text: Under Section 501 of the Gramm-Leach-Bliley Act, the federal banking agencies have established appropriate 
  standards for financial institutions regarding the implementation of safeguards to ensure the security and 
  confidentiality of customer records and information, protection against any anticipated threats or hazards to the 
  security or integrity of such records and protection against unauthorized access to or use of such records or 
  information in a way that could result in substantial harm or inconvenience to a customer. Among other matters, the 
  rules require each bank to implement a comprehensive written information security program that includes 
  administrative, technical and physical safeguards relating to customer information. 
  
  Under the Gramm-Leach-Bliley Act, a financial institution must also provide its customers with a notice of 
  privacy policies and practices. Section 502 prohibits a financial institution from disclosing nonpublic personal 
  information about a consumer to nonaffiliated third parties unless the institution satisfies various notice and opt-out 
  requirements and the customer has not elected to opt out of the disclosure. Under Section 504, the agencies are 
  authorized to issue regulations as necessary to implement notice requirements and restrictions on a financial 
  institution’s ability to disclose nonpublic personal information about consumers to nonaffiliated third parties. 
  Under the final rule the regulators adopted, all banks must develop initial and annual privacy notices which describe 
  in general terms the bank’s information sharing practices. Banks that share nonpublic personal information about 
  customers with nonaffiliated third parties must also provide customers with an opt-out notice and a reasonable 
  period of time for the customer to opt out of any such disclosure (with certain exceptions). Limitations are placed on 
  the extent to which a bank can disclose an account number or access code for credit card, deposit, or transaction 
  accounts to any nonaffiliated third party for use in marketing. 