Without getting into the details of what information you are sharing and to whom, it is allowable to say "No" the consumer cannot limit sharing if it is the bank's policy to not allow the consumer to limit sharing. I don't believe there is a specific citation that states this other than the language below which requires the disclosure to accurately reflect the institutions practices.
§1016.4 Initial privacy notice to consumers required.
(a) Initial notice requirement. You must provide a clear and conspicuous notice that accurately reflects your privacy policies and practices to:
(1) Customer. An individual who becomes your customer, not later than when you establish a customer relationship, except as provided in paragraph (e) of this section; and
(2) Consumer. A consumer, before you disclose any nonpublic personal information about the consumer to any nonaffiliated third party, if you make such a disclosure other than as authorized by §§1016.14 and 1016.15 of this part
_________________________
Opinions expressed are my own and do not reflect legal advice or the opinions of my employer.