What must a GLBA privacy notice describe?

• A. Privacy notices describing information collection, sharing practices, and opt-out rights.
• B. Opt-out rights are optional.
• C. Nonpublic information can be shared with anyone without notice.
• D. Privacy notices must be kept confidential and not provided to customers.

Answer: (A)

Under the GLBA, a privacy notice must spell out what information is collected, how that information is shared, and the consumer’s right to opt out of certain sharing. This notice lets customers understand the institution’s data practices and know how they can control disclosures to nonaffiliated third parties. The other statements conflict with GLBA requirements: opt-out rights aren’t optional to disclose, sharing nonpublic information without notice isn’t allowed, and notices must be provided to customers rather than kept secret.