Disclosing Non-Public Personal Information (NPPI) without obtaining the consumer's consent is a violation of the Gramm-Leach-Bliley Act (GLBA). The GLBA mandates that financial institutions must establish safeguards and privacy policies to protect consumers' private information. A key provision of the Act requires institutions to have a clear policy regarding the sharing of NPPI, which includes obtaining consent from consumers before any disclosure.
When an institution shares NPPI without consent, it compromises consumer privacy and undermines the protections that the GLBA is designed to uphold. This practice not only violates the legal requirements set forth by the Act but also places consumers at risk of identity theft and other privacy breaches.
In contrast, maintaining the security of consumer data, providing privacy notices to consumers, and allowing them to opt out of data sharing are all compliant with the regulations established by the GLBA, as they focus on protecting consumer information and respecting their privacy choices. These practices reinforce the fundamental purpose of the GLBA in safeguarding financial information.