What are people doing to comply with each State's different disclosure requirements regarding a consumer's personal information? Specifically, we use the Model Notice and we don't currently share consumer information for any reason that would require an opt out (we do have joint marketing relationships). We offer products online which would be available to consumers in all States and from what I've seen multiple States (CA for example) have disclosure requirements that are outside of the Model Privacy Notice. My opinion is that since we don't share outside of exceptions we are okay but do we need to specifically address CA residents or residents of other States that have similar laws in our Policy?

Thanks, that is helpful.

The thread that Randy linked to relates to the California Online Privacy Protection Act which relates to the type of privacy notice that shows up on websites. It sounds as though you might be interested in a different California privacy law, the California Financial Information Privacy Act:


http://www.leginfo.ca.gov/cgi-bin/displaycode?section=fin&group=04001-05000&file=4050-4060

This is the one that would affect your GLB privacy notice if you have customers in California.

"Financial institution" means any institution the business of which is engaging in financial activities as described in Section 1843(k) of Title 12 of the United States Code and doing business in this state.

I would argue that I am not doing business in California. I am doing business in the State in which I am located and if a Californian wants to come to me and open an account, it does not change where I am doing business.

If you are a National Bank not domiciled in California, you could also point to your preemption authority.