Federal Financial Privacy Laws: What Each Rule Set Says
Each rule set below is read from its own held source text, and one law's protection is not taken to cover another record. The table does not say which agency enforces a rule, whether a given company is covered, what any state law adds, or whether a quoted edition is the current one.
/* Not legal advice. This page is research, not compliance guidance. */ /* */
What counts as protected financial information, and when must an institution give me a privacy notice?
Regulation P defines financial institution, consumer, customer, nonpublic personal information and publicly available information, and it sets privacy notice rules: required contents, the event and timing of the initial notice, annual notice and its exception, revised notices and delivery.
| Path | Regulation P definitions | Privacy notice rules |
|---|---|---|
| glba-reg-p | Regulation P definitions of financial institution, consumer, customer, nonpublic personal information and publicly available information, with the Safeguards Rule definition of customer informationsource | Regulation P privacy notice rules: required contents, initial-notice event and timing, annual notice and its exception, revised notices, delivery, and the model form sourcesource |
Source: 1 paths. Each source link opens the authority for its cell. The page source record lists the capture date for every cell, and the SHA-256 and snapshot path of the source document for the cells that have them.
Field definitions
- Regulation P definitions
- Regulation P definitions of financial institution, consumer, customer, nonpublic personal information and publicly available information, with the Safeguards Rule definition of customer information.
- Privacy notice rules
- Required contents of the privacy notice, the initial-notice event and its timing, the annual notice and its exception, revised notices, delivery, and the source of the model form.
When can a financial institution share my nonpublic information with other companies?
Regulation P sets conditions on disclosing nonpublic personal information: an opt-out gate, an opt-out notice, revised notices, service-provider, processing and other exceptions, and limits on redisclosure, reuse and account numbers.
| Path | Disclosure conditions |
|---|---|
| glba-reg-p | Regulation P disclosure paths: the opt-out gate, the opt-out notice, revised notices, the service-provider, processing and other exceptions, redisclosure and reuse limits and the account-number limit, with notice, opt-out, consent, exception, reuse, redisclosure, account-number and recipient conditionssource |
Source: 1 paths. Each source link opens the authority for its cell. The page source record lists the capture date for every cell, and the SHA-256 and snapshot path of the source document for the cells that have them.
Field definitions
- Disclosure conditions
- The opt-out gate, the opt-out notice, revised notices, the service-provider, processing and other exceptions, and the redisclosure, reuse and account-number limits, with the notice, opt-out, consent, exception, reuse, redisclosure, account-number and recipient conditions.
What must a financial institution do to protect customer information, and when must it notify of a security event?
The Safeguards Rule sets coverage, program elements and service-provider duties for protecting customer information, and it sets a notification event with its trigger, fields, timing and channel.
| Path | Safeguards Rule requirements |
|---|---|
| ftc-safeguards | Safeguards Rule: coverage, program elements, service-provider duties and the notification event (trigger, fields, timing and channel)source |
Source: 1 paths. Each source link opens the authority for its cell. The page source record lists the capture date for every cell, and the SHA-256 and snapshot path of the source document for the cells that have them.
Field definitions
- Safeguards Rule requirements
- Coverage, program elements, service-provider duties and the notification event, with its trigger, fields, timing and channel.
This table holds the Safeguards Rule as its own rule set, apart from Regulation P. The one link it states between them is that the Regulation P definitions cell also carries the Safeguards Rule definition of customer information.
When can a federal agency get my bank records?
The Right to Financial Privacy Act defines financial institution, financial record, Government authority, customer and person, and sets the access procedures by which a Government authority may reach a customer's financial records: customer authorization, administrative subpoena or summons, search warrant, judicial subpoena and formal written request, with named exceptions.
| Path | Definitions | Access procedures | Exceptions |
|---|---|---|---|
| rfpa | Right to Financial Privacy Act definitions of financial institution, financial record, Government authority, customer and person, quoted from 12 U.S.C. 3401source | Each Right to Financial Privacy Act access procedure of 12 U.S.C. 3402 (customer authorization, administrative subpoena or summons, search warrant, judicial subpoena, formal written request) with process document, issuer, relevance standard, certification, customer notice, challenge path and delaysource | Each Right to Financial Privacy Act exception named in 12 U.S.C. 3402 (3403(c) and (d), every paragraph of 3413, and 3414) with requester, purpose, record scope, certification, transfer limit and notice effect, quotedsource |
Source: 1 paths. Each source link opens the authority for its cell. The page source record lists the capture date for every cell, and the SHA-256 and snapshot path of the source document for the cells that have them.
Field definitions
- Definitions
- Definitions of financial institution, financial record, Government authority, customer and person, quoted from the statute.
- Access procedures
- Each access procedure for a Government authority: customer authorization, administrative subpoena or summons, search warrant, judicial subpoena and formal written request, with process document, issuer, relevance standard, certification, customer notice, challenge path and delay.
- Exceptions
- Each named exception to the access procedures, with requester, purpose, record scope, certification, transfer limit and notice effect, quoted.
Two of the exception elements appear as the kept source text has them, including its page-break splits. This page does not requote or repair them.
What can I do if an agency or institution breaks the financial privacy rules for my records?
The Right to Financial Privacy Act provides a civil remedy, injunctive relief, an enforcement forum and a good-faith defense, together with a record of disclosures and an agency transfer record; the table gives each from the held cell.
| Path | Records and remedies |
|---|---|
| rfpa | Right to Financial Privacy Act record of disclosures, agency transfer record, cost reimbursement, civil remedy, injunctive relief, enforcement forum, good-faith defense and the edition of the kept textsource |
Source: 1 paths. Each source link opens the authority for its cell. The page source record lists the capture date for every cell, and the SHA-256 and snapshot path of the source document for the cells that have them.
Field definitions
- Records and remedies
- Record of disclosures, agency transfer record, cost reimbursement, civil remedy, injunctive relief, enforcement forum, good-faith defense and the edition of the kept text.
Are my tax returns confidential, and who else can see them?
The Internal Revenue Code sets a confidentiality rule for returns and return information and defines return, return information, taxpayer return information, taxpayer identity, inspection and disclosure; the table then lists the captioned disclosure paths by requester, purpose, authorization, notice, redisclosure limit and records kept.
| Path | Confidentiality rule and definitions | Disclosure paths |
|---|---|---|
| irc-6103 | Text of 26 U.S.C. 6103(a) and (b): the confidentiality rule and the definitions of return, return information, taxpayer return information, taxpayer identity, inspection and disclosuresource | Each captioned disclosure path of 26 U.S.C. 6103(c) to (o): requester, purpose, authorization, notice, redisclosure limit and records kept as that paragraph states them; the recordkeeping and safeguard paragraphs of (p) beside themsource |
Source: 1 paths. Each source link opens the authority for its cell. The page source record lists the capture date for every cell, and the SHA-256 and snapshot path of the source document for the cells that have them.
Field definitions
- Confidentiality rule and definitions
- The confidentiality rule and the definitions of return, return information, taxpayer return information, taxpayer identity, inspection and disclosure.
- Disclosure paths
- Each captioned disclosure path: requester, purpose, authorization, notice, redisclosure limit and records kept as that paragraph states them, with the recordkeeping and safeguard paragraphs beside them.
The disclosure paths cell does not carry the closed-executive-session condition of the committee-access paragraphs, or the same-conditions and tax-administration clause of one later paragraph. This page does not describe the disclosure paths as unconditional or complete.
Who can get the personal information in my motor vehicle record?
The Driver's Privacy Protection Act defines personal information and highly restricted personal information, and it lists each permitted use by requester, purpose, covered fields, consent condition and onward-disclosure rule, with resale, redisclosure and record-keeping duties set out beside them.
| Path | Definitions | Permitted uses | Resale and record-keeping |
|---|---|---|---|
| dppa | DPPA definitions of personal information and highly restricted personal information, quoted from 18 U.S.C. 2725(3) and (4)source | Each permitted use of 18 U.S.C. 2721(b): the introductory clause and every paragraph of the use list, with requester, purpose, covered fields, consent condition and onward-disclosure rule, beside the general conditions of subsection (a), (d) and (e)source | Resale and redisclosure limits and the record-keeping duty of 18 U.S.C. 2721(c): who keeps records, their content, retention and inspectionsource |
Source: 1 paths. Each source link opens the authority for its cell. The page source record lists the capture date for every cell, and the SHA-256 and snapshot path of the source document for the cells that have them.
Field definitions
- Definitions
- Definitions of personal information and highly restricted personal information.
- Permitted uses
- Each permitted use: the introductory clause and every paragraph of the use list, with requester, purpose, covered fields, consent condition and onward-disclosure rule, beside the general conditions.
- Resale and record-keeping
- Resale and redisclosure limits and the record-keeping duty: who keeps records, their content, retention and inspection.
This table holds the federal rule text only. State motor vehicle record rules are not in it.
If you are worried about your safety or about who can find your address, confidential help is available. National Domestic Violence Hotline: call 1-800-799-7233 or text START to 88788 (thehotline.org). Safety Net Project, National Network to End Domestic Violence: techsafety.org, including its page on state address confidentiality programs (techsafety.org/address-confidentiality-programs). U.S. Department of Justice Office on Violence Against Women, resources for victims and survivors: justice.gov/ovw/resources-victims-and-survivors. If you are in immediate danger, call 911.
What are the penalties if someone misuses motor vehicle record information?
The Driver's Privacy Protection Act provides a civil action with relief, a governmental civil penalty and a criminal fine; the table gives each with its pinpoint.
Source: 1 paths. Each source link opens the authority for its cell. The page source record lists the capture date for every cell, and the SHA-256 and snapshot path of the source document for the cells that have them.
Field definitions
- Civil action and penalties
- The civil action and relief, the governmental civil penalty and the criminal fine, with pinpoints.
Does my company have to file a beneficial ownership report, and what are the penalties?
The table gives the beneficial ownership information report rule, with its reporting-company and individual fields, accepted identification, initial, update and correction timing and prescribed form and manner, beside the federal provisions on reporting violations and on unauthorized disclosure or use of BOI.
| Path | BOI report contents | Violation provisions |
|---|---|---|
| boi-report | BOI report: reporting-company and individual fields, accepted identification, initial, update and correction timing, and the form and manner FinCEN prescribes, quoted from 31 CFR 1010.380 as amended by the final rulesource | Federal provisions on reporting violations and on unauthorized disclosure or use of BOI: the statute's penalty paragraph and the two implementing regulation paragraphs, quotedsource |
Source: 1 paths. Each source link opens the authority for its cell. The page source record lists the capture date for every cell, and the SHA-256 and snapshot path of the source document for the cells that have them.
Field definitions
- BOI report contents
- Reporting-company and individual fields, accepted identification, initial, update and correction timing, and the form and manner FinCEN prescribes, quoted from the rule.
- Violation provisions
- Federal provisions on reporting violations and on unauthorized disclosure or use of BOI: the statute's penalty paragraph and the implementing regulation paragraphs, quoted.
This table is the rule text. It does not say which companies must report or whether the rule is being enforced now. The rule history and court orders are on BOI rules, orders and deadlines since the Corporate Transparency Act.
How does a bank verify a business customer, and who behind the company does it look at?
The bank customer identification rule lists the documents that show a legal entity's existence and reaches individuals with authority or control over the account; the table adds the risk-based verification procedures, the beneficial owner definition with its ownership and control prongs, and the ongoing customer due diligence paragraph.
| Path | Existence evidence and scope | Risk-based verification | Ownership and control roles | Ongoing due diligence |
|---|---|---|---|---|
| cip-cdd-entity | Documents the bank customer identification rule lists as showing a legal entity's existence, and the provisions that reach individuals with authority or control over the account, quoted from 31 CFR 1020.220source | Risk-based identity verification procedures, the document and non-documentary method provisions and the address forms of the bank customer identification rule, quoted from 31 CFR 1020.220source | Beneficial owner as defined for legal entity customers (ownership prong and control prong, with the officer titles listed), the trust rule and the individual who opens the account, quoted from 31 CFR 1010.230source | Ongoing customer due diligence paragraph of the bank anti-money laundering program rule (customer information updated on a risk basis, including beneficial owners of legal entity customers), quoted from 31 CFR 1020.210source |
Source: 1 paths. Each source link opens the authority for its cell. The page source record lists the capture date for every cell, and the SHA-256 and snapshot path of the source document for the cells that have them.
Field definitions
- Existence evidence and scope
- Documents the bank customer identification rule lists as showing a legal entity's existence, and the provisions that reach individuals with authority or control over the account.
- Risk-based verification
- Risk-based identity verification procedures, the document and non-documentary method provisions and the address forms of the bank customer identification rule.
- Ownership and control roles
- Beneficial owner as defined for legal entity customers, with its ownership prong, its control prong and the officer titles listed, the trust rule and the individual who opens the account.
- Ongoing due diligence
- The ongoing customer due diligence paragraph of the bank anti-money laundering program rule: customer information updated on a risk basis, including beneficial owners of legal entity customers.
The ownership and control roles cell marks the authorized-signer and registered-agent roles as not stated. This page does not say whether or how the due diligence rule treats either role.
Who is the responsible party on an EIN application, and how is it updated?
The table gives the EIN application's line labels, the responsible-party definition, the nominee restriction, the third-party designee authorization and the update path, quoted from IRS instructions and the IRS responsible-party page.
| Path | EIN responsible party |
|---|---|
| ein-responsible-party | EIN application line labels, the responsible-party definition, the nominee restriction, the third-party designee authorization and the Form 8822-B update path, quoted from IRS instructions and the IRS responsible-party pagesource |
Source: 1 paths. Each source link opens the authority for its cell. The page source record lists the capture date for every cell, and the SHA-256 and snapshot path of the source document for the cells that have them.
Field definitions
- EIN responsible party
- EIN application line labels, the responsible-party definition, the nominee restriction, the third-party designee authorization and the update path.
How does federal law tell an insured deposit from other financial products?
The federal rule defines deposit, insured deposit, non-deposit product, hybrid product and uninsured financial product, prohibits implying that an uninsured product is insured, and sets a non-deposit signage provision.
| Path | Deposit and product labels |
|---|---|
| deposit-products | Deposit, insured deposit, non-deposit product, hybrid product and uninsured financial product definitions, with the prohibition on implying that an uninsured product is insured and the non-deposit signage provision, quoted from 12 CFR part 328source |
Source: 1 paths. Each source link opens the authority for its cell. The page source record lists the capture date for every cell, and the SHA-256 and snapshot path of the source document for the cells that have them.
Field definitions
- Deposit and product labels
- Deposit, insured deposit, non-deposit product, hybrid product and uninsured financial product definitions, with the prohibition on implying that an uninsured product is insured and the non-deposit signage provision.
The held rule text defines deposit and insured deposit only by reference to the Federal Deposit Insurance Act, whose text is not in the kept source. This page does not state the statutory definition of an insured deposit.
How to read Unknown
- Unknown: Verified absence
- The captured authority was searched and shows no such rule or filing. No value is printed because the absence is the finding. The reason and the authority are printed beside the badge.
- Unknown: Not yet verified
- The captured sources did not settle this field yet. No value is printed, not even an earlier one. The reason is printed beside the badge, and an authority is linked only when one was supplied.