A borrower receives a multi-page document from her mortgage lender at the time of application explaining what personal financial information the lender collects, how it may be shared with affiliates and non-affiliates, and how she can opt out of certain data sharing. Which federal law requires this disclosure?

Correct answer: The Gramm-Leach-Bliley Act (GLBA)

The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to provide customers with a clear privacy notice explaining their information-sharing practices, the types of personal data collected, how that data may be shared with affiliated and non-affiliated third parties, and the consumer's right to opt out of sharing with non-affiliates. GLBA also requires institutions to maintain safeguards protecting the security and confidentiality of customer information. FCRA governs credit reporting and consumer rights regarding their credit reports — not broad privacy disclosures. The BSA focuses on anti-money laundering reporting (SARs, CTRs), not privacy notices. HMDA requires lenders to report lending data for fair lending analysis, not to provide privacy disclosures to individual borrowers.