Quick Answer
Regulation S-P governs nonpublic personal information, privacy notices, third-party disclosure, opt-out rights, safeguards, and secure disposal. Nonpublic personal information includes personally identifiable financial information that is not publicly available, even in some public groupings. Customers get an opt-out choice before most disclosures to nonaffiliated third parties, and firms must safeguard customer records and dispose of information securely.
How Does Regulation S-P Control Information Sharing?
Regulation S-P addresses privacy of customer financial information and the safeguarding of personal information. Nonpublic personal information (NPI) includes personally identifiable financial information that is not publicly available. It also includes consumer lists, descriptions, or groupings derived using such information, even when the grouping contains publicly available information. Publicly available information can also be NPI when its disclosure indicates that an individual is or was the firm's consumer.
The regulation requires a firm to:
- Provide customers with notice of its privacy policies and practices.
- Establish conditions before disclosing NPI to nonaffiliated third parties.
- Give customers an opportunity to opt out of most such disclosures, subject to exceptions.
- Protect customer records and information from unauthorized access or use.
- Use reasonable measures and written procedures to protect information during disposal.
Privacy notices, disclosure conditions, opt-out rights, and safeguards are separate duties.
Think of it this way: A privacy notice explains the firm's information path, while the safeguards control who can get onto that path.
What Must the Customer Privacy Disclosure Explain?
Privacy disclosures explain the firm's:
- Privacy policies and practices
- Information-sharing practices
- Controls applicable when information is shared outside the firm
Outside-firm sharing does not end the firm's responsibility for privacy controls or applicable disclosure conditions.
| Situation | Core privacy result |
|---|---|
| Nonpublic personally identifiable financial information or a consumer grouping derived from it | It is NPI and is subject to Regulation S-P treatment |
| NPI is disclosed to a nonaffiliated third party and no exception applies | Customer generally has an opportunity to opt out |
| Information is shared outside the firm | Privacy controls and disclosure conditions still apply |
Exam Tip: Gotchas
- The usual choice is opt out. For most disclosures of NPI to nonaffiliated third parties, the customer receives this choice when no exception applies.
- Regulation S-P requires more than a disclosure form. It also requires safeguards against unauthorized access or use.
What Should You Check on Exam Day?
- Identify NPI, the recipient, and whether a disclosure exception applies.
- Use opt out, not opt in, for most nonaffiliated-third-party disclosure when no exception applies.
- Apply written safeguards and secure disposal procedures.