulation V’s examples and its example of referencing the Regulation P opt-out notice suggests that consumers should have 30 days to opt out under Regulation V when they open an account.
For more information, contact ABA’s Leslie Callaway.
Please note that this section is not a substitute for professional legal advice.
