OAR 836-080-0531
Revised Privacy Notices
(1)
Except as otherwise authorized in OAR 836-080-0501 (Authority; Rule of Construction; Applicability) to 836-080-0551 (Authorization Request Delivery), a licensee shall not, directly or through an affiliate, disclose any personal financial information about a consumer to a nonaffiliated third party under ORS 746.665 (Limitations and conditions on disclosure of certain information)(1)(k) other than as described in the initial notice that the licensee provided to the consumer under 746.620 (Notice of insurance information practices) and OAR 836-080-0501 (Authority; Rule of Construction; Applicability) to 836-080-0551 (Authorization Request Delivery), unless:(a)
The licensee has provided to the consumer a clear and conspicuous revised notice that accurately describes its policies and practices;(b)
The licensee has given the consumer a reasonable opportunity, before the licensee discloses personal financial information to the nonaffiliated third party, to opt out of the disclosure; and(c)
The consumer does not opt out.(2)
Except as otherwise allowed by ORS 746.665 (Limitations and conditions on disclosure of certain information)(1)(a) to (j) and (m) to (q), a licensee shall provide a revised notice to the consumer under section (1) of this rule before the licensee, for example:(a)
Discloses a new category of personal financial information to a nonaffiliated third party;(b)
Discloses personal financial information to a new category of nonaffiliated third party; or(c)
Discloses personal financial information about a former customer to a nonaffiliated third party, if that former customer has not had the opportunity to indicate that the former customer does not want disclosure.(3)
A revised privacy notice under this rule shall be delivered according to OAR 836-080-0536 (Delivery).(4)
The prohibition in section (1) of this rule and the requirements of section (2) of this rule do not apply with respect to a revision of an initial notice, the sole purpose of which is to incorporate a notice of a disclosure of personal information for which authorization is not required by ORS 746.665 (Limitations and conditions on disclosure of certain information).
Source:
Rule 836-080-0531 — Revised Privacy Notices, https://secure.sos.state.or.us/oard/view.action?ruleNumber=836-080-0531
.