(a) In general The Secretary of the Treasury, in conjunction with the Federal functional regulators and the Federal Trade Commission , shall conduct a study of information sharing practices among financial institutions and their affiliates. Such study shall include— (1) the purposes for the sharing of confidential customer information with affiliates or with nonaffiliated third parties; (2) the extent and adequacy of security protections for such information; (3) the potential risks for customer privacy of such sharing of information; (4) the potential benefits for financial institutions and affiliates of such sharing of information; (5) the potential benefits for customers of such sharing of information; (6) the adequacy of existing laws to protect customer privacy; (7) the adequacy of financial institution privacy policy and privacy rights disclosure under existing law; (8) the feasibility of different approaches, including opt-out and opt-in, to permit customers to direct that confidential information not be shared with affiliates and nonaffiliated third parties; and (9) the feasibility of restricting sharing of information for specific uses or of permitting customers to direct the uses for which information may be shared. (b) Consultation The Secretary shall consult with representatives of State insurance authorities designated by the National Association of Insurance Commissioners, and also with financial services industry, consumer organizations and privacy groups, and other representatives of the general public, in formulating and conducting the study required by subsection (a). (c) Report On or before January 1, 2002 , the Secretary shall submit a report to the Congress containing the findings and conclusions of the study required under subsection (a), together with such recommendations for legislative or administrative action as may be appropriate. ( Pub. L. 106–102, title V, § 508 , Nov. 12, 1999 , 113 Stat. 1442 .) CFR Title Parts 12 332 , 334 , 716 16 313 17 160 , 248