Non-Public Personal Information (NPPI) refers to details about a consumer’s financial data that a bank, lender, or other financial institution collects or shares. Understanding NPPI is essential for protecting personal financial information and asserting rights under federal privacy laws. This article explains what counts as NPPI, how it can be shared, and the privacy rights Americans have to access, restrict, or control that information. It also highlights practical steps to safeguard NPPI and what to expect from privacy notices.
What NPPI Means And The GLBA Framework
NPPI is defined under the Gramm-Leach-Bliley Act (GLBA) as information that a financial institution collects about a consumer in connection with financial products or services, such as account numbers, credit histories, income, and payment histories, that is not publicly available. The GLBA creates obligations for financial institutions to protect NPPI and to disclose how they collect, share, and safeguard it. Institutions must provide a Privacy Notice that explains what NPPI they handle, who they share it with, and the consumer’s rights to opt out of certain sharing.
What Counts As NPPI
NPPI includes information that is not considered public. Common examples are a consumer’s name, address, Social Security number, account balances, loan details, transaction histories, credit scores, and investment data collected in the course of providing financial services. Even aggregated data tied to an individual in a way that can identify them may be NPPI if it can link back to the consumer. The key factor is whether the information can be used to identify or contact an individual and relates to their financial activities.
How NPPI Is Shared And With Whom
Under GLBA, NPPI may be shared with affiliates and non-affiliates, but the scope is limited by opt-out rights and privacy notices. Financial institutions can share NPPI with service providers, auditors, and certain business partners to deliver products or services, subject to safeguards. Sharing with non-affiliates for marketing purposes typically requires an opt-out choice. Consumers should receive clear Privacy Notices that outline sharing practices, purposes, and third parties involved. If a consumer elects to opt out of sharing for marketing or other restricted purposes, institutions must honor that choice.
Your Rights Under NPPI Privacy Notices
Federal law requires clear, accessible Privacy Notices from financial institutions. Key rights include the ability to:
- Access and Review NPPI: Consumers can request a copy of the personal information the institution holds about them and how it is used.
- Opt Out Of Certain Sharing: Consumers can opt out of sharing NPPI with non-affiliates for marketing or other purposes beyond the essential service delivery.
- Limit Disclosure: When possible, consumers can limit how NPPI is disclosed to third parties and affiliates.
- Correct Inaccurate Information: If NPPI is inaccurate, consumers can request corrections or updates.
- Receive Clear Notices: Privacy notices should explain what information is collected, how it is used, who it is shared with, and how to exercise rights.
Taking control of NPPI involves a few actionable steps:
- Review Privacy Notices Regularly: Compare notices year over year to understand changes in data practices or third-party sharing.
- Submit Opt-Out Requests: Use the method specified in the privacy notice to opt out of sharing NPPI with non-affiliates for marketing purposes.
- Check For Data Security Practices: Look for mentions of encryption, access controls, breach notification, and vendor risk management in the institution’s security measures.
- Monitor Account Activity: Regularly review statements and online account activity to detect unauthorized access or unusual transactions.
- Request Access And Corrections: If a contact method or personal data appears incorrect, contact the institution to request a review or correction.
Financial institutions must implement safeguards to protect NPPI under GLBA and relevant state laws. Common protections include:
- Access Controls: Multi-factor authentication and role-based access to limit who can view NPPI.
- Encryption: Encryption for data at rest and in transit to prevent interception or leakage.
- Vendor Management: Due diligence and contractual protections with third-party service providers handling NPPI.
- Security Audits: Regular audits, risk assessments, and incident response planning to identify and address vulnerabilities.
- Employee Training: Ongoing training on data privacy, security best practices, and incident reporting.
Consumers can exercise NPPI rights by following the instructions in the privacy notice, which often include:
- Submitting a Written Request or using an online portal to access NPPI data.
- Using Opt-Out Mechanisms provided in the notice or on the financial institution’s website.
- Providing Verification to confirm identity before processing requests to protect against fraud.
- Contacting Compliance Or Privacy Offices for guidance on specific requests or to report concerns.
Clarifying misconceptions helps consumers make informed choices:
- “All my financial data is public”: NPPI is not public; it is protected and not freely shared without consent or a legitimate purpose.
- “Opting out stops all data collection”: Opting out limits certain disclosures, but institutions may still collect and use data for operations and service delivery.
- “Privacy notices are optional”: Privacy notices are required by law and must be provided by financial institutions when they collect NPPI.
If there is suspected misuse or unauthorized disclosure of NPPI, consumers can file complaints with the institution’s privacy or compliance office. If the response is unsatisfactory, complaints can be escalated to federal oversight bodies, such as the Consumer Financial Protection Bureau (CFPB), or state consumer protection agencies. Breaches or improper handling of data may trigger remediation actions, including freezes, identity theft protections, or legal remedies.
NPPI encompasses sensitive financial information not publicly available. The GLBA requires clear privacy notices and reasonable safeguards, with consumer rights to access, limit sharing, opt out of certain disclosures, and correct data. Regular review of notices, proactive opt-out requests, and vigilant monitoring of financial activity strengthen personal privacy in the digital age. By understanding NPPI and the rights it affords, individuals can better manage their financial information and reduce exposure to data misuse.