We have had a number of calls asking for an address for somebody. The compliance officer says we can give this out because anybody can go on the internet now and get this info or it's in the phone book so it's public informatin these days. Our privacy officer says, we are basically telling the caller that the person has an account with us so no we can't give it out. What would be the correct procedure???

We do not give out addresses or phone numbers over the phone. To me it is a privacy issue just like your privacy officer said.

I concur - you are admitting that the customer is or has been a customer, plus it might be just the beginning of a social engineering ploy.

Your bank is not "Directory Assistance." Regardless of any legal issues, I'm surprised that any bank would consider giving out a customer's address.