If a customer alleges that a bank employee has violated their privacy, is the customer's recourse to file a suit? In researching the privacy regulation, I found no stated penalties. And if the customer files a suit, are there any limitations to relief the consumer seeks - punitive damages, etc.? If anyone knows if where to locate this information, I would appreciate your assistance.

There are no specific regulatory or statutory civil penalties of which I am aware.

So, we could be at the mercy of the court if the customer files suit?

I would be more worried about being at the mercy of the local press.

Clearly, the press can do your business the most damage. What you need to look to for purposes of law suits are the variety of state laws and federal that could be called into play. The area is much more complicated than regulation P. A lot depends on the type of harm done and how it was done.