Law / United States / 
California
California Financial Information Privacy Act
Officially California Financial Information Privacy Act: consent and opt-out for sharing nonpublic personal information
Cal. Fin. Code sections 4050 to 4060
In force since .
A data subject rights rule binding private bodies.
- Obligation class
- Consent, Disclosure, Data subject rights
- Audit expectation
- none
As of .
What it requires
- Check whether you are a financial institution: an institution whose business is engaging in the financial activities described in section 1843(k) of Title 12 of the United States Code and that does business in California. An institution that is not significantly engaged in financial activities is not one, and neither is an institution primarily engaged in providing hardware, software or interactive services unless it acts as a debt collector or engages in activities for which it must hold a charter, license or registration from a state or federal banking, insurance or securities agency. The definition lists further exclusions, among them providers of professional services barred by professional ethics from disclosing client confidences.
- Do not sell, share, transfer or otherwise disclose a consumer's nonpublic personal information (personally identifiable financial information, which includes information collected through an Internet cookie or an information collecting device from a Web server) to or with a nonaffiliated third party without the consumer's explicit prior consent, unless section 4053(b)(2), section 4054.6 or section 4056 permits the release. A consumer is an individual resident of California who obtains a financial product or service primarily for personal, family or household purposes.
- Obtain that consent on a separate document, not attached to any other, that is dated and signed by the consumer. It must clearly and conspicuously disclose that signing consents to disclosure to nonaffiliated third parties, that the consent stays in effect until revoked or modified, that the consumer may revoke it at any time and how, that you will keep the document or a true copy, that the consumer is entitled to a copy on request, and that the consumer may want to make a copy.
- Do not discriminate against or deny an otherwise qualified consumer a financial product or service because the consumer has not consented to disclosure to a nonaffiliated third party or has directed that information not be shared with an affiliate. You may decline to provide a product or service you could not provide without the disclosure, and may offer incentives or discounts to elicit a response.
- Before sharing nonpublic personal information with an affiliate, notify the consumer clearly and conspicuously and in writing, annually, using the form set out in section 4053(d) or one that meets its requirements, and honor the consumer's direction not to disclose within 45 days of receipt. A consumer may give the direction at any time, and where you have not given the annual notice you must allow 45 days after giving the form before disclosing. The affiliate opt-out does not regulate consumer report information as defined by the federal Fair Credit Reporting Act. No written notice is required if you disclose nothing to a nonaffiliated third party or an affiliate except as the division allows.
- Send the form with a self-addressed first class business reply return envelope if your assets exceed $25,000,000, or with a self-addressed return envelope if your assets are $25,000,000 or less; in place of the first class business reply envelope you may offer a self-addressed return envelope and at least two alternative cost-free means for consumers to communicate their choices, such as a toll-free number, a facsimile to a toll-free number or electronic means, and you must state those means in the form.
- Disclose to an affinity partner (a business that is not a financial institution with which you issue an affinity card or other financial product in its name) only the information section 4054.6 allows, and only if you have given the consumer the section 4053(d) notice and the consumer has not directed otherwise, a written agreement requires the partner to keep the information confidential and use it only to verify membership, verify contact information or offer its own products or services, the list does not reveal or permit extrapolation of other information, and any email sent to a listed address identifies the sender and gives a cost-free way to opt out of further messages. This does not apply to credit cards issued in the name of an entity primarily engaged in retail sales.
- Release information to an affiliate or nonaffiliated third party to perform services for you (such as printing, mailing, data processing or analysis, or customer surveys) only if the services could lawfully be performed by you, a written contract prohibits the recipient from disclosing or using the information other than to carry out the purpose of the disclosure, the information is limited to what the services need, and you receive no payment from or through the recipient.
- As a recipient of nonpublic personal information from a financial institution, do not disclose it to any other entity unless the disclosure would be lawful if the financial institution made it directly. If you received it under a section 4056 exception, use or disclose it only in the ordinary course of business to carry out the activity the exception covers.
These lines are LexLint's reading of the law's text, as of . Also read by: American Bankers Association v. Lockyer, No. 05-17163 (9th Cir. ) (recorded ).
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
Section 4057(a): a negligent disclosure or sharing in violation of the division carries a civil penalty of not more than $2,500 per violation, irrespective of the amount of damages suffered by the consumer, and where the release covers more than one individual the total for the negligent violation may not exceed $500,000. Section 4057(b): a knowing and willful obtaining, disclosure, sharing or use carries a civil penalty of not more than $2,500 per individual violation, and the section states no total cap for it. Section 4057(d) doubles the penalties if a violation results in the identity theft of a consumer. Section 4057(c) lists the factors a court weighs, including the entity's total assets and net worth. The $500,000 total applies only to a negligent release covering more than one individual, so no cap is recorded for the row.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 2,500
Who enforces it
Enforcement body
California Attorney General, and the functional regulator of the financial institution: the Department of Financial Protection and Innovation (Division of Financial Institutions) or the appropriate federal authority for banks, savings associations, credit unions, commercial lending companies and bank holding companies; the Department of Insurance for a person engaged in the business of insurance; the Department of Financial Protection and Innovation (Division of Corporations) for an investment broker or dealer, investment company, investment adviser, residential mortgage lender or finance lender; and the Attorney General for any other financial institution. The division creates no private action, and the civil penalties are exclusively assessed and recovered in a civil action brought in the name of the People of California.
Settledness
The Ninth Circuit's opinion concerns the affiliate-sharing provision, section 4053(b)(1), and narrows it to exclude the regulation of consumer report information as defined by the federal Fair Credit Reporting Act.
- As of
- Case link
- https://cdn.ca9.uscourts.gov/datastore/opinions/2008/09/04/0517163.pdf
- Case citation
- American Bankers Association v. Lockyer, No. 05-17163 (9th Cir. )
- Open questions
- What degree of financial activity makes an institution significantly engaged in financial activities for the definition of financial institution, given that section 4052(c) uses the phrase without defining it?
What this law does
A financial institution may not sell, share, transfer or otherwise disclose nonpublic personal information to or with a nonaffiliated third party without the explicit prior consent of the consumer to whom it relates, except as sections 4053, 4054.6 and 4056 provide. A financial institution is an institution whose business is engaging in the financial activities described in section 1843(k) of Title 12 of the United States Code and that does business in California.
An institution that is not significantly engaged in financial activities is not a financial institution. An institution primarily engaged in providing hardware, software or interactive services is not a financial institution, provided that it does not act as a debt collector and does not engage in activities for which it must acquire a charter, license or registration from a state or federal banking, insurance or securities agency.
A consumer is an individual resident of California, or that individual's legal representative, who obtains or has obtained from a financial institution a financial product or service to be used primarily for personal, family or household purposes. Personally identifiable financial information includes such information collected through an Internet cookie or an information collecting device from a Web server.
To obtain consent for disclosure to nonaffiliated third parties, a financial institution must use a separate document that is dated and signed by the consumer, clearly and conspicuously states that signing consents to the disclosure, that the consent remains in effect until revoked or modified, that it may be revoked at any time and how, and that the institution will keep a copy which the consumer may request.
A financial institution may not discriminate against or deny an otherwise qualified consumer a financial product or service because the consumer has not given consent to disclosure to a nonaffiliated third party.
A financial institution may not disclose or share a consumer's nonpublic personal information with an affiliate unless it has clearly and conspicuously notified the consumer annually in writing that the information may be disclosed to an affiliate and the consumer has not directed that it not be disclosed.
The United States Court of Appeals for the Ninth Circuit has narrowed the affiliate-sharing provision, section 4053(b)(1), to exclude the regulation of consumer report information as defined by the federal Fair Credit Reporting Act. The affiliate notice must be sent on the form the section sets out or on a form that meets the requirements listed in subparagraphs (A) to (L) of the section.
A consumer may direct at any time that nonpublic personal information not be disclosed, and a financial institution must comply with the direction within 45 days of receipt. A financial institution need not give the written notice if it does not disclose nonpublic personal information to any nonaffiliated third party or to any affiliate, except as the division allows.
For an affinity card issued in an affinity partner's name, the financial institution may disclose to the partner only the cardholder's name, address, telephone number and email address and a record of purchases made with the card in an establishment, including a Web site, bearing the partner's brand name, subject to the conditions in subdivision (c).
A financial institution may release nonpublic personal information without the consent or notice that sections 4052.5, 4053, 4054 and 4054.6 would otherwise require in the circumstances listed in section 4056, which include a release necessary to effect, administer or enforce a transaction requested or authorized by the consumer.
A release to an affiliate or nonaffiliated third party to perform services such as printing, mailing, data processing or analysis, or customer surveys on the institution's behalf is permitted if the services could lawfully be performed by the institution, a written contract bars other disclosure or use, the information is limited to what the services need, and the institution receives no payment from or through the recipient.
An entity that receives nonpublic personal information from a financial institution may not disclose it to any other entity unless the disclosure would be lawful if made directly by the financial institution, and a recipient under a section 4056 exception may use or disclose it only in the ordinary course of business to carry out the activity the exception covers.
An entity that negligently discloses or shares nonpublic personal information in violation of the division is liable for a civil penalty not to exceed $2,500 per violation, and not to exceed $500,000 in total where the release covers more than one individual. An entity that knowingly and willfully obtains, discloses, shares or uses nonpublic personal information in violation of the division is liable for a civil penalty not to exceed $2,500 per individual violation.
The civil penalties are doubled if a violation results in the identity theft of a consumer, as defined by section 530.5 of the Penal Code. The civil penalties are exclusively assessed and recovered in a civil action brought in the name of the People of California by the Attorney General or by the functional regulator with jurisdiction over the financial institution.
The division preempts and is exclusive of all local agency ordinances and regulations relating to the use and sharing of nonpublic personal information by financial institutions.
When LexLint raises it
When your app profile says your app provides financial services.