Affiliate Sharing

I asked a similar question before but...we will be acquiring an insurance company as an affilate of the bank. Currently our privacy policy is we do not share therefore no "opt-out" required. If individuals taking consumer loan application discuss the insurance affiliate with the customer and asks if they want to forward information to or have an insurance person call them does the bank have to change its privacy policy and provide an opt-out when the customer has given consent. Information from old files would not be provided to the insurance affiliate in order to solicate any customers for insurance.

So, you have told your customers that you will NOT share with affiliates? If so, I would think you would need authorization (opt-in) from the customer in order to share.

Does anyone agree?

We state that we share as permitted by law

Leslie, if what you are saying is that no information on the customer is shared before getting permission, but only that the person is asked if they can be called by any other entity then you have no problem. If you get the customers permission to share, you can do so (only for the purpose authorized).

leslie, you are permitted to share by law with different entitles such as credit bureaus, service providers, etc, but, have you specifically told your customer that you do not share with affiliates or that you may share with affiliates and if so provided them with option to opt-out?

As long as you share the information "with the consent or at the direction of the consumer" you have an exception under .15(a)(1) and the notice and opt-out rules do not apply to .15 exceptions. You might want to get that consent in writing to document it, however.

------------------
This is a personal observation that should not be taken as legal advice nor relied upon for any purpose.

Sharing info with an affiliate is governed by the Fair Credit Reporting Act. If you intend to share, you must notify your customers that you wish to share with your affiliates and provide them with the opportunity to opt out. Once this has been accomplished you may share with your affiliates. However, under GLBA you must include your affiliate sharing practices in your privacy policy and the FCRA opt out must also be included. If you not already mailed your privacy policies out this year, you may wish to re-write them to include this provision and opt-out notice.
You may share your customers info without doing this if you have their consent in writing.

[This message has been edited by Louvera (edited 02-27-2002).]

Ted, Does the exception you sited apply to affilate sharing?

Leslie: There are two issues, the privacy notice requirements and FCRA. If information is shared under a .15 exception (such as consent) the privacy notice and opt-out requirements do not apply. As far as FCRA is concerned, if the information shared with the affiliate is limited to transaction and experience information no opt-out is needed. So, unless the institution is planning on sharing information outside of their dealings with the customer (and I don't know why you would have to do this just to make a referral) the opt-out can be avoided.

------------------
This is a personal observation that should not be taken as legal advice nor relied upon for any purpose.

I agree with Louvera, you should revise your privacy policy to reflect this. Although you are permitted by law to share transactional information with an affiliate, you cannot share additional information (SS#, balance sheet info, info from credit bureaus,etc.) without providing the customer the opportunity to opt out.

We also have an insurance company as an affiliate. We provide the privacy policy at the time a customer applies for a mortgage with our mortgage affiliate and that gives them the opportunity to opt out of sharing. We also verbally ask (as an extra courtesy) the customer if they would like an insurance affiliate rep to contact them for a quote. This satisfied the examiners during their last visit.

My institution is a community bank and we have a financial services affiliate which includes the sale of insurance and investments. In our privacy disclosure we disclose that we share transaction and experience information with our affiliate, including name, address, balances, activity, types of accounts, payment history, and deposit history. We do not share any information that would trigger the FCRA or the GLB opt-out; therefore have not provided our customers with this option. During the course of my research I spoke with an OTS Compliance Analyst who reviewed our policy and procedures and informed me we were in compliance with the regulations.

We mailed over 28,000 of the privacy disclosures and 15 customers responded with concerns. Of those 15, 9 customers absolutely demanded that our financial services affiliate not contact them. As a means of courtesy and good customer service, we assured those 9 customers they would receive nothing from our affiliate. It is that time again and I am not looking forward to the re-disclosure. Although our policy has not changed over the last year, I am sure I will receive more calls with new concerns over the same old policy.

Our policy is similar in that we do not disclose any info unless we receive written permission from the customer (therefore not needing the opt-out provision) and we also have an insurance company in the bank. We just cover ourselves by taking the customer over to the insurance office and let the customer give info directly, or we would get a written consent fromt the customer if they wanted us to forward the info on.