Federal regulators are drafting the rules to spell out how consumers' personal information will be protected as barriers between financial businesses come down, because of landmark legislation enacted in November. The law allows banks, investment firms and insurance companies to get involved in each other's businesses.

But it's less widely known that the law's privacy provisions reach beyond banks, Wall Street and insurance to a diverse panoply of "money" businesses. They include consumer finance companies, department stores that issue credit cards, money transmitters and money-order businesses, debt collection agencies, credit bureaus and telemarketing firms that sell financial products.

The definition of "financial activities" is being broadened as traditional distinctions blur in the marketplace.

Importantly, consumers are getting a new right to stop the financial businesses from sharing their personal data with a third party, such as a telemarketer, with some exceptions.

That right, however, doesn't go as far as consumer groups and privacy advocates had wanted. Financial companies with whom you do business will be able to share or sell your data unless you expressly ask them, in writing, not to do so. The onus is on consumers.

Financial and money businesses of all shapes and sizes will have to disclose their privacy policies to customers at least once a year.

"Because the privacy provisions apply to a company doing a financial business, regardless of whether the company is affiliated with a bank, they will apply to a very broad group of companies and industries," said Scott Alvarez, associate general counsel of the Federal Reserve.

That's because financial holding companies are allowed to engage in a wide range of activities, with the new requirement that they abide by the privacy rules. Consumers should get the same protection whether a business is part of a holding company group or stands alone, the government's reasoning goes, so all "money" businesses should be subject to the privacy rules.

The idea is, for example, that if you do business with a mom and pop travel agency, your personal data should be as well protected as that of customers of American Express Co., which has a travel business, banking operations and other financial divisions under the same roof.

The Federal Reserve is among a group of agencies drafting privacy rules for the industries and sectors they regulate, along with the Securities and Exchange Commission, the Office of the Comptroller of the Currency, the Office of Thrift Supervision and others. The Federal Trade Commission is writing the rules for insurance companies and agents and all other affected businesses outside of banks and securities firms.

They're working under a tight deadline, aiming to put out proposed rules for 30 days of public comment in early to mid-February. Under the new law, final regulations must be in place by May.

Officials of several business groups affected by the new privacy rules, contacted by The Associated Press, declined to comment on them because they haven't yet been proposed.

They included the American Society of Travel Agents; the American Financial Services Association, whose members include consumer finance companies, automobile financing divisions and retail chains; and the Community Financial Services Association of America, which represents check-cashing and short-term cash loan businesses.

Some officials of groups representing the banking, securities and insurance industries, which closely followed Congress' lengthy deliberations on the financial overhaul legislation, already have discussed the new privacy rules with regulators.