Use and Disclosure Limit -- Financial Records

GLB section 6802: "A financial institution may not disclose nonpublic personal information to a nonaffiliated third party unless -- (A) such financial institution clearly and conspicuously discloses to the consumer, in writing or in electronic form or other form...,that such information may be disclosed to such third party; the consumer is given the opportunity, before the time that such information is initially disclosed, to direct that such information not be disclosed to such third party; and the consumer is given an explanation of how the consumer can exercise that nondisclosure option."

Financial institutions can provide nonpublic personal information to a non-affiliated third party "to perform services for or functions on behalf of the financial institution, including marketing ...if the financial institution fully discloses the providing of such information and enters into a contractual agreement with the third party that requires the third party to maintain the confidentiality of such information."

A nonaffiliated third party that receives nonpublic information may not disclose the information to any other person unless doing so would be lawful if made directly to such other person by the financial institution itself.)

Disclosure is permitted "as necessary to effect, administer, or enforce a transaction requested or authorized by the consumer;" "to the extent permitted or required...in accordance with the Right to Financial Privacy Act of 1978 (12 U.S.C. 3401 et seq.), to law enforcement agencies...or for an investigation on a matter related to public safety;" and "to comply with Federal, State, or local laws, rules, and other applicable legal requirements."