I'm hoping for confirmation of my thought process.

Our bank is broken into specialty areas, branch banks, auto loan centers, mortgage centers, student loan centers etc.

If a banker from a branch contacts a loan center on behalf of an applicant (usually because the applicant was denied for a loan) how much information can be given to the banker about the credit and reasons for denial.

My thoughts, it would fall under FCRA affiliate sharing. But in this scenario, the applicant has not received our privacy policy because the customer relationship hasn't been established. Therefore, I'm thinking under FCRA we could not disclose any credit related details because the applicant has not been given the opportunity, before the time that the information is initially communicated, to direct that such information not be shared among affiliates.

Am I thinking right? Any thoughts would be appreciated.

One of the first things you need to determine to correctly assess the situation is are these areas just divisions and departments of one legal entity or are they separate legal entities? FCRA primarily applies to sharing across distinct legal entities.

Ken - Thanks for your reply. The areas are clearly different legal entities. That's why I was leaning toward my FCRA opinion.