Currently our Privacy Notice is that "we do not share outside the permitted purposes"...nothing to opt out of. We are going to purchase some insurance agencies and want to solicate current customer for insurance. If a bank employee calls customer to let them know we know offer insurance and if the customer is interested we can forward their information to an agent who will call them.....is a verbal ok from the customer enough. Verses giving the information to the agent directly and having them solicit the customers. I know I would have to change our privacy policy and give an opt out under the second senario....What do you guys think??

Did you include a Fair Credit Reporting Act affiliate sharing provision in your privacy notice? Did it provide an opt out for your customers? If so, you should be fine. If not, you may wish to review your next Privacy policy to include this.

It depends on what information you want to share about that customer. You can share transaction and experience data with an affiliated insurance agency without providing an opt-out. The fact that a customer is a customer is experiential. The OCC has said that other identification-orient information, such as address and phone number, are also considered transaction or experience data and so not subject to opt-out under FCRA.

I do believe that you have to include in your privacy notice a statment that you share information with your affiliates as permitted by law. If you said in your privacy notice that you do not share any data with your affiliates, I would recommend sending a revised notice before sharing.