We are trying to determine who we need to send a privacy notice to. We know our customers, however we are trying to determine our obligation to send notices to customers that call us and do not est a relationship, but we want to market them for other products/services. We now have their name, address and phone number in a data base. Must we send them a notice and provide them an opportunity to opt out of affiliate sharing ? Would the fact that we only have a name address and phone number that is public information make a difference? Basically we are asking if privacy notices are required for leads/prospects that do not result in an ongoing relationship.

(e)(1) Consumer means an individual who obtains or has obtained a financial product or service from you that is to be used primarily for personal, family, or household purposes, or that individual's legal representative.

(j)(1) Customer relationship means a continuing relationship between a consumer and you under which you provide one or more financial products or services to the consumer that are to be used primarily for personal, family, or household purposes. As noted in the examples, and for purposes of this part only, in the case of a credit union, a customer relationship will exist between a credit union and certain consumers that are not the credit union's members.

They would not fall under the definition of a consumer or a customer for Reg P purposes.

Take a look at the definition of "consumer" in the privacy regulation, which varies depending on whether you are at a credit union or not:

https://www.bankersonline.com/regulations/12-1016-003

There are some circumstances in which someone who provides information meets the definition even if no relationship is established. And you may need to provide a privacy notice if you share that consumer's information with nonaffiliated third parties under section 1016.4 of the regulation.

The question to me is around those customers / consumers that call us and we do not end up establishing a relationship with. This company retains their name. Can we provide their name to another affiliate or use that name to market a product to without providing them with an opt out privacy notice? Concern is if we did not give them that opportunity and would we be in violation of the privacy act if we shared their name and address?