| name | glba-privacy-notice |
| title | GLBA Privacy Notice |
| description | Drafts GLBA-compliant privacy notices using the 16 CFR Part 313 Appendix A model form safe harbor. Use when creating or updating Regulation P privacy notices, annual consumer disclosures, or NPI sharing notices for banks, credit unions, securities firms, insurers, or other covered entities under 15 U.S.C. §§ 6801–6809. |
| author | CaseMark |
| author_url | https://github.com/CaseMark/skills/tree/main/skills/legal/glba-privacy-notice |
| license | Apache-2.0 |
| version | 0.1.0 |
| execution_mode | open |
| jurisdiction | us |
| practice | finance |
| language | en |
| tags | ["drafting","letter","regulatory"] |
GLBA Privacy Notice
Produces a 16 CFR Part 313-compliant consumer privacy notice using the Appendix A model form safe harbor, covering mandatory disclosures, sharing categories, opt-out rights, and security safeguards.
Gather Before Drafting
- Institution legal name, DBAs, charter type, federal regulator
- Affiliate structure and types (banking, insurance, securities, lending)
- NPI categories collected and their sources
- All sharing arrangements: affiliate, nonaffiliate, joint marketing, service providers
- Opt-out channels: toll-free number, URL, mailing address, processing timeline
- Security program: physical, electronic, procedural safeguards
- Operating jurisdictions (for state-law overlays)
Notice Structure
1. FACTS Table Header
Required model form opening:
| Field | Content |
|---|
| Why? | One-sentence explanation of why notice is provided |
| What? | Categories of NPI collected (summary) |
| How? | Whether and how consumers can limit sharing |
Include verbatim or substantially similar opening: "Federal law requires us to tell you how we collect, share, and protect your personal information. Federal law also gives you the right to limit some but not all sharing."
Include institution legal name, effective date, recognizable DBAs.
2. Information Collection Disclosure
Group NPI by source:
| Source | Examples |
|---|
| Consumer-provided | SSN, income, assets, contact info, account preferences |
| Account-generated | Balances, payment history, transactions, card activity |
| Consumer reporting agencies | Credit reports/scores |
| Other third parties | Identity verification, fraud databases, public records |
3. Sharing Matrix and Opt-Out Rights
| Sharing Purpose | Limitable? | Authority |
|---|
| Everyday business (transactions, compliance, fraud) | No | §§ 313.14–.15 exceptions |
| Affiliates — transaction/experience info | No | Permitted sharing |
|
