The correct answer is D, until the customer rescinds direction. This question relates to privacy rules under Regulation S-P, which governs how financial institutions handle customers’ nonpublic personal information.

When a customer exercises their right to opt out of having their personal information shared with nonaffiliated third parties, that decision remains in effect indefinitely. The firm must honor the customer’s opt-out instruction continuously, unless the customer later chooses to revoke or rescind that direction.

Choice A (for one year) is incorrect because there is no expiration period for an opt-out election. Once made, it does not need to be renewed annually. Choice B (as long as the account has a balance) and C (until the account is closed) are also incorrect because the opt-out applies regardless of account status and may even extend beyond account closure in certain recordkeeping contexts.

Regulation S-P ensures customers maintain control over their personal financial information, and firms are required to provide privacy notices and allow customers the ability to opt out at any time.

Thus, the opt-out direction remains valid until the customer changes their mind, making choice D correct.