Actually is says it must be given to customers as defined by section 509 Public Law 106--102.
From the FAQ to to GLBA:
http://www.ftc.gov/privacy/glbact/glb-faq.htmQ&A B. 1.
. . . A customer is a type of consumer, namely, an individual who has an ongoing relationship with you under which you provide a financial product or service. . . .Therefore if you will report negative information on the individual (customer) then yes you must provide the notice.