OAR 836-080-0655: Revised Privacy Notices

(1) Except as otherwise authorized in OAR 836-080-0600 to 836-080-0700, a licensee shall not, directly or through an affiliate, disclose any personal financial information about a consumer to a nonaffiliated third party under AR 836-080-0675 other than as described in the initial notice that the licensee provided to the consumer under 836-080-0620, unless: (a) The licensee has provided to the consumer a clear and conspicuous revised notice that accurately describes its policies and practices; (b) The licensee has given the consumer a reasonable opportunity, before the licensee discloses personal financial information to the nonaffiliated third party, to opt out of the disclosure; and (c) The consumer does not opt out. (2) Except as otherwise allowed by OAR 836-080-0670, a licensee shall provide a revised notice to the consumer under section (1) of this rule before the licensee, for example: (a) Discloses a new category of personal financial information to a nonaffiliated third party; (b) Discloses personal financial information to a new category of nonaffiliated third party; or (c) Discloses personal financial information about a former customer to a nonaffiliated third party, if that former customer has not had the opportunity to indicate that the former customer does not want disclosure. (3) A revised privacy notice under this rule shall be delivered according to OAR 836-080-0660. (4) The prohibition in section (1) of this rule and the requirements of section (2) of this rule do not apply with respect to a revision of an initial notice, the sole purpose of which is to incorporate a notice of a disclosure of personal information for which authorization is not required by OAR 836-080-0670 or 836-080-0675.