If our COB has a law practice that closes our mortgage loans, is the law practice an affiliate for privacy notice purposes?

Nobody knows?

Why do you think the law practice is an affiliate for privacy notice purposes?

"(a)(1) Affiliate means any company that controls, is controlled by, or is under common control with another company."

I didn't say that I think that it is. I asked a question.

Well, I was only asking because I wasn't sure if I was missing something in the question. If the law practice is a company that is controlled by or under common ownership of your bank, then it would be. If not, it would not be an affiliate for privacy purposes.

The law practice is owned by the bank's Chairman of the Board, so I still have the same question.

Ah, I see. I didn't relate COB to mean Chairman of the Board - so I was missing something to the question. For privacy purposes, the law practice is not an affiliate unless it is controlled by or under common ownership of your bank.

From Regulation P:
"(a)(1) Affiliate means any company that controls, is controlled by, or is under common control with another company."

The question you next have to answer is whether the Chairman (or the law firm) has control of both companies. The Fair Credit Reporting Act defines common ownership/control as follows:

(d) Common ownership or common corporate control means a relationship between two companies under which:

(1) One company has, with respect to the other company:

(i) Ownership, control, or power to vote 25 percent or more of the outstanding shares of any class of voting security of a company, directly or indirectly, or acting through one or more other persons;

(ii) Control in any manner over the election of a majority of the directors, trustees, or general partners (or individuals exercising similar functions) of a company; or

(iii) The power to exercise, directly or indirectly, a controlling influence over the management or policies of a company, as determined by the applicable prudential regulator (as defined in 12 U.S.C. 5481(24)) (a credit union is presumed to have a controlling influence over the management or policies of a credit union service corporation if the credit union service corporation is 67% owned by credit unions) or, where there is no prudential regulator, by the Bureau; or

(2) Any other person has, with respect to both companies, a relationship described in paragraphs (d)(1)(i) through (d)(1)(ii).

But the FCRA's definition is not the same as the Privacy definition, is it?
I need to know whether the COB's law practice is an affiliate for the privacy notice.