OAR 836-080-0531: Revised Privacy Notices

(1) Except as otherwise authorized in OAR 836-080-0501 to 836-080-0551, a licensee shall not, directly or through an affiliate, disclose any personal financial information about a consumer to a nonaffiliated third party under ORS 746.665(1)(k) other than as described in the initial notice that the licensee provided to the consumer under 746.620 and OAR 836-080-0501 to 836-080-0551, unless: (a) The licensee has provided to the consumer a clear and conspicuous revised notice that accurately describes its policies and practices; (b) The licensee has given the consumer a reasonable opportunity, before the licensee discloses personal financial information to the nonaffiliated third party, to opt out of the disclosure; and (c) The consumer does not opt out. (2) Except as otherwise allowed by ORS 746.665(1)(a) to (j) and (m) to (q), a licensee shall provide a revised notice to the consumer under section (1) of this rule before the licensee, for example: (a) Discloses a new category of personal financial information to a nonaffiliated third party; (b) Discloses personal financial information to a new category of nonaffiliated third party; or (c) Discloses personal financial information about a former customer to a nonaffiliated third party, if that former customer has not had the opportunity to indicate that the former customer does not want disclosure. (3) A revised privacy notice under this rule shall be delivered according to OAR 836-080-0536. (4) The prohibition in section (1) of this rule and the requirements of section (2) of this rule do not apply with respect to a revision of an initial notice, the sole purpose of which is to incorporate a notice of a disclosure of personal information for which authorization is not required by ORS 746.665.