OAR 836-080-0655
Revised Privacy Notices
(1)
Except as otherwise authorized in OAR 836-080-0600 (Authority; Rule of Construction; Applicability) to 836-080-0700 (Correction, Amendment or Deletion of Recorded Personal Information), a licensee shall not, directly or through an affiliate, disclose any personal financial information about a consumer to a nonaffiliated third party under AR 836-080-0675 (Disclosure Without Authorization) other than as described in the initial notice that the licensee provided to the consumer under 836-080-0620 (Notice of Personal Financial Information Practices), unless:(a)
The licensee has provided to the consumer a clear and conspicuous revised notice that accurately describes its policies and practices;(b)
The licensee has given the consumer a reasonable opportunity, before the licensee discloses personal financial information to the nonaffiliated third party, to opt out of the disclosure; and(c)
The consumer does not opt out.(2)
Except as otherwise allowed by OAR 836-080-0670 (Authorization Exemptions), a licensee shall provide a revised notice to the consumer under section (1) of this rule before the licensee, for example:(a)
Discloses a new category of personal financial information to a nonaffiliated third party;(b)
Discloses personal financial information to a new category of nonaffiliated third party; or(c)
Discloses personal financial information about a former customer to a nonaffiliated third party, if that former customer has not had the opportunity to indicate that the former customer does not want disclosure.(3)
A revised privacy notice under this rule shall be delivered according to OAR 836-080-0660 (Delivery).(4)
The prohibition in section (1) of this rule and the requirements of section (2) of this rule do not apply with respect to a revision of an initial notice, the sole purpose of which is to incorporate a notice of a disclosure of personal information for which authorization is not required by OAR 836-080-0670 (Authorization Exemptions) or 836-080-0675 (Disclosure Without Authorization).
Source:
Rule 836-080-0655 — Revised Privacy Notices, https://secure.sos.state.or.us/oard/view.action?ruleNumber=836-080-0655
.