§ 1033.411 Authorization disclosure.

(a) In general. To comply with § 1033.401(a), a third party must provide the consumer with an authorization disclosure electronically or in writing. The authorization disclosure must be clear, conspicuous, and segregated from other material. The names included in the authorization disclosure as required by paragraphs (b)(1) and (2) of this section and by § 1033.431(b) must be readily understandable to the consumer. (b) Content. The authorization disclosure must include: (1) The name of the third party that will be authorized to access covered data pursuant to the third party authorization procedures in § 1033.401. (2) The name of the data provider that controls or possesses the covered data that the third party identified in paragraph (b)(1) of this section seeks to access on the consumer's behalf. (3) A brief description of the product or service the consumer has requested from the third party identified in paragraph (b)(1) of this section and a statement that the third party will collect, use, and retain the consumer's data only as reasonably necessary to provide that product or service to the consumer. (4) The categories of data that will be accessed. Categories must have a substantially similar level of specificity as the categories in § 1033.211. (5) The certification statement described in § 1033.401(b). (6) A brief description of the expected duration of data collection and a statement that collection will not last longer than one year after the consumer's most recent reauthorization. (7) A description of the revocation method described in § 1033.421(h)(1). (c) Language access—(1) In general. The authorization disclosure must be in the same language as the communication in which the authorization disclosure is conveyed to the consumer. Any translation of the authorization disclosure provided to the consumer must be complete and accurate. (2) Additional languages. If the authorization disclosure is in a language other than English, it must include a link to an English-language translation, and it is permitted to include links to translations in other languages. If the authorization disclosure is in English, it is permitted to include links to translations in other languages.