We offer investments through a non-affiliated third party investment company. Our in-bank investment advisor is a sole employee of the bank. They are not a dual employee. This investment advisor employee has access to the bank’s customers non-public personal information.

The Bank’s privacy notice indicates it does not share information with non-affiliated third parties nor for joint marketing. The Bank’s contract with the third party investment firm discusses joint marketing and the sharing of non-public personal information for purposes of providing products/services and advancing the investment program.

On the surface, it appears the Bank’s privacy notice is incorrect because their contract indicates they participate in joint marketing and the sharing of information with the non-affiliated third party.

Having said that, since the investment advisor is an employee of the bank and any sharing of information with the third party investment company is to provide products and services, does this meet one of the exceptions of 1016.13, 14, or 15? What are your thoughts on the privacy notice needing to be updated?