1016.3 of Regulation P defines customers and consumer differently. Basically, a customer has a relationship with you (like one who obtained a loan) and a consumer may not have a relationship with you (like someone who applied for a loan that was denied).
An example from 1016.3(e)(2)(i):
"(i) An individual who applies to you for credit for personal, family, or household purposes is a consumer of a financial service, regardless of whether the credit is extended."
1016.4 explains when the privacy notice is required for both customers and consumers. In simple terms, consumers (who are not customers) must get a privacy notice (with an opt-out option) before you share their information.
From 1016.4:
"(a) Initial notice requirement. You must provide a clear and conspicuous notice that accurately reflects your privacy policies and practices to:
(1) Customer. An individual who becomes your customer, not later than when you establish a customer relationship, except as provided in paragraph (e) of this section; and
(2) Consumer. A consumer, before you disclose any nonpublic personal information about the consumer to any nonaffiliated third party, if you make such a disclosure other than as authorized by §§1016.14 and 1016.15 of this part."
_________________________
Adam Witmer, CRCM
All statements are my opinion, not those of my employer, and should not be taken as legal advice.
www.compliancecohort.com