By virtue of Federal Law signed by Clinton on 11/12/99.
All financial institutions are covered.
A “financial institution” is any institution the business of which is engaging in activities that are financial in nature or incidental to such financial activities, as determined by section 4(k) of the Bank Holding Company Act of 1956. Financial institutions can include banks, finance companies, mortgage bankers, and travel agents. (2)
(2) Certain functionally-regulated subsidiaries, such as brokers, dealers, and investment advisers will be subject to privacy regulations issued by the Securities and Exchange Commission. Insurance entities may be subject to privacy regulations issued by the respective state insurance authorities.
The regulations do not supersede, alter, or affect any state statute, regulation, order, or interpretation, except to the extent that it is inconsistent with the regulations. A state statute, regulation, order, etc. is consistent with the regulations if the protection it affords any consumer is greater than the protection provided under the regulations, as determined by the FTC.
I suggest you get a copy of the federal, and your state statutes to see what you need to be doing.
The opinions expressed are mine and they are not to be taken as legal advice.