We're entering into a joint agreement with a nonaffiliated third party mortgage lender. However, we do not want to update our privacy disclosure to include that information. The Board is afraid of the negative connotations by including that paragraph under Sample Clause A-5 alternative 2. What our Board requests is that we obtain consent from each mortgage loan consumer prior to disclosing the nonpublic personal information. I know that a consumer may always consent to the disclosure of his or her information. So would this work so that all customers would not be advised of this practice just those who applied for real estate loans? Opinions? Thanks.

Watch out with this. Having just gone through a privacy exam, the examiners went so far as to say (with an opinion letter from OCC) that you cannot disclose account numbers (if that creates the possibility of the third party initiating charges to the account) even if the customer authorized you to do so. Basically, the customer can disclose the account number, or you can set up the charge for the third party, but you can't be in the business of giving third parties the potential of access to your accounts (including loan numbers). So I guess it depends on what information your talking about. Hope this helps.

My opinions are my own, worth what you paid for them, and not necessarily those of my employer.

I believe you are referring to Interp. Letter 910. Search this forum for that and FISI for discussion on this. You have to go thru yet another vendor for billing, as one option, to giving out account numbers.

Anonymous - Did examiners happen to mention anything about check printing companies directly charging customer accounts? I have heard from some that it is an exception and from others that it is not.

That really didn't come up, as this was a straight 3P marketing agreement. I don't know that the interpretive letter, correctly cited above would help, as it was pretty tightly focused on this ssort of agreement. The sentiment certainly seemed to be against giving 3P's access to customer accounts. 216.12 seems pretty focused on these sorts of arrangements though. Sorry, you'll have to rely on more experienced heads than mine for your question. My gut says they probably won't like it, but I have no support for that feeling.

Opinions expressed are my own and not necessarily those of my employer.

I can't put my hands on it, but I want to say (read as not verified) that because they have the account number to carry out the customers order, it is permissable for them to have the account number in an unencrypted form.

This is not viewed as a marketing transaction as is the above scenario, and is exempt. Again, it worries me that I have this belief but no documentation to back it up.

Andy - you probably just don't want to believe it's true because it would actually make sense and when does that ever happen in compliance? Thanks!!!

I agree that they can have the unencrypted account number, but can they charge the account directly. That's the part of the question that made me more nervous. That's what I didn't have an answer for.

In accordance with that interpretive letter, without the customer providing them the account number, the 3rd party cannot charge the customers account.

This is not the same situation. In order to carry out the request, the account number has to be known. This is a cross between a servicer of the bank and a marketer.

But if I were the check printing company, I'd have the cite and opinion letters at my fingertips. This wouldn't be the first time they were asked.

The prohibitions in GLBA against the sharing of account numbers for marketing purposes was to address the abuse that occured when banks turned over their customer's account numbers to telemarketers who would then try to sell them a product or service (Yes - for only $59.95 you will receive the featured Cheese of the Month!) Even when the customer said "No Thanks, I'm lactose intolerent", some telemarketers would still mark it as approved and send the charge along. (Yep - they met their sales quota, collected their incentive bonus and then quit before the customer would notice. Don't you love sales incentives?)

Now contrast that to the customer who has only 5 checks left and needs to order a new supply. Does anyone in this room think that when Congress was considering this bill EVER thought that having account numbers on checks was the issue? I know, I know, laws of unintended consequences, but rather than risk the cessation of all customer transactions, I will allow the CHECK PRINTER to know the customer's account number.

BTW - how ironic is it that the customer's privacy is better protected when they go through the Bank to order checks as opposed to going to one of those outside "Discount Check Printers." When the order is routed through us, the check printer has an agreement that they will NOT use the customer information for anything other than to fill the order. When your customer goes outside to order checks, the check printer can do anything they want with the information.

It would have been nice if this particular situation was addressed in a Q & A though......