Privacy Opt-Out vs Joint Marketing

If an institution wishes to market an ID protection account-add-on product of a third-party to its existing customers, and provide nonpublic personal information of its customers to that same third-party to do the marketing, does this fall under the joint marketing exception or is a privacy notice with an opt-out required?

I'm not sure how you could get this product to fall under a joint marketing agreement?

Randy,
I was thinking that since it is not the bank's product and it is being marketed by the third-party, there needs to be an privacy opt-out provided to all the customers of whom will be solicited. Are you thinking the same thing?

If you can't get it to fall into one of the exceptions, then an opt-out is needed.