Can our wholly owned subsidiary share its customer information with us for marketing purposes? What steps do we need to take before we can receive and use this information?

Yes, you may use customer information that you receive from your wholly owned subsidiary for marketing purposes, provided that you disclose this arrangement to your customers and offer them the opportunity to opt out.

The Illinois Banking Act’s prohibition on disclosing customer financial records does not apply to the exchange in the regular course of business of information between a bank and any commonly owned affiliate.

In addition, the Fair Credit Reporting Act (FCRA) permits entities under common ownership or affiliated by corporate control to share customer information for marketing purposes, provided that they clearly and conspicuously disclose to customers what information will be shared and provide customers an opportunity to opt-out. The opt-out notice should be provided by the entity that has or had a pre-existing business relationship with the customer or as part of a joint notice, where at least one of the affiliates has or had a pre-existing business relationship with the customer.

For resources related to our guidance, please see:

Illinois Banking Act, 205 ILCS 48.1(b)(15) (“This Section does not prohibit: . . . [t]he exchange in the regular course of business of information between a bank and any commonly owned affiliate of the bank, subject to the provisions of the Financial Institutions Insurance Sales Law.”)

Financial Institutions Insurance Sales Law, 215 ILCS 5/1415(a) (Permits financial institutions that are a registered insurance sales firms to share customer insurance information with affiliates.)

FCRA, 15 USC 1681s-3(a) (Permits sharing consumer information among corporations under common ownership or affiliated by corporate control, provided that “(A) it is clearly and conspicuously disclosed to the consumer that the information may be communicated among such persons for purposes of making such solicitations to the consumer; and (B) the consumer is provided an opportunity” to opt-out.”)

Consumer Compliance Outlook, Affiliate Marketing Rules (Fourth Quarter 2008) (“The opt-out notice must be provided by an affiliate that has or had a pre-existing business relationship with the consumer or as part of a joint notice, where at least one of the affiliates providing the joint notice has or had a pre-existing business relationship with the consumer.”)