Gramm-Leach-Bliley Act, obligations with respect to disclosures of personal information (15 U.S.C. 6802(a), (b)(1), (c))
A bank, lender, insurer or other financial institution may not hand customers' nonpublic personal information to an outside company, such as an AI developer buying training data, unless it has given its privacy notice and each customer has had the chance to opt out first. The buyer is bound in turn: it may pass the data on only where the institution itself could lawfully have disclosed it directly.
Dated 17 Oct 2026Source checked 17 Oct 2026Basis: primary text
In the source's own words
“(a) Notice requirements Except as otherwise provided in this subchapter, a financial institution may not, directly or through any affiliate, disclose to a nonaffiliated third party any nonpublic personal information, unless such financial institution provides or has provided to the consumer a notice that complies with section 6803 of this title. (b) Opt out ... A financial institution may not disclose nonpublic personal information to a nonaffiliated third party unless ... the consumer is given the opportunity, before the time that such information is initially disclosed, to direct that such information not be disclosed to such third party; and ... (c) Limits on reuse of information Except as otherwise provided in this subchapter, a nonaffiliated third party that receives from a financial institution nonpublic personal information under this section shall not, directly or through an affiliate of such receiving third party, disclose such information to any other person that is a nonaffiliated third party of both the financial institution and such receiving third party, unless such disclosure would be lawful if made directly to such other person by the financial institution.”
Where it was read
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in this guide