IBA Compliance Connection

Your go to source for compliance!

We are merging with another institution which is owned by our bank holding company and are changing our bank name. We need to update our privacy notice to change our bank’s name, but we will not be making any other changes. Do we need to send a revised privacy notice when the only change is the bank’s name?

—

by

admin

No, we do not believe your bank is required to send a revised privacy notice to customers when the only change to the notice is the bank’s name.

Regulation P requires banks to provide a revised privacy notice before disclosing any nonpublic personal information about a consumer other than as described in its current privacy notice. Additionally, Regulation P requires banks to provide a revised privacy notice before disclosing to any nonaffiliated third party: (1) a new category of nonpublic personal information, (2) nonpublic personal information to a new category of nonaffiliated third party (that was not adequately described in the current privacy notice); or (3) nonpublic personal information about a former customer to a nonaffiliated third party, if that former customer has not had the opportunity to exercise an opt out right regarding that disclosure. Here, your bank is not changing how it discloses nonpublic personal information, and consequently we do not believe that a revised privacy notice is required.

Also, if your bank is acquiring any customers as part of the merger process (which is not necessarily the case), you should provide your privacy notice to those new customers within a reasonable time.

For resources related to our guidance, please see:

  • Regulation P, 12 CFR 1016.8(a) (“Except as otherwise authorized in this part, you must not, directly or through any affiliate, disclose any nonpublic personal information about a consumer to a nonaffiliated third party other than as described in the initial notice that you provided to that consumer under § 1016.4 of this part, unless:

(1) You have provided to the consumer a clear and conspicuous revised notice that accurately describes your policies and practices;

(2) You have provided to the consumer a new opt out notice;

(3) You have given the consumer a reasonable opportunity, before you disclose the information to the nonaffiliated third party, to opt out of the disclosure; and

(4) The consumer does not opt out.”)

  • Regulation P, 12 CFR 1016.8(b) (“(1) Except as otherwise permitted by §§ 1016.13, 1016.14, and 1016.15 of this part, you must provide a revised notice before you:
  • (i)  Disclose a new category of nonpublic personal information to any nonaffiliated third party;
     
  • (ii) Disclose nonpublic personal information to a new category of nonaffiliated third party; or
     
  • (iii) Disclose nonpublic personal information about a former customer to a nonaffiliated third party, if that former customer has not had the opportunity to exercise an opt out right regarding that disclosure.

(2) A revised notice is not required if you disclose nonpublic personal information to a new nonaffiliated third party that you adequately described in your prior notice.”)

  • Regulation P, 12 CFR 1016.3(e) (“Exceptions to allow subsequent delivery of notice. (1) You may provide the initial notice required by paragraph (a)(1) of this section within a reasonable time after you establish a customer relationship if: (i) Establishing the customer relationship is not at the customer’s election; . . .”)