You need to be careful if you use Reg E model language. In the confidentiality section, the last clause reads that you will only disclose information to third parties about the account: "If you give us your written permission". So, unless the situation falls under one of the earlier clauses (completing transfers, verifying account or in response to government orders) you have disclosed an "opt-in" requirement for release of information instead of the "opt-out" in your GLB notice.
------------------
This is a personal observation that should not be taken as legal advice nor relied upon for any purpose.