Is a lender, in California

Cal. Fin. Code sections 4050 to 4060 · Read the law's page

• Check whether you are a financial institution: an institution whose business is engaging in the financial activities described in section 1843(k) of Title 12 of the United States Code and that does business in California. An institution that is not significantly engaged in financial activities is not one, and neither is an institution primarily engaged in providing hardware, software or interactive services unless it acts as a debt collector or engages in activities for which it must hold a charter, license or registration from a state or federal banking, insurance or securities agency. The definition lists further exclusions, among them providers of professional services barred by professional ethics from disclosing client confidences.
• Do not sell, share, transfer or otherwise disclose a consumer's nonpublic personal information (personally identifiable financial information, which includes information collected through an Internet cookie or an information collecting device from a Web server) to or with a nonaffiliated third party without the consumer's explicit prior consent, unless section 4053(b)(2), section 4054.6 or section 4056 permits the release. A consumer is an individual resident of California who obtains a financial product or service primarily for personal, family or household purposes.
• Obtain that consent on a separate document, not attached to any other, that is dated and signed by the consumer. It must clearly and conspicuously disclose that signing consents to disclosure to nonaffiliated third parties, that the consent stays in effect until revoked or modified, that the consumer may revoke it at any time and how, that you will keep the document or a true copy, that the consumer is entitled to a copy on request, and that the consumer may want to make a copy.
• Do not discriminate against or deny an otherwise qualified consumer a financial product or service because the consumer has not consented to disclosure to a nonaffiliated third party or has directed that information not be shared with an affiliate. You may decline to provide a product or service you could not provide without the disclosure, and may offer incentives or discounts to elicit a response.
• Before sharing nonpublic personal information with an affiliate, notify the consumer clearly and conspicuously and in writing, annually, using the form set out in section 4053(d) or one that meets its requirements, and honor the consumer's direction not to disclose within 45 days of receipt. A consumer may give the direction at any time, and where you have not given the annual notice you must allow 45 days after giving the form before disclosing. The affiliate opt-out does not regulate consumer report information as defined by the federal Fair Credit Reporting Act. No written notice is required if you disclose nothing to a nonaffiliated third party or an affiliate except as the division allows.
• Send the form with a self-addressed first class business reply return envelope if your assets exceed $25,000,000, or with a self-addressed return envelope if your assets are $25,000,000 or less; in place of the first class business reply envelope you may offer a self-addressed return envelope and at least two alternative cost-free means for consumers to communicate their choices, such as a toll-free number, a facsimile to a toll-free number or electronic means, and you must state those means in the form.
• Disclose to an affinity partner (a business that is not a financial institution with which you issue an affinity card or other financial product in its name) only the information section 4054.6 allows, and only if you have given the consumer the section 4053(d) notice and the consumer has not directed otherwise, a written agreement requires the partner to keep the information confidential and use it only to verify membership, verify contact information or offer its own products or services, the list does not reveal or permit extrapolation of other information, and any email sent to a listed address identifies the sender and gives a cost-free way to opt out of further messages. This does not apply to credit cards issued in the name of an entity primarily engaged in retail sales.
• Release information to an affiliate or nonaffiliated third party to perform services for you (such as printing, mailing, data processing or analysis, or customer surveys) only if the services could lawfully be performed by you, a written contract prohibits the recipient from disclosing or using the information other than to carry out the purpose of the disclosure, the information is limited to what the services need, and you receive no payment from or through the recipient.
• As a recipient of nonpublic personal information from a financial institution, do not disclose it to any other entity unless the disclosure would be lawful if the financial institution made it directly. If you received it under a section 4056 exception, use or disclose it only in the ordinary course of business to carry out the activity the exception covers.