3rd Party Companies and the Gramm-Leech-Bliley act

It seems like the GLB privacy act applies to financial institution that has the relationship with the consumer/customer. Does it also apply to 3rd party companies that the financial institution uses?

For instance…
John Doe goes to ABC Mortgage for a home loan. ABC Mortgage has to adhere to GLB since John Doe is their customer.

As part of the mortgage transaction, ABC Mortgage sends John Doe’s personal information to XYZ Appraisal Company.

Does XYZ Appraisal Company have to adhere to Gramm-Leech-Bliley? After all, John Doe is not their customer… ABC Mortgage is.

Thanks in advance!
-Jeff