(a) A covered entity, including a group of covered entities or financial institutions that use a common privacy notice, may use the model form, at its option, to meet the content requirements of the privacy notice and opt out notice set out in §22.10 and §22.11 of this title (relating to Information to be Included in Privacy Notices and Form of Opt Out Notice to Consumers and Opt Out Methods).
(b) The model form is a standardized form, including page layout, content, format, style, pagination, and shading. Covered entities seeking to obtain legal safe harbor through use of the model form may modify it only as described in these instructions.
(c) Disclosure of certain information, such as assets, income, and information from a consumer reporting agency, may give rise to obligations under the Fair Credit Reporting Act (15 U.S.C. §§1681 - 1681x) (FCRA), for example, a requirement to permit a consumer to opt out of disclosures to affiliates or designation as a consumer reporting agency if disclosures are made to nonaffiliated third parties.
(d) The word "customer" may be replaced by the word "member" whenever it appears in the model form, as appropriate. A covered entity may replace the term "customer" with another appropriate term as provided under 28 TAC §22.4(c) - (e).
(e) The model form consists of two pages, which may appear on both sides of a single sheet of paper, or may appear on two separate pages. Where a covered entity provides a long list of covered entities or financial institutions at the end of the model form in accord with the instructions in subsection (g)(3)(A)(i) of this section, or provides additional information in accord with the instructions in subsection (g)(3)(C) of this section, and the list or additional information exceeds the space available on page two of the model form, the list or additional information may extend to a third page.
  (1) Page one contents. The first page consists of the following components:
    (A) date last revised in the upper right-hand corner;
    (B) title;
    (C) key frame (Why?, What?, How?);
    (D) disclosure table (Reasons we can share your personal information);
    (E) "To limit our sharing" box, as needed, for the covered entity's opt out information;
    (F) "Questions" box, for customer service contact information; and
    (G) mail-in opt out form, as needed.
  (2) Page two contents. The second page consists of the following components:
    (A) heading (page 2);
    (B) frequently asked questions("Who we are" and "What we do";
    (C) definitions; and
    (D) "Other important information" box, as needed.
(f) The format of the model privacy form may be modified only as described in paragraphs (1) - (5) of this subsection.
  (1) Easily readable type font. Covered entities that use the model form must use an easily readable type font. While a number of factors together produce easily readable type font, covered entities must use a minimum of 10-point font, unless otherwise expressly permitted in these instructions, and sufficient spacing between the lines of type.
  (2) Logo. A covered entity may include a corporate logo on any page of the notice, so long as it does not interfere with the readability of the model form or the space constraints of each page.
  (3) Page size and orientation. Each page of the model form must appear on paper in portrait orientation, the size of which must meet the layout and minimum font size requirements.
  (4) Color. The model form must appear on white or light color paper, for example, cream, with black or other contrasting ink color. Spot color may be used to achieve visual interest, so long as the color contrast is distinctive and the color does not detract from the readability of the model form. Logos may also appear in color.
  (5) Languages. The model form may be translated into languages other than English.
(g) The information required in the model form may be modified only as described in this subsection.
  (1) Name of the covered entity or group of affiliated covered entities or institutions providing the notice. Insert the name of the covered entity providing the notice or a common identity of affiliated covered entities or institutions jointly providing the notice on the form wherever name of covered entity appears.
  (2) Page one instruction.
    (A) Last revised date. The covered entity must insert in the upper right-hand corner the date on which it last revised the notice. The information must appear in minimum 8-point font as "rev. (month/year)" using either the name or number of the month, for example "rev. July 2009" or "rev. 7/09."
    (B) General instructions for the "What?" box.
      (i) The bulleted list identifies the types of personal information the covered entity collects and shares. All covered entities must use the term "Social Security number" in the first bullet.
      (ii) Covered entities must use at least five of the following terms to complete the bulleted list: income, account balances, payment history, transaction history, transaction or loss history, credit history, credit scores, assets, investment experience, credit-based insurance scores, insurance claim history, medical information, overdraft history, purchase history, account transactions, risk tolerance, medical-related debts, credit card or other debt, mortgage rates and payments, retirement assets, checking account information, employment information, and wire transfer instructions.
    (C) General instructions for the disclosure table. The left column lists reasons for sharing or using personal information. Each reason correlates to a specific legal provision described in the instructions in subparagraph (D) of this paragraph. In the middle column, each covered entity must provide a "Yes" or "No" response that accurately reflects its information-sharing policies and practices with respect to the reason listed on the left. In the right column, each covered entity must provide in each box one of the following three responses, as applicable, that reflects whether a consumer can limit such sharing:
      (i) "Yes" if it is required to or voluntarily provides an opt out;
      (ii) "No" if it does not provide an opt out; or
      (iii) "We don't share" if it answers "No" in the middle column. Only the sixth row, "For our affiliates to market to you," may be omitted at the option of the covered entity as described in the instructions in subparagraph (D)(vi) of this paragraph.
    (D) Specific disclosures and corresponding legal provisions.
      (i) For our everyday business purposes. This reason incorporates sharing information under §22.18 and §22.19 of this title (relating to Exceptions to Notice and Opt Out Requirements for Disclosure of Nonpublic Personal Financial information for Processing and Servicing Transactions and Other Exceptions to Notice and Opt Out Requirements for Disclosure of Nonpublic Personal Financial Information) and with service providers under §22.17 of this title (relating to Exception to Opt Out Requirements for Disclosure of Nonpublic Personal Financial Information for Service Providers and Joint Marketing), other than the purposes specified in the instructions in clause (ii) or (iii) of this subparagraph.
      (ii) For our marketing purposes. This reason incorporates sharing information with service providers by a covered entity for its own marketing under §22.17 of this title. A covered entity that shares for this reason may choose to provide an opt out.
      (iii) For joint marketing with other financial companies. This reason incorporates sharing information under joint marketing agreements between two or more covered entities or financial institutions and with any service provider used in connection with such agreements under §22.17 of this title. A covered entity that shares for this reason may choose to provide an opt out.
      (iv) For our affiliates' everyday business purposes - information about transactions and experiences. This reason incorporates sharing information specified in §603(d)(2)(A)(i) and §603(d)(2)(A)(ii) of the FCRA. A covered entity that shares for this reason may choose to provide an opt out.
      (v) For our affiliates' everyday business purposes - information about creditworthiness. This reason incorporates sharing information under §603(d)(2)(A)(iii) of the FCRA. A covered entity that shares for this reason must provide an opt out.
Cont'd...