; and (B) upon receipt of a notice described under subparagraph (A), the nonaffiliated third party may not share any nonpublic information of such individual already received from the financial institution. (2) Rulemaking The agencies referred to in section 504 shall issue rules to establish the requirements for notices under paragraph (1), including the form of such notices, taking into account any privacy risks posed by such notices. (g) Requirements with respect to the collection of consumer account credentials A financial institution may not collect from an individual with whom such financial institution has a customer or consumer relationship account credentials such individual uses to access an account at a nonaffiliated third party that is a financial institution unless, prior to collecting the consumer account credentials— (1) the financial institution clearly and conspicuously discloses to the consumer, in a form permitted by the regulations prescribed under section 504— (A) that the financial institution is collecting such account credentials; (B) how such credentials will be used by the financial institution; and (C) whether such credentials may be disclosed to a nonaffiliated third party; and (2) such individual is given an opportunity to direct that such credentials not be collected or to direct that such credentials not be disclosed to any nonaffiliated third party. . (b) Conforming amendment Section 509(3)(D) of the Gramm-Leach-Bliley Act ( 15 U.S.C. 6809(3)(D) ) is amended by striking section 502(e)(1)(C) and inserting section 502(e)(1)(D)(ii) . 4. Disclosure of institution privacy policy Section 503 of the Gramm-Leach-Bliley Act ( 15 U.S.C. 6803 ) is amended— (1) in subsection (a)— (A) by striking customer relationship with a consumer and inserting customer or consumer relationship ; (B) by striking clear and conspicuous disclosure to such consumer and inserting clear and conspicuous disclosure to such individual with whom such financial institution has a customer or consumer relationship