Privacy Notices - Regulation IH-2001-01 - Use of Federal Model Privacy Form

Vermont Department of Financial Regulation Insurance Division INSURANCE BULLETIN #188 Privacy Notices – Regulation IH-2001-01 Use of Federal Model Privacy Form The purpose of this bulletin is to set forth the views of the Vermont Department of Financial Regulation regarding use of the Federal Model Privacy Form for compliance with the privacy notice requirements in Department Regulation IH-2001-01, Privacy of Consumer Financial and Health Information Regulation (“Vermont Privacy Regulation”). The Financial Services Regulatory Relief Act of 2006 directed eight federal agencies1 to adopt a simplified Federal Model Privacy Form. The new Federal Model Privacy Form was developed to increase consumers’ understanding and ability to make informed decisions regarding the sharing of personal information, as required by the Gramm Leach Bliley Act (“GLBA”). Federally regulated financial institutions that use the new Federal Model Privacy Form may rely on it as a safe harbor to provide the notices required under the GLBA privacy rules. This Bulletin describes how Licensees, as defined in the Vermont Privacy Regulation, may use the new Federal Model Privacy Form to meet the notice and content requirements of the Vermont Privacy Regulation. Use of the Federal Model Privacy Form A Licensee’s use of the Federal Model Privacy Form set forth in Attachment A, consistent with the Instructions set forth in Attachments B and C as modified by this Bulletin, constitutes compliance with the notice content requirements of Sections 7 and 8 of the Vermont Privacy Regulation Licensees may rely on the Federal Model Privacy Form, consistent with this Bulletin and the attached Instructions, as a safe harbor for compliance with the privacy notice content requirements of the Vermont Privacy Regulation. Licensees are reminded that Vermont statutes and regulations relating to consumer privacy contain content requirements with significant differences from many other states. Significantly, Vermont is an “opt-in” state rather than an “opt-out” state. As more specifically set forth in the Vermont Privacy Regulation, a Licensee may not share nonpublic personal information without the consumer’s consent, other than as permitted by Vermont law.                                                             1 Office of the Comptroller of the Currency; Treasury (OCC); Board of Governors of the Federal Reserve System (Board); Federal Deposit Insurance Corporation (FDIC); Office of Thrift Supervision, Treasury (OTS); National Credit Union Administration (NCUA); Federal Trade Commission (FTC); Commodity Futures Trading Commission (CFTC); and Securities and Exchange Commission (SEC).     Both the Federal Model Privacy Form and the Instructions were designed for use by “optout” states. To maintain consistency with other states, the Instructions set forth in Attachments B and C include the Instructions for “opt-out” states. This Bulletin and the notes in Attachments B and C describe how to use the Federal Model Privacy Forms and Instructions, otherwise designed for “opt-out” states, in a manner consistent with Vermont’s “opt-in” requirements. Vermont laws and the Vermont Privacy Regulation require that Licensees obtain “opt-in” consent from a consumer prior to sharing nonpublic personal information with an affiliate or with a nonaffiliated third party, except as otherwise specifically permitted by Vermont laws and regulations. A Licensee may use the Federal Model Privacy Form to comply with the Vermont Privacy Regulation in either of the following ways: Option 1. A Licensee may provide a generalized notice to its Vermont consumers that answers “no” to each of the questions about whether it shares information: (i) “For our affiliates’ everyday business purposes – information about your creditworthiness;” and (ii) “for nonaffiliates to market to you;” OR Option 2. A Licensee can provide a generalized notice to consumers across a number of states, including Vermont, and answer “yes” to the questions in Option 1 above, provided it includes a discussion on the application of Vermont law in the “Other Important Information” box on page 2 of the Federal Model Privacy Form and complies with the requirements below. A Licensee that chooses to use the Federal Model Privacy Form as provided in Option 2 above shall provide the following information: (a) The “Other Important Information” box on the Federal Model Privacy Form contains statements that convey the following information: Other Important Information For Vermont Members/Customers. We will not disclose information about your creditworthiness to our affiliates and will not disclose your personal information, financial information, credit report, or health information to nonaffiliated third parties to market to you, other than as permitted by Vermont law, unless you authorize us to make those disclosures. Additional information concerning our privacy policies can be found at [website link] or call [telephone number]. AND (b) The additional information provided on the Licensee’s website contains the information required by the Vermont Privacy Regulation; to the extent such information is not already included in the Licensee’s privacy notice.   Use of Other Types of Privacy Notices Use of the attached Federal Model Privacy Form is not required. Licensees may continue to use other types of privacy notices to meet the requirements of Sections 7 and 8 of the Vermont Privacy Regulation so long as the notices accurately describe the Licensee’s privacy practices and otherwise meet the requirements of Sections 7 and 8 of the Vermont Privacy Regulation. Dated this __19th___ day of January 2016 ___________________________________ Susan L. Donegan, Commissioner Vermont Department of Financial Regulation     Attachment A - Model Privacy Form       There are four versions of the Model Privacy Form.   • Version 1: Model Form with No Opt-Out.   • Version 2: Model Form with Opt-out by Telephone and/or Online.   • Version 3: Model with Mail In Opt-Out Form.   • Version 4: Optional Mail-in Form.     Version 1: Model Form with No Opt-Out         FACTS     WHAT DOES [Name of Licensee] DO WITH YOUR PERSONAL INFORMATION?   Rev. [insert date]   Why? Financial companies choose how they share your personal information. Federal law gives consumers the right to limit some but not all sharing. Federal law also requires us to tell you how we collect, share, and protect your personal information. Please read this notice carefully to understand what we do. What? The types of personal information we collect and share depend on the product or service you have with us. This information can include: ■ Social Security number and ■ and ■ and   When you are no longer our customer, we continue to share your information as described in this notice. How? All financial companies need to share customers’ personal information to run their everyday business. In the section below, we list the reasons financial companies can share their customers’ personal information; the reasons [name of Licensee] chooses to share; and whether you can limit this sharing.     Reasons we can share your personal information Does [name of Licensee] share?   Can you limit this sharing? For our everyday business purposes— such as to process your transactions, maintain your account(s), respond to court orders and legal investigations, or report to credit bureaus       For our marketing purposes— to offer our products and services to you     For joint marketing with other financial companies     For our affiliates’ everyday business purposes— information about your transactions and experiences     For our affiliates’ everyday business purposes— information about your creditworthiness     For our affiliates to market to you     For nonaffiliates to market to you       Questions? Call [telephone number] or go to [website]            Page 2          Who we are   Who is providing this notice?        [Insert name of Licensee(s)]   What we do How does [name of Licensee] protect my personal information? To protect your personal information from unauthorized access and use, we use security measures that comply with federal law. These measures include computer safeguards and secured files and buildings. [insert] How does [name of Licensee] collect my personal information?   We collect your personal information, for example, when you    or  or  or [We also collect your personal information from other companies] OR [We also collect your personal information from others, such as credit bureaus, affiliates, or other companies.] Why can’t I limit all sharing?   Federal law gives you the right to limit only    sharing for affiliates’ everyday business purposes—information about your creditworthiness  affiliates from using your information to market to you  sharing for nonaffiliates to market to you   State laws and individual companies may give you additional rights to limit sharing. [See below for more on your rights under state law.]   Definitions Affiliates Companies related by common ownership or control. They can be financial and nonfinancial companies.   [affiliate information] Nonaffiliates Companies not related by common ownership or control. They can be financial and nonfinancial companies.   [nonaffiliate information] Joint marketing A formal agreement between nonaffiliated financial companies that together market financial products or services to you.   [joint marketing information] Other important information [Insert other important information]    Version 2: Model Forms with Opt-out by Telephone and/or Online   FACTS  WHAT DOES [Name of Licensee] Rev. [insert date]  DO WITH DO WITH YOUR PERSONAL INFORMATION?   Why? Financial companies choose how they share your personal information. Federal law gives consumers the right to limit some but not all sharing. Federal law also requires us to tell you how we collect, share, and protect your personal information. Please read this notice carefully to understand what we do. What? The types of personal information we collect and share depend on the product or service you have with us. This information can include: Social Security number and and and How? All financial companies need to share customers’ personal information to run their everyday business. In the section below, we list the reasons financial companies can share their customers’ personal information; the reasons [name of Licensee] chooses to share; and whether you can limit this sharing.     Reasons we can share your personal information Does [name of Licensee] share?   Can you limit this sharing? For our everyday business purposes— such as to process your transactions, maintain your account(s), respond to court orders and legal investigations, or report to credit bureaus     For our marketing purposes— to offer our products and services to you     For joint marketing with other financial companies     For our affiliates’ everyday business purposes— information about your transactions and experiences     For our affiliates’ everyday business purposes— information about your creditworthiness     For our affiliates to market to you     For nonaffiliates to market to you       To limit our sharing Call [telephone number]—our menu will prompt you through your choice(s) or Visit us online: [website]   Please note:   If you are a new customer, we can begin sharing your information [30] days from the date we sent this notice. When you are no longer our customer, we continue to share your information as described in this notice.   However, you can contact us at any time to limit our sharing.   Questions?   Call [telephone number] or go to [website]   Page 2       Who we are   Who is providing this notice?      [Insert name of Licensee(s)]  What we do How does [name of Licensee] protect my personal information? To protect your personal information from unauthorized access and use, we use security measures that comply with federal law. These measures include computer safeguards and secured files and buildings. [insert] How does [name of Licensee] collect my personal information? We collect your personal information, for example, when you or or or [We also collect your personal information from other companies.] OR [We also collect your personal information from others, such as credit bureaus, affiliates, or other companies.] Why can’t I limit all sharing? Federal law gives you the right to limit only    sharing for affiliates’ everyday business purposes—information about your creditworthiness  affiliates from using your information to market to you  sharing for nonaffiliates to market to you   State laws and individual companies may give you additional rights to limit sharing. [See below for more on your rights under state law.] What happens when I limit sharing for an account I hold jointly with someone else? [Your choices will apply to everyone on your account.] OR [Your choices will apply to everyone on your account – unless you tell us otherwise.] Definitions Affiliates Companies related by common ownership or control. They can be financial and nonfinancial companies.    [affiliate information] Nonaffiliates Companies not related by common ownership or control. They can be financial and nonfinancial companies.   [nonaffiliate information] Joint marketing A formal agreement between nonaffiliated financial companies that together market financial products or services to you.   [joint marketing information] Other important information [Insert other important information]   Version 3: Model Form with Mail In Opt-Out Form         FACTS     WHAT DOES [Name of Licensee] DO WITH YOUR PERSONAL INFORMATION? Rev. [insert date] Why? Financial companies choose how they share your personal information. Federal law gives consumers the right to limit some but not all sharing. Federal law also requires us to tell you how we collect, share, and protect your personal information. Please read this notice carefully to understand what we do. What? The types of personal information we collect and share depend on the product or service you have with us. This information can include: Social Security number and and and How? All financial companies need to share customers’ personal information to run their everyday business. In the section below, we list the reasons financial companies can share their customers’ personal information; the reasons [name of Licensee] chooses to share; and whether you can limit this sharing.     Reasons we can share your personal information Does [name of Licensee] share?   Can you limit this sharing? For our everyday business purposes— such as to process your transactions, maintain your account(s), respond to court orders and legal investigations, or report to credit bureaus     For our marketing purposes— to offer our products and services to you     For joint marketing with other financial companies     For our affiliates’ everyday business purposes— information about your transactions and experiences     For our affiliates’ everyday business purposes— information about your creditworthiness     For our affiliates to market to you     For nonaffiliates to market to you       To limit our sharing Call [telephone number] —our menu will prompt you through your choice(s) Visit us online: [website] or Mail the form below   Please note:   If you are a new customer, we can begin sharing your information [30] days from the date we sent this notice. When you are no longer our customer, we continue to share your information as described in this notice.   However, you can contact us at any time to limit our sharing.   Questions?   Call [telephone number] or go to [website]   Mail-in Form Leave Blank OR [If you have a joint account, your choice(s) will apply to everyone on your account unless you mark below. □ Apply my choices only to me.] Mark any/all you want to limit: □ Do not share information about my creditworthiness with your affiliates for their everyday purposes. □ Do not allow your affiliates to use my personal information to market to me. □ Do not share my personal information with nonaffiliates to market their products and services to me. Name   Address     City, State, Zip   [Account #]    Mail To:     [Name of Licensee, address, city, state, zip code]   Page 2  P Who we are   Who is providing this notice? [Insert name of Licensee(s)]   What we do How does [name of Licensee] protect my personal information? To protect your personal information from unauthorized access and use, we use security measures that comply with federal law. These measures include computer safeguards and secured files and buildings. [insert] How does [name of Licensee] collect my personal information?   We collect your personal information, for example, when you or or or [We also collect your personal information from other companies.] OR [ We also collect your personal information from others, such as credit bureaus, affiliates, or other companies.] Why can’t I limit all sharing?   Federal law gives you the right to limit only - sharing for affiliates’ everyday business purposes—information about your creditworthiness - affiliates from using your information to market to you - sharing for nonaffiliates to market to you   State laws and individual companies may give you additional rights to limit sharing. [See below for more on your rights under state law.] What happens when I limit sharing for an account I hold jointly with someone else? [Your choices will apply to everyone on your account.] OR [Your choices will apply to everyone on your account – unless you tell us otherwise.]   Definitions Affiliates Companies related by common ownership or control. They can be financial and nonfinancial companies.  [affiliate information] Nonaffiliates Companies not related by common ownership or control. They can be financial and nonfinancial companies. [nonaffiliate information] Joint marketing A formal agreement between nonaffiliated financial companies that together market financial products or services to you. [joint marketing information]   Other important information [Insert other important information]    Version 4: Optional Mail-in Form         Mail-in Form Leave Blank OR [If you have a joint account, your choice(s) will apply to everyone on your account unless you mark below. □ Apply my choices only to me.] Mark any/all you want to limit: □ Do not share information about my creditworthiness with your affiliates for their everyday purposes. □ Do not allow your affiliates to use my personal information to market to me. □ Do not share my personal information with nonaffiliates to market their products and services to me. Name   Address     City, State, Zip   [Account #]    Mail To:     [Name of Licensee, address, city, state, zip code]               Attachment B - General Instructions   1. How the Federal Model Privacy Form is used.     (a)  The Federal Model Privacy Form (“Model Form”) may be used, at the option of a Licensee, including a group of Licensees or financial institutions that use a common privacy notice, to meet the content requirements set forth in Sections 7 and 8 of the Vermont Privacy Regulation. (b) The Model Form is a standardized form, including page layout, content, format, style, pagination, and shading. Licensees seeking to obtain a safe harbor through use of the Model Form may modify it only as described in these instructions. (c) Note that disclosure of certain information, such as assets, income, and information from a consumer reporting agency, may give rise to obligations under the Fair Credit Reporting Act [15 U.S.C. §§1681 – 1681x] (“FCRA”), such as a requirement to permit a consumer to opt out of disclosures to affiliates or designation as a consumer reporting agency if disclosures are made to nonaffiliated third parties. [For Vermont consumers – the Vermont Fair Credit Reporting Act [9 V.S.A. §§2480a – 2480n] (“VCRA”) imposes additional requirements. A Licensee may not share a Vermont consumer’s credit report without the Vermont consumer’s consent. 9 V.S.A. §2480e.] (d) The word “customer” may be replaced by the word “member” whenever it appears in the Model Form, as appropriate.   2. The contents of the Federal Model Privacy Form.   The Model Form consists of two pages, which may be printed on both sides of a single sheet of paper, or may appear on two separate pages. Where a Licensee provides a long list of Licensees or financial institutions at the end of the Model Form in accordance with the Instructions in Attachment C section 3(a)(1), or provides additional information in accordance with the Instructions in Attachment C section 3(c), and such list or additional information exceeds the space available on page two of the Model Form, such list or additional information may extend to a third page. (a) Page One. The first page consists of the following components: (1) Date last revised (upper right-hand corner) (2) Title (3) Key frame (Why?, What?, How?) (4) Disclosure table (“Reasons we can share your personal information”) (5) “To limit our sharing” box, as needed, for licensee’s opt-out information   (6) “Questions” box, for customer service contact information (7) Mail-in opt-out form, as needed [For Vermont customers, the Licensee may include a mail-in opt-in form, as needed] (b) Page Two. The second page consists of the following components: (1) Heading (Page 2) (2) Frequently Asked Questions (“Who we are” and “What we do”) (3) Definitions (4) “Other important information” box, as needed [For Licensees providing notices to Vermont consumers, see additional information about the “other important information” box in the body of this Bulletin #188.] 3. The format of the Federal Model Privacy Form.   The format of the Model Form may be modified only as described below. (a) Easily readable type font. Licensees that use the Model Form must use an easily readable type font. While a number of factors together produce easily readable type font, Licensees are required to use a minimum of 10-point font (unless otherwise expressly permitted in these Instructions) and sufficient spacing between the lines of type. (b) Logo. A Licensee may include a corporate logo on any page of the notice, so long as it does not interfere with the readability of the Model Form or the space constraints of each page. (c) Page size and orientation. Each page of the Model Form must be printed on paper in portrait orientation, the size of which must be sufficient to meet the layout and minimum font size requirements, with sufficient white space on the top, bottom, and sides of the content. (d) Color. The Model Form must be printed on white or light color paper (such as cream) with black or other contrasting ink color. Spot color may be used to achieve visual interest, so long as the color contrast is distinctive and the color does not detract from the readability of the Model Form. Logos may also be printed in color. (e) Languages. The Model Form may be translated into languages other than English.   Attachment C - Information Required in the Federal Model Privacy Form The information in the Model Form may be modified only as described below:   1. Name of the Licensee or group of affiliated Licensees or institutions providing the notice. Insert the name of the Licensee providing the notice or a common identity of affiliated licensees or institutions jointly providing the notice on the form wherever [name of Licensee] appears. 2. Page one. (a) Last revised date. The Licensee must insert in the upper right-hand corner the date on which the notice was last revised. The information shall appear in minimum 8-point font as “rev. [month/year]” using either the name or number of the month, such as “rev. July 2009” or “rev. 7/09”. (b) General instructions for the “What?” box. (1) The bulleted list identifies the types of personal information that the Licensee collects and shares. All Licensees must use the term “Social Security number” in the first bullet. (2) Licensees must use five (5) of the following terms to complete the bulleted list: income; account balances; payment history; transaction history; transaction or loss history; credit history; credit scores; assets; investment experience; credit-based insurance scores; insurance claim history; medical information; overdraft history; purchase history; account transactions; risk tolerance; medical-related debts; credit card or other debt; mortgage rates and payments; retirement assets; checking account information; employment information; wire transfer instructions. (c) General instructions for the disclosure table. The left column lists reasons for sharing or using personal information. Each reason correlates to a specific legal provision described in Attachment C section 2(d) of this Instruction. In the middle column, each Licensee must provide a “Yes” or “No” response that accurately reflects its information sharing policies and practices with respect to the reason listed on the left. In the right column, each Licensee must provide in each box one of the following three (3) responses, as applicable, that reflects whether a consumer can limit such sharing: “Yes” if it is required to or voluntarily provides an opt-out; “No” if it does not provide an opt-out; or “We don’t share” if it answers “No” in the middle column. Only the sixth row (“For our affiliates to market to you”) may be omitted at the option of the Licensee.   See Attachment C section 2(d)(6) of this Instruction. (d) Specific disclosures and corresponding legal provisions. (1) For our everyday business purposes. This reason incorporates sharing information under Sections 15 and 16 of the Vermont Privacy Regulation and with service providers pursuant to Section 14 of the Vermont Privacy Regulation, other than the purposes specified in Attachment C sections 2(d)(2) or 2(d)(3).   (2) For our marketing purposes. This reason incorporates sharing information with service providers by a Licensee for its own marketing pursuant to Section 14 of the Vermont Privacy Regulation. A Licensee that shares for this reason may choose to provide an opt-out. (3) For joint marketing with other financial companies. This reason incorporates sharing information under joint marketing agreements between two or more Licensees or financial institutions and with any service provider used in connection with such agreements pursuant to Section 14 of the Vermont Privacy Regulation. A Licensee that shares for this reason may choose to provide an opt-out. (4) For our affiliates’ everyday business purposes – information about transactions and experiences. This reason incorporates sharing information specified in sections 603(d)(2)(A)(i) and (ii) of the FCRA and 9 V.S.A. §2480a(2) of the VCRA. A Licensee that shares for this reason may choose to provide an opt-out. (5) For our affiliates’ everyday business purposes – information about creditworthiness. This reason incorporates sharing information pursuant to section 603(d)(2)(A)(iii) of the FCRA and 9 V.S.A. §2480e of the VCRA. Under the FCRA a Licensee that shares for this reason must provide an opt-out. [For Vermont consumers, however, Licensees are reminded that Vermont is an opt-in state and, pursuant to 9 V.S.A. §2480e, a Licensee shall not share information about a Vermont consumer’s creditworthiness for affiliates’ everyday purposes unless the Vermont consumer specifically consents to the sharing of such information.] (6) For our affiliates to market to you. This reason incorporates sharing information specified in section 624 of the FCRA. This reason may be omitted from the disclosure table when: the Licensee does not have affiliates (or does not disclose personal information to its affiliates); the Licensee’s affiliates do not use personal information in a manner that requires an opt-out; or the Licensee provides the affiliate marketing notice separately. Licensees that include this reason must provide an opt-out of indefinite duration. A Licensee that is required to provide an affiliate marketing opt-out, but does not include that opt-out in the Model Form under this part, must comply with section 624 of the FCRA with respect to the initial notice and opt-out and any subsequent renewal notice and opt-out. A Licensee not required to provide an opt-out under this subparagraph may elect to include this reason in the Model Form. (7) For nonaffiliates to market to you. This reason incorporates sharing described in Sections 8 and 11 of the Vermont Privacy Regulation. [For Vermont consumers, Licensees are reminded that Vermont is an opt-in state and a Licensee shall not share personal information with nonaffiliates to market to Vermont consumers unless the Vermont consumer specifically consents to the sharing of such information.] (e) To limit our sharing. A Licensee must include this section of the Model Form only if it provides an opt-out. The word “choice” may be written in either the singular or plural, as appropriate. Licensees must select one or more of the applicable opt-out methods described: telephone, such as by a toll-free number; a Website; or use of a mail-in opt-out form. Licensees may include the words “toll-free” before telephone, as appropriate. A Licensee that allows consumers to opt out online must provide either a specific Web address that takes consumers directly to the opt-out page or a general Web address that provides a clear and conspicuous direct   link to the opt-out page. The opt-out choices made available to the consumer who contacts the licensee through these methods must correspond accurately to the “Yes” responses in the third column of the disclosure table. In the part titled “Please note” Licensees may insert a number that is 30 or greater in the space marked “[30].” Instructions on voluntary or state privacy law opt-out information are in Attachment C section 2(g)(5) of these Instructions. [For Vermont consumers Licensee are reminded that Vermont is an opt-in state with respect to section 2 (d)(5), For our affiliates’ everyday business purposes – information about creditworthiness, and with respect to section 2 (d)(7), For nonaffiliates to market to you.] (f) Questions box. Customer service contact information must be inserted as appropriate, where [phone number] or [website] appear. Licensees may elect to provide either a phone number, such as a toll-free number, or a Web address, or both. Licensees may include the words “toll-free” before the telephone number, as appropriate. (g) Mail-in opt-out form. Licensees must include this mail-in form only if they state in the “To limit our sharing” box that consumers can opt out by mail. The mail-in form must provide opt-out options that correspond accurately to the “Yes” responses in the third column in the disclosure table. Licensees that require customers to provide only name and address may omit the section identified as “[account #].” Licensees that require additional or different information, such as a random opt-out number or a truncated account number, to implement an opt-out election should modify the “[account #]” reference accordingly. This includes Licensees that require customers with multiple accounts to identify each account to which the opt-out should apply. A Licensee must enter its opt-out mailing address: in the far right of this form (see version 3); or below the form (see version 4). The reverse side of the mail-in opt-out form must not include any content of the Model Form. (1) Joint accountholder. Only Licensees that provide their joint accountholders the choice to opt out for only one accountholder, in accordance with Attachment C section 3(a)(5) of these Instructions, must include in the far left column of the mail-in form the following statement: “If you have a joint account, your choice(s) will apply to everyone on your account unless you mark below. □ Apply my choice(s) only to me.” The word “choice” may be written in either the singular or plural, as appropriate. Licensees that provide insurance products or services, provide this option, and elect to use the Model Form may substitute the word “policy” for “account” in this statement. Licensees that do not provide this option may eliminate this left column from the mailin form. [For Vermont joint accountholders, whenever opt-in consent is required, the Licensee may only disclose nonpublic personal financial information after obtaining an affirmative consent from the customer. Joint information may only be disclosed after obtaining the affirmative consent of all joint accountholders.] (2) FCRA Section 603(d)(2)(A)(iii) opt-out. If the Licensee shares personal information pursuant to section 603(d)(2)(A)(iii) of the FCRA, it must include in the mail-in opt-out form the following statement: “□ Do not share information about my creditworthiness with your affiliates for their everyday business purposes.” [For Vermont consumers, the Licensee may not share information about the consumer’s creditworthiness with affiliates without first obtaining the Vermont consumer’s affirmative consent. See 9 V.S.A. §2480e.]   (3) FCRA Section 624 opt-out. If the Licensee incorporates section 624 of the FCRA in accord with Attachment C section 2(d)(6) of these Instructions, it must include in the mail-in optout form the following statement: “□ Do not allow your affiliates to use my personal information to market to me.” (4) Nonaffiliate opt-out. If the Licensee shares personal information for nonaffiliates to market to consumers, it must include in the mail-in opt-out form the following statement: “□ Do not share my personal information with nonaffiliates to market their products and services to me.” [For Vermont consumers, the Licensee may not share personal information with nonaffiliates to market their products or services to the consumer unless the Vermont consumer affirmatively consents to the sharing of such information. See Section 11 of the Vermont Privacy Regulation.] (5) Additional opt-outs. Licensees that use the disclosure table to provide opt-out options beyond those required by Federal law or state law must provide those opt-outs in this section of the Model Form. A Licensee that chooses to offer an opt-out for its own marketing in the mail-in optout form must include one of the two following statements: “□ Do not share my personal information to market to me.” or “□ Do not use my personal information to market to me.” A Licensee that chooses to offer an opt-out for joint marketing must include the following statement: “□ Do not share my personal information with other financial institutions to jointly market to me.” (h) Barcodes. A Licensee may elect to include a barcode and/or “tagline” (an internal identifier) in 6-point font at the bottom of page one, as needed for information internal to the institution, so long as these do not interfere with the clarity or text of the form. 3. Page two.   (a) General Instructions for the Questions. Certain of the Questions may be customized as follows: (1) “Who is providing this notice?” This question may be omitted where only one Licensee provides the Model Form and that Licensee is clearly identified in the title on page one. Two or more Licensees or financial institutions that jointly provide the Model Form must use this question to identify themselves as required by Section 10(F) of the Vermont Privacy Regulation. Where the list of Licensees or financial institutions exceeds four (4) lines, the Licensee must describe in the response to this question the general types of Licensees or financial institutions jointly providing the notice and must separately identify those Licensees or financial institutions, in minimum 8- point font, directly following the “Other important information” box, or, if that box is not included in the institution’s form, directly following the “Definitions.” The list may appear in a multicolumn format. (2) “How does [name of Licensee] protect my personal information?” The Licensee may only provide additional information pertaining to its safeguards practices following the designated response to this question. Such information may include information about the Licensee’s use of cookies or other measures it uses to safeguard personal information. Licensees are limited to a maximum of 30 additional words. (3) “How does [name of Licensee] collect my personal information?” Licensees must use five (5) of the following terms to complete the bulleted list for this question: open an account;   deposit money; pay your bills; apply for a loan; use your credit or debit card; seek financial or tax advice; apply for insurance; pay insurance premiums; file an insurance claim; seek advice about your investments; buy securities from us; sell securities to us; direct us to buy securities; direct us to sell your securities; make deposits or withdrawals from your account; enter into an investment advisory contract; give us your income information; provide employment information; give us your employment history; tell us about your investment or retirement portfolio; tell us about your investment or retirement earnings; apply for financing; apply for a lease; provide account information; give us your contact information; pay us by check; give us your wage statements; provide your mortgage information; make a wire transfer; tell us who receives the money; tell us where to send the money; show your government-issued ID; show your driver’s license; order a commodity futures or option trade. Licensees that collect personal information from their affiliates and/or credit bureaus must include after the bulleted list the following statement: “We also collect your personal information from others, such as credit bureaus, affiliates, or other companies.” Licensees that do not collect personal information from their affiliates or credit bureaus but do collect information from other companies must include the following statement instead: “We also collect your personal information from other companies.” Only Licensees that do not collect any personal information from affiliates, credit bureaus, or other companies can omit both statements. (4) “Why can’t I limit all sharing?” Licensees that describe state privacy law provisions in the “Other important information” box must use the bracketed sentence: “See below for more on your rights under state law.” Other Licensees must omit this sentence. (5) “What happens when I limit sharing for an account I hold jointly with someone else?” Only Licensees that provide opt-out options must use this question. Other licensees must omit this question. Licensees must choose one of the following two statements to respond to this question: “Your choices will apply to everyone on your account.” or “Your choices will apply to everyone on your account–unless you tell us otherwise.” Licensees that provide insurance products or services and elect to use the Model Form may substitute the word “policy” for “account” in these statements. [For Vermont joint accountholders, whenever opt-in consent is required, the Licensee may only disclose nonpublic personal financial information after obtaining an affirmative consent from the consumer. Joint information may only be disclosed after obtaining the affirmative consent of all joint accountholders.] (b) General Instructions for the Definitions. The Licensee must customize the space below the responses to the three definitions in this section. This specific information must be in italicized lettering to set off the information from the standardized definitions. (1) Affiliates. As required by Section 7(A)(3) of the Vermont Privacy Regulation, where [affiliate information] appears, the Licensee must: (i) If it has no affiliates, state: “[name of Licensee] has no affiliates”; (ii) If it has affiliates but does not share personal information, state: “[name of Licensee] does not share with our affiliates”; or (iii) If it shares with its affiliates, state, as applicable: “Our affiliates include companies with a [common corporate identity of Licensee] name; financial companies such as [insert   illustrative list of companies]; nonfinancial companies, such as [insert illustrative list of companies;] and others, such as [insert illustrative list].” (2) Nonaffiliates. As required by Section 7 (C)(3) of the Vermont Privacy Regulation, where [nonaffiliate information] appears, the Licensee must: (i) If it does not share with nonaffiliated third parties, state: “[name of Licensee] does not share with nonaffiliates so they can market to you”; or   (ii) If it shares with nonaffiliated third parties, state, as applicable: ‘‘Nonaffiliates we share with can include [list categories of companies such as mortgage companies, insurance companies, direct marketing companies, and nonprofit organizations].” (3) Joint Marketing. As required by Section 14 of the Vermont Privacy Regulation, where [joint marketing] appears, the Licensee must: (i) If it does not engage in joint marketing, state: “[name of Licensee] doesn’t jointly market”; or (ii) If it shares personal information for joint marketing, state, as applicable: “Our joint marketing partners include [list categories of companies such as credit card companies].” (c) General instructions for the “Other important information” box. This box is optional. The space provided for information in this box is not limited. Only the following types of information can appear in this box. (1) State and/or international privacy law information; and/or   (2) Acknowledgment of receipt form. [For Vermont consumers, the body of this Bulletin #188 includes sample language to describe Vermont privacy law.]