Regulation S-P: Initial Privacy Notice and Opt-Out

What Must the Initial Privacy Notice Disclose?

• Regulation S-P requires a firm to provide a clear and conspicuous notice of its privacy policies and practices to a consumer who becomes a customer, no later than when the customer relationship is established.
• The notice must include, among other required items:
  • The categories of nonpublic personal information (NPI) the firm collects
  • The categories of NPI the firm discloses
  • The categories of affiliates and nonaffiliated third parties the firm discloses NPI to
  • The categories of NPI about former customers the firm discloses, and to whom
  • An explanation of the consumer's right to opt out of that disclosure, including how to exercise it
  • The firm's policies and practices for protecting the confidentiality and security of NPI
• A firm that uses the SEC's standardized model privacy form satisfies these content requirements.
• The notice is also owed to a consumer who never becomes a customer. Before a firm discloses that consumer's NPI to a nonaffiliated third party, absent an exception, it must give the initial notice. A short-form notice, stating that the privacy notice is available on request and explaining a reasonable way to get it, satisfies that branch.
• The timing trigger has three exceptions. A firm may deliver the initial notice within a reasonable time after the relationship is established when establishing the relationship was not at the customer's election, when notice at that moment would substantially delay a transaction the customer has agreed to receive later notice on, or when a nonaffiliated broker-dealer or investment adviser establishes the relationship without the firm's prior knowledge.

Exam Tip: Gotchas

• The initial notice is owed no later than when the customer relationship begins, not at the first transaction or the first mailing after that. Timing questions test this trigger point specifically.

• That trigger is a default, not an absolute. Three named situations let the firm deliver the notice within a reasonable time afterward, and an account a court-appointed trustee transfers in is the standard example of the first one.

How Does a Consumer Opt Out of Nonpublic-Information Sharing?

• Before a firm discloses NPI to a nonaffiliated third party, absent an exception, it must give the consumer an opt-out notice and a reasonable opportunity to opt out, such as 30 days from the date the notice was mailed, or 30 days from when an online customer acknowledges receiving the notice.
• A reasonable way to opt out includes:
  • A check-off box on the relevant form
  • A reply form included with the notice
  • An electronic means, such as a web process or an email the consumer can send
  • A toll-free telephone number
• Requiring the consumer to write and mail a personal letter, with no other option offered, is not a reasonable means of opting out.
• A one-off transaction works differently. For an isolated transaction, such as brokerage services provided as an accommodation, the firm gives the notices at the time of the transaction and asks the consumer to decide, as a necessary part of it, before the transaction completes. There is no 30-day window in that case.
• A consumer may exercise the right to opt out at any time, and an opt-out reaches NPI the firm collected before the direction as well as after it.
• Once a consumer opts out, the firm must comply as soon as reasonably practicable after it receives the direction. That is a separate and faster standard than the 30 days the consumer was given to decide.
• Joint accounts. Where two or more consumers hold an account jointly, the firm may send one opt-out notice, and may either treat one joint consumer's direction as binding for all of them or let each opt out separately. It may never require every joint consumer to opt out before honoring one consumer's direction.
• A consumer's opt-out direction stays effective until the consumer revokes it in writing or, if the consumer agrees, electronically. It continues to apply even after the customer relationship ends, though it does not carry over to a new relationship the same individual later opens with the firm.

Exam Tip: Gotchas

• Regulation S-P defaults to opt-out, not opt-in. A customer who never responds to the notice can still have nonpublic personal information disclosed to nonaffiliated third parties, unless the customer affirmatively opts out.

What Should You Check on Exam Day?

• Confirm the initial notice was given no later than when the customer relationship was established.
• Check that the notice covers what NPI is collected and disclosed, to whom, and how to opt out.
• Verify the opt-out window: 30 days from mailing, or 30 days from an online customer's acknowledgment. For an isolated accommodation transaction there is no window at all; the consumer decides before the transaction completes.
• Check how the consumer revoked an opt-out. A revocation must be in writing, or electronic if the consumer agreed to that.
• Watch for a letter-only opt-out method presented as sufficient. It is not a reasonable means, and remember silence is not an opt-out either: the default lets disclosure proceed unless the consumer affirmatively objects.