[Code of Federal Regulations]
[Title 16, Volume 1]
[Revised as of January 1, 2001]
From the U.S. Government Printing Office via GPO Access
[CITE: 16CFR313.1]

[Page 392-393]
 
                     TITLE 16--COMMERCIAL PRACTICES
 
                   CHAPTER I--FEDERAL TRADE COMMISSION
 
PART 313--PRIVACY OF CONSUMER FINANCIAL INFORMATION--Table of Contents
 
Sec. 313.1  Purpose and scope.

    (a) Purpose. This part governs the treatment of nonpublic personal 
information about consumers by the financial institutions listed in 
paragraph (b) of this section. This part:
    (1) Requires a financial institution in specified circumstances to 
provide notice to customers about its privacy policies and practices;
    (2) Describes the conditions under which a financial institution may 
disclose nonpublic personal information about consumers to nonaffiliated 
third parties; and
    (3) Provides a method for consumers to prevent a financial 
institution from disclosing that information to most nonaffiliated third 
parties by ``opting out'' of that disclosure, subject to the exceptions 
in Secs. 313.13, 313.14, and 313.15.
    (b) Scope. This part applies only to nonpublic personal information 
about individuals who obtain financial products or services primarily 
for personal, family or household purposes from the institutions listed 
below. This part does not apply to information about companies or about 
individuals who obtain financial products or services for business, 
commercial, or agricultural purposes. This part applies to those 
``financial institutions'' and ``other persons'' over which the Federal 
Trade

[[Page 393]]

Commission (``Commission'') has enforcement authority pursuant to 
Section 505(a)(7) of the Gramm-Leach-Bliley Act. An entity is a 
``financial institution'' if its business is engaging in a financial 
activity as described in Section 4(k) of the Bank Holding Company Act of 
1956, 12 U.S.C. 1843(k), which incorporates by reference activities 
enumerated by the Federal Reserve Board in 12 CFR 211.5(d) and 12 CFR 
225.28. The ``financial institutions'' subject to the Commission's 
enforcement authority are those that are not otherwise subject to the 
enforcement authority of another regulator under Section 505 of the 
Gramm-Leach-Bliley Act. More specifically, those entities include, but 
are not limited to, mortgage lenders, ``pay day'' lenders, finance 
companies, mortgage brokers, account servicers, check cashers, wire 
transferors, travel agencies operated in connection with financial 
services, collection agencies, credit counselors and other financial 
advisors, tax preparation firms, non-federally insured credit unions, 
and investment advisors that are not required to register with the 
Securities and Exchange Commission. They are referred to in this part as 
``You.'' The ``other persons'' to whom this part applies are third 
parties that are not financial institutions, but that receive nonpublic 
personal information from financial institutions with whom they are not 
affiliated. Nothing in this part modifies, limits, or supersedes the 
standards governing individually identifiable health information 
promulgated by the Secretary of Health and Human Services under the 
authority of sections 262 and 264 of the Health Insurance Portability 
and Accountability Act of 1996, 42 U.S.C. 1320d-1320d-8. Any institution 
of higher education that complies with the Federal Educational Rights 
and Privacy Act (``FERPA''), 20 U.S.C. 1232g, and its implementing 
regulations, 34 CFR part 99, and that is also a financial institution 
subject to the requirements of this part, shall be deemed to be in 
compliance with this part if it is in compliance with FERPA.